Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   120 Funde / Logfileauswertung (https://www.trojaner-board.de/188338-120-funde-logfileauswertung.html)

juergen007 06.02.2018 08:22
120 Funde / Logfileauswertung
 
Das letzte hat sich erledigt und kann auch gelöscht werden.
Ich finde "Eröffne neues Thema" nicht und hänge mich hieran mit der Bitte um Kenntnisnahme un Beantwortung:
Ich Habe avira antivir Trial Version noch ein paar Tage.
Die erzählt mir quasi als Motivation 39 € auszugeben, was ich nicht tuen werde, folgendes:
Eine Liste von 120 Dateien in Quarantäne, die als "verdächtige Dateien" bezeichnet werden meist in c:/program files(x86), die ich leider nicht copy / pasten kann.
Oder sind nicht unter Quarantäne gestellte Dateien "harmlosisiert"?
Ich will die aber weg haben, wer braucht die? Löschen und wipe.
Vorher hatte ich lösche sämtliche Browser Verlauf etc. in chrome und firefox ausgeführt.
Übrigens geht auto vervollständigen der URL in FF immer noch, sollte es nicht oder?
Sowie eine Wartungs.cmd - Datei aus einem anderen Forum soll darf ich den Link hier bringen?
ok bitte weil sehr nützlich: https://www.win-10-forum.de/windows-...ungsmodus.html


Sonst habe ich noch microsoft essentials laufen lassen, das im Schnelllauf gar nichts fand.
Folgende neueste Logfiles: das avira meldete sich mit dem mitleiderregenden selbstlosen Kaufbefehl nach all diesen Aktionen und nach reboot!
Kann ich wie gesagt nicht hier als Bild bringen.

Danke!

P.S. Soll ich ein FRST machen?

Jürgen



JRT Logfile:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.1.4 (07.09.2017)
Operating System: Windows 7 Professional x64
Ran by juergen2 (Administrator) on 05.02.2018 at 11:21:18,42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




File System: 8

Successfully deleted: C:\Users\juergen2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H2183XR4 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\juergen2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIUWA25G (Temporary Internet Files Folder)
Successfully deleted: C:\Users\juergen2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VRRE3I4Y (Temporary Internet Files Folder)
Successfully deleted: C:\Users\juergen2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKCJZN90 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H2183XR4 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIUWA25G (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VRRE3I4Y (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZKCJZN90 (Temporary Internet Files Folder)

Deleted the following from C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\prefs.js
user_pref(extensions.webextensions.uuids, {\vdpure@link64\:\47349fd8-5b1d-4f49-95d0-f9c5fc89103f\,\{170503FA-3349-4F17-BC86-001888A5C8E2}\:\f0c47838-edc5-40e6-9444-c



Registry: 0





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.02.2018 at 11:25:52,23
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--- --- ---

Code:
# AdwCleaner 7.0.2.1 - Logfile created on Mon Feb 05 10:11:02 2018
# Updated on 2017/29/08 by Malwarebytes
# Running on Windows 7 Professional (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

Plugin deleted: __MSG_appName__ -
Plugin deleted: SMSfromBrowser -


***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [1601 B] - [2016/9/2 23:20:52]
C:/AdwCleaner/AdwCleaner[C10].txt - [2962 B] - [2017/2/3 11:33:41]
C:/AdwCleaner/AdwCleaner[C11].txt - [3282 B] - [2017/3/3 14:44:46]
C:/AdwCleaner/AdwCleaner[C12].txt - [3513 B] - [2017/3/15 13:2:20]
C:/AdwCleaner/AdwCleaner[C13].txt - [3829 B] - [2017/4/2 12:43:5]
C:/AdwCleaner/AdwCleaner[C14].txt - [4180 B] - [2017/6/18 16:17:28]
C:/AdwCleaner/AdwCleaner[C15].txt - [4101 B] - [2017/6/28 17:14:42]
C:/AdwCleaner/AdwCleaner[C2].txt - [1707 B] - [2016/9/20 18:12:53]
C:/AdwCleaner/AdwCleaner[C3].txt - [1354 B] - [2016/9/28 14:28:40]
C:/AdwCleaner/AdwCleaner[C4].txt - [1503 B] - [2016/10/2 10:0:44]
C:/AdwCleaner/AdwCleaner[C5].txt - [9963 B] - [2016/11/4 0:38:18]
C:/AdwCleaner/AdwCleaner[C6].txt - [2102 B] - [2016/11/15 11:42:40]
C:/AdwCleaner/AdwCleaner[C7].txt - [2381 B] - [2016/11/28 19:18:11]
C:/AdwCleaner/AdwCleaner[C8].txt - [2468 B] - [2016/12/15 17:33:32]
C:/AdwCleaner/AdwCleaner[C9].txt - [3240 B] - [2017/1/16 8:47:55]
C:/AdwCleaner/AdwCleaner[S10].txt - [2196 B] - [2016/11/9 9:1:41]
C:/AdwCleaner/AdwCleaner[S11].txt - [2270 B] - [2016/11/15 11:42:29]
C:/AdwCleaner/AdwCleaner[S12].txt - [2515 B] - [2016/11/28 19:15:23]
C:/AdwCleaner/AdwCleaner[S13].txt - [2602 B] - [2016/12/15 10:13:11]
C:/AdwCleaner/AdwCleaner[S14].txt - [2710 B] - [2016/12/16 9:49:35]
C:/AdwCleaner/AdwCleaner[S15].txt - [2785 B] - [2016/12/30 16:44:39]
C:/AdwCleaner/AdwCleaner[S16].txt - [2859 B] - [2017/1/5 12:27:45]
C:/AdwCleaner/AdwCleaner[S17].txt - [3337 B] - [2017/1/16 8:47:35]
C:/AdwCleaner/AdwCleaner[S18].txt - [3097 B] - [2017/2/3 11:17:24]
C:/AdwCleaner/AdwCleaner[S19].txt - [3347 B] - [2017/2/3 15:56:8]
C:/AdwCleaner/AdwCleaner[S1].txt - [809 B] - [2016/7/21 12:34:46]
C:/AdwCleaner/AdwCleaner[S20].txt - [3416 B] - [2017/3/3 14:43:57]
C:/AdwCleaner/AdwCleaner[S21].txt - [3449 B] - [2017/3/7 19:20:53]
C:/AdwCleaner/AdwCleaner[S22].txt - [3647 B] - [2017/3/15 13:1:59]
C:/AdwCleaner/AdwCleaner[S23].txt - [3671 B] - [2017/3/17 18:44:20]
C:/AdwCleaner/AdwCleaner[S24].txt - [3913 B] - [2017/4/2 12:42:42]
C:/AdwCleaner/AdwCleaner[S25].txt - [4162 B] - [2017/6/5 16:38:10]
C:/AdwCleaner/AdwCleaner[S26].txt - [4236 B] - [2017/6/17 11:46:40]
C:/AdwCleaner/AdwCleaner[S27].txt - [4309 B] - [2017/6/18 16:15:19]
C:/AdwCleaner/AdwCleaner[S28].txt - [4189 B] - [2017/6/21 17:51:48]
C:/AdwCleaner/AdwCleaner[S29].txt - [4031 B] - [2017/6/28 17:11:29]
C:/AdwCleaner/AdwCleaner[S2].txt - [1758 B] - [2016/9/2 22:48:8]
C:/AdwCleaner/AdwCleaner[S3].txt - [1776 B] - [2016/9/20 18:12:25]
C:/AdwCleaner/AdwCleaner[S4].txt - [1522 B] - [2016/9/28 13:55:38]
C:/AdwCleaner/AdwCleaner[S5].txt - [1671 B] - [2016/10/2 10:0:33]
C:/AdwCleaner/AdwCleaner[S6].txt - [1817 B] - [2016/10/6 2:7:2]
C:/AdwCleaner/AdwCleaner[S7].txt - [1887 B] - [2016/10/17 3:6:2]
C:/AdwCleaner/AdwCleaner[S8].txt - [1959 B] - [2016/10/22 0:47:29]
C:/AdwCleaner/AdwCleaner[S9].txt - [10485 B] - [2016/11/4 0:37:40]


########## EOF - C:\AdwCleaner\AdwCleaner[C15].txt ##########



# AdwCleaner 7.0.2.1 - Logfile created on Mon Feb 05 10:11:02 2018
# Updated on 2017/29/08 by Malwarebytes
# Running on Windows 7 Professional (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

Plugin deleted: __MSG_appName__ -
Plugin deleted: SMSfromBrowser -


***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [1601 B] - [2016/9/2 23:20:52]
C:/AdwCleaner/AdwCleaner[C10].txt - [2962 B] - [2017/2/3 11:33:41]
C:/AdwCleaner/AdwCleaner[C11].txt - [3282 B] - [2017/3/3 14:44:46]
C:/AdwCleaner/AdwCleaner[C12].txt - [3513 B] - [2017/3/15 13:2:20]
C:/AdwCleaner/AdwCleaner[C13].txt - [3829 B] - [2017/4/2 12:43:5]
C:/AdwCleaner/AdwCleaner[C14].txt - [4180 B] - [2017/6/18 16:17:28]
C:/AdwCleaner/AdwCleaner[C15].txt - [4101 B] - [2017/6/28 17:14:42]
C:/AdwCleaner/AdwCleaner[C2].txt - [1707 B] - [2016/9/20 18:12:53]
C:/AdwCleaner/AdwCleaner[C3].txt - [1354 B] - [2016/9/28 14:28:40]
C:/AdwCleaner/AdwCleaner[C4].txt - [1503 B] - [2016/10/2 10:0:44]
C:/AdwCleaner/AdwCleaner[C5].txt - [9963 B] - [2016/11/4 0:38:18]
C:/AdwCleaner/AdwCleaner[C6].txt - [2102 B] - [2016/11/15 11:42:40]
C:/AdwCleaner/AdwCleaner[C7].txt - [2381 B] - [2016/11/28 19:18:11]
C:/AdwCleaner/AdwCleaner[C8].txt - [2468 B] - [2016/12/15 17:33:32]
C:/AdwCleaner/AdwCleaner[C9].txt - [3240 B] - [2017/1/16 8:47:55]
C:/AdwCleaner/AdwCleaner[S10].txt - [2196 B] - [2016/11/9 9:1:41]
C:/AdwCleaner/AdwCleaner[S11].txt - [2270 B] - [2016/11/15 11:42:29]
C:/AdwCleaner/AdwCleaner[S12].txt - [2515 B] - [2016/11/28 19:15:23]
C:/AdwCleaner/AdwCleaner[S13].txt - [2602 B] - [2016/12/15 10:13:11]
C:/AdwCleaner/AdwCleaner[S14].txt - [2710 B] - [2016/12/16 9:49:35]
C:/AdwCleaner/AdwCleaner[S15].txt - [2785 B] - [2016/12/30 16:44:39]
C:/AdwCleaner/AdwCleaner[S16].txt - [2859 B] - [2017/1/5 12:27:45]
C:/AdwCleaner/AdwCleaner[S17].txt - [3337 B] - [2017/1/16 8:47:35]
C:/AdwCleaner/AdwCleaner[S18].txt - [3097 B] - [2017/2/3 11:17:24]
C:/AdwCleaner/AdwCleaner[S19].txt - [3347 B] - [2017/2/3 15:56:8]
C:/AdwCleaner/AdwCleaner[S1].txt - [809 B] - [2016/7/21 12:34:46]
C:/AdwCleaner/AdwCleaner[S20].txt - [3416 B] - [2017/3/3 14:43:57]
C:/AdwCleaner/AdwCleaner[S21].txt - [3449 B] - [2017/3/7 19:20:53]
C:/AdwCleaner/AdwCleaner[S22].txt - [3647 B] - [2017/3/15 13:1:59]
C:/AdwCleaner/AdwCleaner[S23].txt - [3671 B] - [2017/3/17 18:44:20]
C:/AdwCleaner/AdwCleaner[S24].txt - [3913 B] - [2017/4/2 12:42:42]
C:/AdwCleaner/AdwCleaner[S25].txt - [4162 B] - [2017/6/5 16:38:10]
C:/AdwCleaner/AdwCleaner[S26].txt - [4236 B] - [2017/6/17 11:46:40]
C:/AdwCleaner/AdwCleaner[S27].txt - [4309 B] - [2017/6/18 16:15:19]
C:/AdwCleaner/AdwCleaner[S28].txt - [4189 B] - [2017/6/21 17:51:48]
C:/AdwCleaner/AdwCleaner[S29].txt - [4031 B] - [2017/6/28 17:11:29]
C:/AdwCleaner/AdwCleaner[S2].txt - [1758 B] - [2016/9/2 22:48:8]
C:/AdwCleaner/AdwCleaner[S3].txt - [1776 B] - [2016/9/20 18:12:25]
C:/AdwCleaner/AdwCleaner[S4].txt - [1522 B] - [2016/9/28 13:55:38]
C:/AdwCleaner/AdwCleaner[S5].txt - [1671 B] - [2016/10/2 10:0:33]
C:/AdwCleaner/AdwCleaner[S6].txt - [1817 B] - [2016/10/6 2:7:2]
C:/AdwCleaner/AdwCleaner[S7].txt - [1887 B] - [2016/10/17 3:6:2]
C:/AdwCleaner/AdwCleaner[S8].txt - [1959 B] - [2016/10/22 0:47:29]
C:/AdwCleaner/AdwCleaner[S9].txt - [10485 B] - [2016/11/4 0:37:40]


########## EOF - C:\AdwCleaner\AdwCleaner[C15].txt ##########
Ich hänge nochmal FRST 64 Scans an:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by juergen2 (06-02-2018 08:14:06)
Running from D:\backupMaxtor80gb\data
Windows 7 Professional Service Pack 1 (X64) (2015-10-31 21:00:58)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-963683855-2343051469-89585254-500 - Administrator - Enabled) => C:\Users\Administrator
Guest (S-1-5-21-963683855-2343051469-89585254-501 - Limited - Disabled)
juergen2 (S-1-5-21-963683855-2343051469-89585254-1000 - Administrator - Enabled) => C:\Users\juergen2

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {B3F630BD-538D-1B4A-14FA-14B63235278F}
AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Avira Antivirus (Enabled - Up to date) {0897D159-75B7-14C4-2E4A-2FC449B26D32}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 18.009.20050 - Adobe Systems Incorporated)
Adobe Flash Player 28 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 28.0.0.137 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (HKLM\...\{F15287C6-10E3-1676-AF50-CB0355A302F1}) (Version: 2.00.0002 - Advanced Micro Devices, Inc.)
AMD APP SDK Runtime (HKLM\...\{503F672D-6C84-448A-8F8F-4BC35AC83441}) (Version: 10.0.873.1 - Advanced Micro Devices Inc.)
AMD Catalyst Control Center (HKLM-x32\...\{20AE3A4E-38CA-C6F8-4E60-5DF41A2CC0AC}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
AMD Catalyst Install Manager (HKLM\...\{7E5DC2C5-115A-322B-976C-219237FAED66}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (HKLM\...\{CF84CD21-FC52-857E-AF41-9DEE9C76D245}) (Version: 2.00.0000 - Advanced Micro Devices, Inc.)
AMD Fuel (HKLM\...\{AA20E9E6-96D0-C201-E44D-F7D921F595FD}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 4.0.0.0 - AppEx Networks)
AMD Steady Video Plug-In  (HKLM\...\{94BFDEF9-D91D-4B5D-8A60-08514C7191AF}) (Version: 2.08.0000 - AMD)
AMD USB 3.0 Device Detector (HKLM\...\{F5733897-B788-4AB1-B399-166A9FBB47A8}) (Version: 2.1.30.0 - Advanced Micro Devices, Inc.)
AMD Wireless Display v3.0 (HKLM\...\{630E5EF7-72F8-9E5D-BEF5-ED85B698E160}) (Version: 1.0.0.15 - Advanced Micro Devices, Inc.)
Arasan 20.2 (HKLM-x32\...\Arasan_is1) (Version:  - )
Avira (HKLM-x32\...\{518c54f5-fd43-4aa6-936b-8d7fd8c85cbd}) (Version: 1.2.103.26908 - Avira Operations GmbH & Co. KG)
Avira (HKLM-x32\...\{E3F659C3-7936-4321-B886-4DA527DA72FE}) (Version: 1.2.103.26908 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.34.20 - Avira Operations GmbH & Co. KG)
Backup and Sync from Google (HKLM-x32\...\{908DB568-E5FA-40C7-A2AA-AB340190858B}) (Version: 3.38.7642.3857 - Google, Inc.)
BCWipe 6.0 (HKLM-x32\...\BCWipe) (Version: 6.08.3 - Jetico Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer Driver Add-On Module (HKLM\...\CANONIJINBOXADDON100) (Version:  - )
Canon MG5500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5500_series) (Version: 1.02 - Canon Inc.)
Catalyst Control Center Graphics Previews Common (HKLM-x32\...\{9114BDDB-A6A6-152D-060A-E99307057AD1}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Catalyst Control Center InstallProxy (HKLM-x32\...\{66CDB8EB-80D3-A762-32B4-80DA61A1C6C8}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Catalyst Control Center Localization All (HKLM-x32\...\{315D9E6B-98B1-1E2B-9E93-B36A0B104224}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Standard (HKLM-x32\...\{703F229F-573E-10E7-3B44-341DB59AD86B}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Traditional (HKLM-x32\...\{489E5436-B101-CAD9-5571-14746675ECE3}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Czech (HKLM-x32\...\{BBA1614E-6470-7841-8A42-ABD5BA7B3FFE}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Danish (HKLM-x32\...\{AA0E1433-8F16-AA01-E8E9-E6408579D0D8}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Dutch (HKLM-x32\...\{504819D1-3C0A-2695-0007-BBDFA5936D68}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help English (HKLM-x32\...\{6C495748-5F03-0B97-568B-76D0368FB460}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Finnish (HKLM-x32\...\{D9CBA021-DB41-9736-923F-52E3E426912D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help French (HKLM-x32\...\{B03A580A-5D67-DAC5-59A1-7AD7C513381C}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help German (HKLM-x32\...\{69DF4822-9B16-CE04-7587-22E09FB5FD1D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Greek (HKLM-x32\...\{968C0E92-6DA9-5784-9A0B-1061D0CB2C14}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Hungarian (HKLM-x32\...\{11BC8F83-7260-65EB-3E0A-FA7AC894B42D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Italian (HKLM-x32\...\{FE4DC915-D724-E72C-EF86-DC5B89961ACF}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Japanese (HKLM-x32\...\{C9353DBC-A47C-2C9B-AF32-5E2C8B4E3D3A}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Korean (HKLM-x32\...\{37DBC990-C514-3821-D6FB-12E0745AA990}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Norwegian (HKLM-x32\...\{79E3071B-8A0C-C105-6442-CF611732601E}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Polish (HKLM-x32\...\{A12E8E1A-A77D-94E5-72F8-E83D6256AF11}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Portuguese (HKLM-x32\...\{AD5E3969-F0C0-ECBF-45E5-C36B84904281}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Russian (HKLM-x32\...\{CFA2067C-AE90-3BF9-06AF-E7E65E679B3D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Spanish (HKLM-x32\...\{110E4EE7-85A9-B76B-B943-C0C1CF0C2F74}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Swedish (HKLM-x32\...\{42A97797-A255-49F9-4250-D58A9CEA2904}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Thai (HKLM-x32\...\{31BC0B51-0676-A531-3940-1818B609EEA7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Turkish (HKLM-x32\...\{9DB45EC2-90E7-642D-7CF9-5AC2FBDC14F7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
ccc-utility64 (HKLM\...\{C3463F9A-E635-02E0-C351-41D16074E202}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Convert XLS (HKLM-x32\...\Convert XLS_is1) (Version:  - Softinterface, Inc.)
CrystalDiskInfo 7.5.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.5.1 - Crystal Dew World)
Debut Videorekorder (HKLM-x32\...\Debut) (Version: 2.17 - NCH Software)
Dr. Hardware 2015 15.5d (HKLM-x32\...\Dr. Hardware 2015_is1) (Version:  - Peter A. Gebhard)
Electrum (HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Electrum) (Version: 2.8.2 - Electrum Technologies GmbH)
Free Pascal 3.0.0 (HKLM-x32\...\FreePascal_is1) (Version:  - Free Pascal Team)
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.195.0 - International GeoGebra Institute)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 63.0.3239.132 - Google Inc.)
Google Earth Pro (HKLM-x32\...\{76AADFE7-3416-419C-A30B-41E762231584}) (Version: 7.3.1.4505 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gpg4win (2.3.3) (HKLM-x32\...\GPG4Win) (Version: 2.3.3 - The Gpg4win Project)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
GUI Turbo Assembler Ver 3.0.1 (HKLM-x32\...\{F522C947-52FA-4C01-B933-16292944E000}) (Version: 3.0.1 - Lakhya's Innovation Inc.)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan)
Java SE Development Kit 8 Update 102 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180102}) (Version: 8.0.1020.14 - Oracle Corporation)
Java SE Development Kit 8 Update 91 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180910}) (Version: 8.0.910.14 - Oracle Corporation)
Java SE Development Kit 8 Update 91 (HKLM-x32\...\{32A3A4F4-B792-11D6-A78A-00B0D0180910}) (Version: 8.0.910.14 - Oracle Corporation)
Lazarus 1.6.2 (HKLM\...\lazarus_is1) (Version: 1.6.2 - Lazarus Team)
MailWasherPro (HKLM-x32\...\{D16B61A0-A55E-47A9-BA73-8A5E92C26DB2}) (Version: 7.11.05 - Firetrust)
ManyCam 5.3.0 (HKLM-x32\...\ManyCam) (Version: 5.3.0 - Visicom Media Inc.)
MBOT_PureSRO_2016 version Final (HKLM-x32\...\{C14EAA16-29F0-4E10-9CD3-0C8922295590}_is1) (Version: Final - ztona, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.667.1 - McAfee, Inc.)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 58.0.1 (x64 de) (HKLM\...\Mozilla Firefox 58.0.1 (x64 de)) (Version: 58.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 53.0.3 - Mozilla)
Mozilla Thunderbird 52.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.6.0 (x86 de)) (Version: 52.6.0 - Mozilla)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.4 - Notepad++ Team)
OpenOffice 4.1.3 (HKLM-x32\...\{8D5FCC56-BB9F-4122-923C-71753F50F6F5}) (Version: 4.13.9783 - Apache Software Foundation)
Opera Stable 50.0.2762.67 (HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Opera 50.0.2762.67) (Version: 50.0.2762.67 - Opera Software)
Pari-2-7-6 (remove only) (HKLM-x32\...\Pari-2-7-6) (Version:  - )
PC Inspector File Recovery (HKLM-x32\...\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}) (Version: 4.0 - )
PilotEdit Lite 10.7.0 (HKLM-x32\...\PilotEdit Lite_is1) (Version:  - )
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Revo Uninstaller 2.0.4 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.4 - VS Revo Group, Ltd.)
Scid vs PC 4.16 (HKLM-x32\...\Scid vs PC_is1) (Version: 4.16 - Steven Atkinson)
SharpKeys (HKLM\...\{F6908C45-459A-4332-A3F2-03DAAB64939D}) (Version: 3.6.0000 - RandyRants.com)
Shotcut (HKLM-x32\...\Shotcut) (Version:  - )
Silkroad (HKLM-x32\...\Silkroad) (Version:  - )
Skype version 8.13 (HKLM-x32\...\Skype_is1) (Version: 8.13 - Skype Technologies S.A.)
TDM-GCC (HKLM-x32\...\TDM-GCC) (Version: 1.1309.0 - TDM)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.83369 - TeamViewer)
Total Commander 64-bit (Remove or Repair) (HKLM-x32\...\Totalcmd64) (Version: 9.0a - Ghisler Software GmbH)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.16 - IDRIX)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Web Companion (HKLM-x32\...\{37c882f6-40f7-46a4-9ccb-8e2808e1a79e}) (Version: 2.4.1558.3001 - Lavasoft)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Wolfram Mathematica 11.2 (M-WIN-L 11.2.0 5822651) (HKLM\...\M-WIN-L 11.2.0 5822651_is1) (Version: 11.2.0 - Wolfram Research, Inc.)
Wondershare Data Recovery(Build 6.5.1.5) (HKLM-x32\...\{FEA3976F-D621-45F3-AFBD-E812A1F2F00D}_is1) (Version: 6.5.1.5 - Wondershare Software Co.,Ltd.)
Wondershare Helper Compact 2.5.2 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.2 - Wondershare)
Xaldon WebSpider2 (HKLM-x32\...\WebSpider2) (Version:  - )
Xilinx Design Tools Vivado HL WebPACK 2016.3 (C:\Xilinx) (HKLM\...\Xilinx_Vivado HL WebPACK_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx DocNav (C:\Xilinx) (HKLM\...\Xilinx_DocNav_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx Information Center (C:\Xilinx) (HKLM\...\Xilinx_Xilinx Information Center_2016.3#0) (Version: 2016.3 - Xilinx Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-01-01] ()
ContextMenuHandlers1: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-20] (Google)
ContextMenuHandlers1: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers1: [PilotEdit] -> {277B9550-37E2-47DE-B533-89A1EBD82DB9} => C:\Program Files (x86)\PilotEdit Lite\EShell_x64.dll [2013-01-01] (PilotEdit)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2018-01-03] (Avira Operations GmbH & Co. KG)
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers2: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-20] (Google)
ContextMenuHandlers4: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\atiacm64.dll [2015-08-04] (Advanced Micro Devices, Inc.)
ContextMenuHandlers6: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers6: [Shell Extension for Malware scanning] -> {45AC2688-0253-4ED8-97DE-B5370FA7D48A} => C:\Program Files (x86)\Avira\Antivirus\shlext64.dll [2018-01-03] (Avira Operations GmbH & Co. KG)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1C0F2488-7423-45B0-9FE9-B2F43E95DDA9} - System32\Tasks\Avira_Antivirus_Systray => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [2018-01-03] (Avira Operations GmbH & Co. KG)
Task: {1FB3732E-9592-444D-A701-81DF304F14A9} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe
Task: {21022CE6-BFE7-40E7-AAFA-15A6CC72356B} - System32\Tasks\{E140102B-F244-4775-9758-5FA77AFD8886} => C:\Windows\system32\pcalua.exe -a "C:\Users\juergen2\Downloads\chromeinstall-8u77 (1).exe" -d C:\Users\juergen2\Downloads
Task: {213D38E2-E0E5-4EFB-88BC-AC61BF33552B} - System32\Tasks\{849B1E16-7952-40E5-887E-DAAD93154E62} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\putty.exe -d D:\backupMaxtor80gb\data
Task: {22DA9795-90BD-4731-AB6A-BD01A662D2F9} - System32\Tasks\{9C6CF1E7-9264-4314-BC30-F7778072B17B} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\wlsetup3528-all.exe -d d:\backupMaxtor80gb\data\
Task: {3B11371B-11AB-415E-8185-32A4F05C4B0F} - System32\Tasks\{471AF2D6-FC39-423E-8A09-1CE6E304D7BB} => C:\Windows\system32\pcalua.exe -a C:\camel\SilkroadOnlineGlobal_Official_v1_486.exe -d c:\camel\
Task: {4ADE3327-7150-4BB8-87C3-76601FC67879} - System32\Tasks\{FD09F9C6-B58A-406E-8536-F1B82AF22BBE} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\i2pinstall_0.9.30_windows.exe -d D:\backupMaxtor80gb\data
Task: {6ADA2DE3-F929-4442-BCBE-E1D403613F2F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)
Task: {70FC73DB-5C4F-4CB5-9833-76B9D3A491A6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {A6D9A0B3-82A7-4937-910D-C86CC1F2F571} - System32\Tasks\{C61837B8-EABF-4B5E-B96E-3C6EC1BD2343} => C:\Windows\system32\pcalua.exe -a C:\datas\jxpiinstall(4).exe -d C:\datas
Task: {AD24AC21-72E8-4AFB-8BA6-BC0413019E02} - System32\Tasks\Opera scheduled Autoupdate 1498067933 => C:\Users\juergen2\AppData\Local\Programs\Opera\launcher.exe [2018-01-22] (Opera Software)
Task: {BE9E6706-8A73-4F34-8BC7-F4B899EDF1C0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {D81ED6FD-5476-4FAA-A9B9-AD7C0B99C7D9} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {DAC363AC-634F-4411-8C93-334B4E476B58} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe
Task: {E302C505-2A7A-4384-87A8-489CE462BC3D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {F4DDD129-C6FA-4772-AC2D-CE369BA97A92} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {F6F30DFE-BB87-4833-A1E0-CEE92CCDEE3C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\juergen2\Favorites\Downloadseite von NCH Software.lnk -> hxxp://www.nchsoftware.com/de/index.htm
Shortcut: C:\Users\juergen2\Desktop\apache_start - Shortcut.lnk -> C:\xampp\apache_start.bat ()
Shortcut: C:\Users\juergen2\Desktop\Vivado HLS 2016.3.lnk -> C:\Xilinx\Vivado_HLS\2016.3\bin\vivado_hls.bat ()
Shortcut: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado HLS\Vivado HLS 2016.3 Command Prompt.lnk -> C:\Xilinx\Vivado_HLS\2016.3\bin\vivado_hls_cmd.bat ()
Shortcut: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado HLS\Vivado HLS 2016.3.lnk -> C:\Xilinx\Vivado_HLS\2016.3\bin\vivado_hls.bat ()
Shortcut: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GAP 4.7.8\GAP 4.7.8.lnk -> C:\gap4r7\bin\gap.bat ()

ShortcutWithArgument: C:\Users\juergen2\Desktop\root@www.hzgb.org.lnk -> D:\WinSCP-5.9.2-Portable\WinSCP.exe (Martin Prikryl) -> "root%40www.hzgb.org" /Desktop /UploadIfAny
ShortcutWithArgument: C:\Users\juergen2\Desktop\Vivado 2016.3.lnk -> C:\Xilinx\Vivado\2016.3\bin\unwrapped\win64.o\vvgl.exe () -> C:\Xilinx\Vivado\2016.3\bin\vivado.bat
ShortcutWithArgument: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Manage Xilinx Licenses.lnk -> C:\Xilinx\Vivado\2016.3\bin\unwrapped\win64.o\vvgl.exe () -> C:\Xilinx\Vivado\2016.3\bin\vlm.bat
ShortcutWithArgument: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado 2016.3 Tcl Shell.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /k C:\Xilinx\Vivado\2016.3\bin\vivado.bat -mode tcl
ShortcutWithArgument: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado 2016.3.lnk -> C:\Xilinx\Vivado\2016.3\bin\unwrapped\win64.o\vvgl.exe () -> C:\Xilinx\Vivado\2016.3\bin\vivado.bat

==================== Loaded Modules (Whitelisted) ==============

2015-08-04 00:25 - 2015-08-04 00:25 - 000214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 000817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 003650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2016-08-18 09:27 - 2016-08-18 09:27 - 000216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2018-01-01 02:07 - 2018-01-01 02:07 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2018-01-09 09:50 - 2018-01-03 10:20 - 004063064 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\libglesv2.dll
2018-01-09 09:50 - 2018-01-03 10:20 - 000099672 _____ () C:\Program Files (x86)\Google\Chrome\Application\63.0.3239.132\libegl.dll
2015-08-04 00:25 - 2015-08-04 00:25 - 000102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2000-01-01 01:00 - 2018-01-27 17:07 - 003614720 _____ () C:\Users\juergen2\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
2016-08-18 09:14 - 2016-08-18 09:14 - 000222720 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2016-08-18 09:09 - 2016-08-18 09:09 - 000103424 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2016-08-18 09:03 - 2016-08-18 09:03 - 000050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000073728 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2016-08-18 09:17 - 2016-08-18 09:17 - 000751104 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll
2018-01-01 02:07 - 2018-01-01 02:07 - 000021680 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll
2000-01-01 01:00 - 2018-01-27 17:07 - 000093095 _____ () C:\Users\juergen2\Desktop\Tor Browser\Browser\libssp-0.dll
2000-01-01 01:00 - 2018-01-27 17:07 - 000107520 _____ () C:\Users\juergen2\Desktop\Tor Browser\Browser\TorBrowser\Tor\zlib1.dll
2000-01-01 01:00 - 2018-01-27 17:07 - 000093095 _____ () C:\Users\juergen2\Desktop\Tor Browser\Browser\TorBrowser\Tor\libssp-0.dll
2000-01-01 01:00 - 2018-01-27 17:07 - 000717225 _____ () C:\Users\juergen2\Desktop\Tor Browser\Browser\TorBrowser\Tor\libevent-2-0-5.dll
2000-01-01 01:00 - 2018-01-27 17:07 - 000523022 _____ () C:\Users\juergen2\Desktop\Tor Browser\Browser\TorBrowser\Tor\libgcc_s_sjlj-1.dll
2015-11-01 08:53 - 2014-07-17 12:18 - 000219648 _____ () C:\xampp\apache\bin\pcre.dll
2015-11-01 08:54 - 2014-07-23 23:24 - 000128512 _____ () C:\xampp\php\libpq.dll
2017-12-10 15:05 - 2018-01-09 18:07 - 001551816 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\ffmpeg.dll
2017-12-10 15:05 - 2018-01-09 18:04 - 000088064 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\keytar\build\Release\keytar.node
2017-12-10 15:05 - 2018-01-09 18:04 - 002559608 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\libglesv2.dll
2017-12-10 15:05 - 2018-01-09 18:04 - 000031864 _____ () C:\Program Files (x86)\Microsoft\Skype for Desktop\libegl.dll
2017-12-10 15:05 - 2018-01-09 18:04 - 000400384 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\@paulcbetts\spellchecker\build\Release\spellchecker.node
2017-12-10 15:05 - 2018-01-09 18:04 - 000129536 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node
2017-12-10 15:05 - 2018-01-09 18:04 - 002171904 _____ () \\?\C:\Program Files (x86)\Microsoft\Skype for Desktop\resources\app.asar.unpacked\node_modules\slimcore\bin\skypert.dll
2016-12-19 15:36 - 2016-12-14 09:00 - 000132176 _____ () C:\totalcmd\wcmzip32.dll
2016-12-19 15:36 - 2016-12-14 09:00 - 000083024 _____ () C:\totalcmd\tc7zipif.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\localhost -> localhost

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2017-11-30 16:41 - 000002026 _____ C:\Windows\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-963683855-2343051469-89585254-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: LavasoftAdAwareService11 => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: vssbrigde64 => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^juergen2^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MailWasherPro.lnk => C:\Windows\pss\MailWasherPro.lnk.Startup
MSCONFIG\startupreg: AvgUi => "C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe" /lps=fmw

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{E08E8243-C2A1-4221-90A7-14736621DBE5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9EA08C55-5310-4A9E-8ABB-32F4A49FF91B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{97587CB0-9EAA-4B76-AE0F-849E608FE32D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{81373308-C4D3-45DA-ABFB-9FF3613C6D5D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{27E94056-EE89-40C2-88F9-FCDD1B8E5D43}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{D80E4AD5-8012-4DE4-B0FE-3695EFEBEAED}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{E4AFD96A-B990-4558-B5EE-3F16F3B150B1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4EFF6531-5BDD-4CC8-BCE4-8C1B36A92B77}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1144CB11-19E6-41BF-BAFF-C3CBF53D788E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{D076BE44-8E6B-4596-BDAA-38B73655C620}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{BA663251-09BF-4823-8DE3-357013B1B8CE}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [UDP Query User{E5E54FE6-C09E-4ABB-90E3-E86CBF75A6F2}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [TCP Query User{3562059C-09AD-49C5-B7A8-F01122A24FF9}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{F0D6FC0B-D3F6-4346-A980-F46D4C9D1B96}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{98C9BD54-7195-421F-8622-82F19A588534}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [UDP Query User{823BFEF5-2144-437C-A54B-BCCA12451298}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [TCP Query User{43DE325D-FD61-460D-842E-290A5202FB7F}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{DFCF343D-2298-479B-820C-A9D87E56AFF7}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [TCP Query User{A1496639-68D5-46B4-967E-A505FB7D9C89}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [UDP Query User{D2661694-9DE9-4B85-AA71-E76B9FE67E92}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [TCP Query User{DA6A1C4E-6658-4536-B8A6-C2F9FD65FD61}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [UDP Query User{4C306084-351A-440E-86A7-02F33064F80E}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [TCP Query User{82621B54-D4E3-4191-A32E-7FB2E966AFE0}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{FA455FFB-BB85-4880-8324-9ED51129A541}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [TCP Query User{AFDB542D-C34E-4DBA-A5E8-13FD772F4676}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{821974AD-1244-4300-8892-42C965D1C906}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [{EE884B1A-0A33-4F7E-BE89-6C013F4282AB}] => (Allow) C:\Users\juergen2\AppData\Local\IQA\Application\chrome.exe
FirewallRules: [{776A7697-A9FA-4D00-AE02-02733E032793}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{179DB254-E4A7-44FD-8180-A252E383B707}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [TCP Query User{5881A1B3-618E-4628-AF81-07C027281C34}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [UDP Query User{B1095A5C-EA19-4532-BE33-41EF9C86B1D8}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [TCP Query User{B12981FF-B265-4AD8-90CC-1CAA78AFF9D3}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{17966661-BA79-4C90-BC0D-63434C7A2A9F}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{359222EA-9F94-4EDA-A978-E08B0C015F21}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{DCC70F92-DA66-4518-B65F-551E06FAED96}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{0C48E5AD-B230-4661-BAFF-D286C90BF7ED}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{5E82995E-38F3-476B-98A0-E4055D9530E6}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{FF3B1697-47E7-4E15-A46F-14DAD9A34297}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{91BF5810-5F2B-4B0B-89A6-13C7BD7AF7E0}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [TCP Query User{0F0A5EA5-6FDA-4571-8F26-6D7235C4710D}C:\program files\java\jdk1.8.0_91\jre\bin\javaw.exe] => (Allow) C:\program files\java\jdk1.8.0_91\jre\bin\javaw.exe
FirewallRules: [UDP Query User{3D4A1B41-29FB-4AED-884B-4EE1AE1D49B2}C:\program files\java\jdk1.8.0_91\jre\bin\javaw.exe] => (Allow) C:\program files\java\jdk1.8.0_91\jre\bin\javaw.exe
FirewallRules: [{A15FD59F-4DEB-48C5-B0AB-C560507A5BD9}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{7B27A2F1-A1C2-40B1-856F-69E72A5FDD68}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{109B94D2-FB0C-44F2-A49B-C1ABC4AE84C2}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{0E26162C-0928-4A55-BFA2-D3D7A388B22E}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{8BAD0C4F-C654-432F-8A46-8CBC4BFF20AF}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{81FA3FFE-6DEF-4F3D-871E-6120D650F375}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{E12FBEE4-11A9-4252-B72E-9DA5B9A82CDB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{7DA09561-F33A-4F74-AE93-BE232605E318}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{C619FF61-7405-4E6D-B469-F5ED7A4CEBEE}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{5D49AA65-E9EC-4E40-AF85-819A887C58C3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{4819EF9F-ECF0-439F-AD62-F821F6909071}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{97B5B131-9D32-4BAD-8E9A-E1780ABF9A4D}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{054F0F09-AE56-4599-9BA5-F86C9D31FFB5}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{A5989984-670A-4953-A4B2-97E2981C1C4E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.58\opera.exe
FirewallRules: [{51A58F52-6A7A-4F9F-A9D3-54673771201E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.67\opera.exe
FirewallRules: [{858D641F-B90B-4B90-9641-DFF96825B635}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{36275EA3-11DB-4932-AC9B-19B7D18F4C95}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{A9C5985A-EEDC-40A3-BBEC-1E2E964F227C}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{A6DED921-ACDB-4F33-8FF6-E322906C2092}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{9D3AC6F5-DD80-4C6C-AC12-2DE855E84AE0}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe
FirewallRules: [{719EF127-CBDB-42E9-AA42-01703EB925AD}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe

==================== Restore Points =========================

31-01-2018 00:38:04 Windows Update
31-01-2018 02:07:07 Windows Update
03-02-2018 12:45:28 Windows Update
04-02-2018 19:00:31 Windows Backup
05-02-2018 23:59:14 Windows Update

==================== Faulty Device Manager Devices =============

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: ZAM Helper Driver
Description: ZAM Helper Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: AODDriver4.1
Description: AODDriver4.1
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: AODDriver4.1
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: ZAM Guard Driver
Description: ZAM Guard Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM_Guard
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/06/2018 07:11:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/05/2018 04:26:47 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/05/2018 11:44:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/05/2018 11:31:38 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/05/2018 11:21:39 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Failed to create restore point (Process = C:\Users\juergen2\AppData\Local\Temp\jrt\CreateRestorePoint.exe  "JRT Pre-Junkware Removal"; Description = JRT Pre-Junkware Removal; Error = 0x80070070).

Error: (02/05/2018 11:14:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/05/2018 09:52:47 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/04/2018 09:07:07 PM) (Source: Windows Backup) (EventID: 4104) (User: )
Description: The backup was not successful. The error is: There is not enough space on this drive to save the backup. Free up space by deleting older backups and unnecessary data or change your backup settings. (0x81000005).

Error: (02/04/2018 12:23:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: MailWasherPro.exe, version: 2017.7.11.5, time stamp: 0x5a24bee9
Faulting module name: KERNELBASE.dll, version: 6.1.7601.24000, time stamp: 0x5a4996d4
Exception code: 0xe0434352
Fault offset: 0x0000c54f
Faulting process id: 0x86c
Faulting application start time: 0x01d39da754478d4b
Faulting application path: C:\Program Files (x86)\Firetrust\MailWasher\MailWasherPro.exe
Faulting module path: C:\Windows\syswow64\KERNELBASE.dll
Report Id: d9c603a5-099d-11e8-bf93-8c89a53586cf

Error: (02/04/2018 12:23:38 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: MailWasherPro.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.IndexOutOfRangeException
  at MailWasherPro.Startup.Main(System.String[])


System errors:
=============
Error: (02/06/2018 07:12:58 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/06/2018 07:12:07 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/06/2018 07:12:07 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/06/2018 07:10:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/06/2018 12:00:12 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: Installation Failure: Windows failed to install the following update with error 0x80070103: Advanced Micro Devices, Inc driver update for AMD SMBus.

Error: (02/05/2018 04:28:13 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/05/2018 04:27:17 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/05/2018 04:27:17 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/05/2018 04:25:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/05/2018 01:04:05 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: The Windows Modules Installer service terminated with the following error:
Access is denied.


CodeIntegrity:
===================================
  Date: 2015-11-05 07:09:53.063
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.061
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.029
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.027
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD A6-3650 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 71%
Total physical RAM: 7793.37 MB
Available physical RAM: 2256.82 MB
Total Virtual: 11887.54 MB
Available Virtual: 5156.29 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:488.18 GB) (Free:179.49 GB) NTFS
Drive d: (neueMaxTor) (Fixed) (Total:443.23 GB) (Free:176.03 GB) NTFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive g: (Dritte Externe Teil 1) (Fixed) (Total:351.38 GB) (Free:50.38 GB) NTFS
Drive h: (Poops) (Fixed) (Total:347.16 GB) (Free:24.97 GB) NTFS
Drive i: (PalleMalle) (Fixed) (Total:931.51 GB) (Free:31.45 GB) NTFS
Drive j: (TOSHIBA EXT) (Fixed) (Total:931.41 GB) (Free:23.36 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 9A083BDB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=443.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 7191D59B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=351.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=347.2 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 002EFF55)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 931.5 GB) (Disk ID: AAE66568)
Partition 1: (Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

juergen007 06.02.2018 08:25
und das noch dazu
 
Und das noch:




FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27.01.2018
Ran by juergen2 (administrator) on JUERGEN2-PC (06-02-2018 08:09:01)
Running from D:\backupMaxtor80gb\data
Loaded Profiles: juergen2 (Available Profiles: juergen2 & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AMDQuickStream.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
() C:\Users\juergen2\Desktop\Tor Browser\Browser\TorBrowser\Tor\tor.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Apache Software Foundation) C:\xampp\apache\bin\httpd.exe
(Mozilla Corporation) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
(Apache Software Foundation) C:\xampp\apache\bin\httpd.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(Alexander Roshal) C:\Program Files\WinRAR\WinRAR.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.)
HKLM-x32\...\Run: [Avira SystrayStartTrigger] => C:\Program Files (x86)\Avira\Launcher\Avira.SystrayStartTrigger.exe [98024 2017-12-21] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [488640 2015-04-06] (AppEx Networks Corporation)
HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Policies\Explorer: [NoThumbNailCache] 1
HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\MountPoints2: F - F:\LaunchU3.exe -a
HKU\S-1-5-21-963683855-2343051469-89585254-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
GroupPolicyScripts\User: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{4F4DD125-EDDA-44BF-B378-9BAF78A43AC1}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-963683855-2343051469-89585254-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=de-at
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-963683855-2343051469-89585254-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)

FireFox:
========
FF ProfilePath: C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 [2018-02-06]
FF Homepage: Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 -> hxxps://www.google.de/
FF NetworkProxy: Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 -> http", "106.38.251.63"
FF Session Restore: Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 -> is enabled.
FF Extension: (Add HTTPS) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\@add-https.xpi [2018-01-30]
FF Extension: (Avira Browser Safety) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\abs@avira.com [2018-01-11]
FF Extension: (YouTube Video and Audio Downloader) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2017-05-24] [Legacy]
FF Extension: (Video Downloader professional) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\ffext_basicvideoext@startpage24.xpi [2017-12-11]
FF Extension: (Ghostery) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\firefox@ghostery.com.xpi [2018-02-02]
FF Extension: (HTTPS Everywhere) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\https-everywhere@eff.org.xpi [2018-01-30]
FF Extension: (Google search link fix) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\jid0-XWJxt5VvCXkKzQK99PhZqAn7Xbg@jetpack.xpi [2018-01-10]
FF Extension: (Easy Video Downloader) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\vdpure@link64.xpi [2017-08-21]
FF Extension: (bvd2) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{170503FA-3349-4F17-BC86-001888A5C8E2}.xpi [2017-12-02]
FF Extension: (Adblock Plus) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-12-12]
FF Extension: (YouTube Video and Audio Downloader (Dev Edt.)) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{f73df109-8fb4-453e-8373-f59e61ca4da3}.xpi [2017-12-11]
FF Extension: (Adblock Edge) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2016-10-06] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_137.dll [2018-01-30] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_137.dll [2018-01-30] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2017-11-04] (Adobe Systems Inc.)

Chrome:
=======
CHR StartupUrls: Default -> "hxxp://www.rzbt.haw-hamburg.de/dankert/spezmath/html/collatzproblem.html","hxxp://www.openoffice.org/de/download/","hxxps://sourceforge.net/projects/openofficeorg.mirror/?source=typ_redirect","hxxps://www.lotto-niedersachsen.de/kundenkonto/gewinn-check/10157300387","hxxps://suchen.mobile.de/fahrzeuge/details.html?id=250479915&ambitCountry=DE&damageUnrepaired=NO_DAMAGE_UNREPAIRED&fuels=PETROL&grossPrice=true&isSearchRequest=true&makeModelVariant1.makeId=19000&maxPrice=1000&minHu=6&minPowerAsArray=66&minPowerAsArray=KW&pageNumber=1&readyToDrive=ONLY_READY_TO_DRIVE&scopeId=C&sortOption.sortBy=searchNetGrossPrice&usage=USED&fnai=prev","hxxps://www.facebook.com/","hxxps://de.wikipedia.org/w/index.php?search=j%C3%B6rg+tobias&title=Spezial:Suche&go=Artikel&searchToken=9pxr2btjyziqk5x0fzvk93dkt","hxxps://www.youtube.com/watch?v=XCL5S9TKJF0","hxxp://matheplanet.com/","hxxps://www.facebook.com/pg/AlternativeFurDeutschlandKreisBraunschweig/events/?ref=page_internal","hxxp://www.rzbt.haw-hamburg.de/dankert/spezmath/html/collatzproblem.html","hxxps://sat-chit-ananda.org/project/virtuelle-kurse-mit-alexander/","hxxps://de.wikipedia.org/wiki/Schl%C3%BCssiges_Handeln","hxxps://afd-braunschweig.de/termine/","chrome://downloads/","hxxps://de.nametests.com/test/result/juergen/btn_9676575548/","chrome://bookmarks/","hxxps://www.google.de/search?q=Birgit+gorzitze&tbm=isch&imgil=upHmVR3Ve2Y7dM%253A%253BLYF1x23uz-z7RM%253Bhttps%25253A%25252F%25252Fwww.solarserver.de%25252Fsolar-magazin%25252Fnachrichten%25252Faktuelles%25252F2017%25252Fkw28%25252Ferstes-mieterstromprojekt-von-green-city-energy.html&source=iu&pf=m&fir=upHmVR3Ve2Y7dM%253A%252CLYF1x23uz-z7RM%252C_&usg=__pJEpJ1muFt-4UJJBrHv2_ztdeu0%3D&biw=1280&bih=680&ved=0ahUKEwjDkuPMwsXWAhUpLsAKHWgQBCYQyjcINg&ei=Hq7LWcOLHqncgAbooJCwAg#imgrc=ykZLkO6KJexLsM:","hxxps://www.myheimat.de/sport/action/page/1303/","hxxps://www.youtube.com/watch?v=YqwWJ6Awrkg&feature=push-u&attr_tag=4s_wISBGf-P-bUwu-6","hxxps://www.bang.com/video/Vulri7rRnz9Qi0Vo/leda-gets-fucked-by-a-senior"
CHR Session Restore: Default -> is enabled.
CHR Profile: C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default [2018-02-06]
CHR Extension: (Präsentationen) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-10-16]
CHR Extension: (Docs) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-10-16]
CHR Extension: (Google Drive) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-21]
CHR Extension: (Pavarti) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhcfbhfmagpnkhllnhddblbbnihalnhm [2017-09-10]
CHR Extension: (Megidash) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhhmfciaobmhjhemmhcbndcnkbhdfiho [2017-09-05]
CHR Extension: (YouTube) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-12-21]
CHR Extension: (Adblock Plus) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2018-01-29]
CHR Extension: (Google-Suche) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-21]
CHR Extension: (Barracuda) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnehjkbejpkjlnjfhhknpcgfihgbbigg [2017-09-16]
CHR Extension: (Video Downloader professional) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2017-08-03]
CHR Extension: (Tabellen) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-10-16]
CHR Extension: (Avira Browserschutz) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2018-01-11]
CHR Extension: (Google Docs Offline) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2016-03-23]
CHR Extension: (Video Downloader professional) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmdldgcmokdpmacblnehppgkjphcbpnn [2018-01-06]
CHR Extension: (Application Launcher for Drive (by Google)) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmjegmlicamnimmfhcmpkclmigmmcbeh [2017-10-30]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-08-23]
CHR Extension: (duobgm) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjjjomjfeomddikaoofeggpliipdfhia [2017-09-02]
CHR Extension: (Google Mail) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-12-21]
CHR Extension: (Chrome Media Router) - C:\Users\juergen2\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2018-01-03]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
CHR HKU\S-1-5-21-963683855-2343051469-89585254-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [1128944 2018-01-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [492560 2018-01-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [492560 2018-01-03] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1526832 2018-01-03] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [444600 2017-12-21] (Avira Operations GmbH & Co. KG)
R2 BCWipeSvc; C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe [90592 2015-12-01] (Jetico, Inc.)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [File not signed]
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S4 ManyCam Service; C:\ProgramData\ManyCam\Service\ManyCamService.exe [544984 2016-03-31] (Visicom Media Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.667\McCHSvc.exe [404376 2018-01-05] (McAfee, Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10803440 2017-08-29] (TeamViewer GmbH)
S4 TrueKey; C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe [908256 2016-07-22] (McAfee, Inc.)
S4 TrueKeyScheduler; C:\Program Files\TrueKey\McTkSchedulerService.exe [15736 2016-07-22] (McAfee, Inc.)
S3 TrueKeyServiceHelper; C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe [86864 2016-07-22] (McAfee, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 InstallerService; "C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [229056 2015-04-03] (AppEx Networks Corporation)
R0 avdevprot; C:\Windows\System32\DRIVERS\avdevprot.sys [64504 2018-01-03] (Avira Operations GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [196344 2018-01-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [153552 2018-02-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [35328 2018-01-03] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [78600 2018-01-03] (Avira Operations GmbH & Co. KG)
R0 avusbflt; C:\Windows\System32\Drivers\avusbflt.sys [34128 2018-01-03] (Avira Operations GmbH & Co. KG)
S4 BCSWAP; C:\Windows\System32\Drivers\BCSWAP.sys [94400 2014-11-24] (Jetico, Inc.)
R2 DRHARD64; C:\Windows\system32\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHARD64; C:\Windows\SysWOW64\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHMSR64; C:\Windows\system32\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R2 DRHMSR64; C:\Windows\SysWOW64\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R0 fsh; C:\Windows\System32\Drivers\fsh.sys [57536 2015-05-19] (Jetico Inc. Oy)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
S3 MftWipeFilter; C:\Windows\System32\Drivers\MftWipeFilter.sys [42632 2015-12-01] (Windows (R) Win 7 DDK provider)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [195416 2015-11-17] (IDRIX)
R2 XilinxPC4Driver; C:\Windows\System32\drivers\xpc4drvr.sys [27384 2016-10-09] (Xilinx, Inc.)
S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
U3 aswbdisk; no ImagePath
S1 bcbus; system32\DRIVERS\bcbus.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 X6va037; \??\C:\Windows\SysWOW64\Drivers\X6va037 [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-06 08:08 - 2018-02-06 08:09 - 000000000 ____D C:\FRST
2018-02-06 07:10 - 2018-02-06 07:10 - 000000021 _____ C:\Windows\S.dirmngr
2018-02-05 23:24 - 2018-02-05 23:41 - 000000000 ___HD C:\~BCWipe.tmp
2018-02-05 18:56 - 2018-02-05 18:56 - 000739464 _____ C:\Users\juergen2\Documents\IMG_20180205_0001.pdf
2018-02-05 16:24 - 2018-02-05 16:24 - 000003544 ____N C:\bootsqm.dat
2018-02-05 12:45 - 2018-02-05 12:45 - 000000000 ____D C:\ODS
2018-02-05 11:48 - 2018-02-05 11:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BCWipe
2018-02-05 11:47 - 2018-02-05 11:47 - 000000000 ____D C:\Program Files (x86)\Jetico
2018-02-02 15:20 - 2018-02-02 15:20 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\dvdcss
2018-02-02 14:52 - 2018-02-02 14:52 - 000000017 _____ C:\Users\juergen2\AppData\Local\resmon.resmoncfg
2018-02-01 13:05 - 2018-02-01 13:05 - 000001196 _____ C:\Users\Administrator\Desktop\CrystalDiskInfo.lnk
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\Program Files (x86)\CrystalDiskInfo
2018-02-01 12:01 - 2018-02-05 11:39 - 000001167 _____ C:\Windows\SysWOW64\Reinigung.cmd
2018-02-01 12:01 - 2017-12-24 23:03 - 000001820 _____ C:\Windows\SysWOW64\Wartung.cmd
2018-02-01 00:23 - 2018-02-01 00:23 - 000000000 ____D C:\Users\juergen2\PDF
2018-01-31 23:58 - 2018-01-31 23:58 - 000000181 _____ C:\Users\juergen2\Documents\slashesversion.gp
2018-01-31 22:17 - 2018-01-31 22:17 - 000000142 _____ C:\Users\juergen2\new2.gp
2018-01-31 22:01 - 2018-01-31 22:01 - 000002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
2018-01-31 22:01 - 2018-01-31 22:01 - 000002172 _____ C:\Users\Public\Desktop\Google Earth Pro.lnk
2018-01-31 22:00 - 2018-01-31 21:57 - 000000096 _____ C:\Users\juergen2\Documents\new.txt
2018-01-31 21:17 - 2018-02-01 00:12 - 000007841 _____ C:\Users\juergen2\Documents11.pdf
2018-01-30 23:39 - 2018-01-30 23:40 - 000000127 _____ C:\Users\juergen2\Documents\anmachenFilipina.txt
2018-01-30 21:18 - 2018-01-30 21:18 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2018-01-30 21:18 - 2018-01-30 21:18 - 000000000 ____D C:\ProgramData\McAfee Security Scan
2018-01-30 21:18 - 2018-01-30 21:18 - 000000000 ____D C:\Program Files\McAfee Security Scan
2018-01-30 20:48 - 2018-01-30 21:18 - 000001924 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Macromedia
2018-01-29 22:31 - 2018-02-04 13:04 - 000004740 _____ C:\Users\juergen2\Documents\23.txt
2018-01-29 22:11 - 2018-01-30 23:09 - 000003173 _____ C:\Users\juergen2\Documents\13.txt
2018-01-29 22:09 - 2018-01-29 22:09 - 001332457 _____ C:\Users\juergen2\Documents\1013.txt
2018-01-29 21:01 - 2018-01-29 21:58 - 000003016 _____ C:\Users\juergen2\Desktop\mmmma.txt
2018-01-28 23:59 - 2018-01-28 23:59 - 000001182 _____ C:\Users\juergen2\Desktop\MailWasherPro.lnk
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Program Files (x86)\Firetrust
2018-01-28 23:58 - 2018-01-29 00:00 - 000000000 ____D C:\ProgramData\Firetrust
2018-01-28 12:57 - 2018-01-31 21:20 - 000000000 ____D C:\Users\juergen2\Documents\Wolfram Mathematica
2018-01-28 12:57 - 2018-01-29 19:37 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Mathematica
2018-01-28 12:57 - 2018-01-28 12:58 - 000000000 ____D C:\Users\juergen2\AppData\Local\Mathematica
2018-01-28 12:57 - 2018-01-28 12:57 - 000000000 ____D C:\Users\juergen2\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\Documents\Wolfram Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\ProgramData\Mathematica
2018-01-27 12:30 - 2018-01-27 12:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica 11.2
2018-01-27 12:27 - 2018-01-27 12:27 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\OpenOffice
2018-01-27 12:17 - 2018-01-27 12:17 - 000000000 ____D C:\Program Files\Wolfram Research
2018-01-27 12:00 - 2018-01-27 12:03 - 000000000 ____D C:\Users\Administrator\Downloads\M-WIN-L-11.2.0-5822651
2018-01-27 12:00 - 2018-01-27 12:00 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram Research
2018-01-18 14:27 - 2018-01-18 14:27 - 000002077 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files\Microsoft Security Client
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2018-01-12 13:00 - 2018-01-01 03:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-01-12 13:00 - 2018-01-01 03:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-01-12 13:00 - 2018-01-01 03:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-01-12 13:00 - 2018-01-01 03:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 03:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-01-12 13:00 - 2018-01-01 03:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-01-12 13:00 - 2018-01-01 03:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-01-12 13:00 - 2018-01-01 02:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-01-12 13:00 - 2018-01-01 02:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-01-12 13:00 - 2018-01-01 02:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-01-12 13:00 - 2018-01-01 02:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll
2018-01-12 13:00 - 2018-01-01 02:46 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\vmictimeprovider.dll
2018-01-12 13:00 - 2018-01-01 02:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-01-12 13:00 - 2018-01-01 02:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 02:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-01-12 13:00 - 2018-01-01 02:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-01-12 13:00 - 2018-01-01 02:39 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 02:36 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-01-12 13:00 - 2018-01-01 02:35 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2017-12-30 08:29 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-01-12 13:00 - 2017-12-30 07:42 - 000347328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-01-12 13:00 - 2017-12-29 19:39 - 020274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-01-12 13:00 - 2017-12-29 19:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 19:13 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-01-12 13:00 - 2017-12-29 19:13 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-01-12 13:00 - 2017-12-29 19:12 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-01-12 13:00 - 2017-12-29 19:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 19:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 19:09 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-01-12 13:00 - 2017-12-29 19:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 18:55 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 18:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-01-12 13:00 - 2017-12-29 18:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-01-12 13:00 - 2017-12-29 18:47 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 18:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 18:45 - 004508160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-01-12 13:00 - 2017-12-29 18:44 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-01-12 13:00 - 2017-12-29 18:39 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 18:37 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 18:36 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 18:19 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-01-12 13:00 - 2017-12-29 18:15 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-01-12 13:00 - 2017-12-29 18:13 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-01-12 13:00 - 2017-12-29 10:15 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-01-12 13:00 - 2017-12-29 10:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 10:04 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-01-12 13:00 - 2017-12-29 09:52 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 005796352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-01-12 13:00 - 2017-12-29 09:50 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 09:44 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 09:43 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-01-12 13:00 - 2017-12-29 09:40 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 09:39 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-01-12 13:00 - 2017-12-29 09:32 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-01-12 13:00 - 2017-12-29 09:28 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 09:22 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-01-12 13:00 - 2017-12-29 09:22 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 09:21 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 09:16 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 09:14 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-01-12 13:00 - 2017-12-29 09:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-01-12 13:00 - 2017-12-29 09:04 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-01-12 13:00 - 2017-12-29 09:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 09:01 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 08:50 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-01-12 13:00 - 2017-12-29 08:39 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-01-12 13:00 - 2017-12-29 08:27 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-01-12 13:00 - 2017-12-21 07:27 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-01-12 13:00 - 2017-12-13 17:31 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-01-12 13:00 - 2017-12-13 17:15 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-01-12 13:00 - 2017-12-13 16:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-01-12 13:00 - 2017-12-05 16:59 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-01-12 13:00 - 2017-12-05 16:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-01-11 17:13 - 2018-01-11 17:42 - 000000000 ____D C:\recov
2018-01-11 12:43 - 2018-02-06 07:20 - 000003292 _____ C:\Windows\System32\Tasks\Avira_Antivirus_Systray
2018-01-11 12:43 - 2018-01-11 12:43 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avusbflt_01011.Wdf
2018-01-11 12:42 - 2018-02-03 14:30 - 000153552 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2018-01-11 12:42 - 2018-01-03 22:33 - 000196344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2018-01-11 12:42 - 2018-01-03 22:33 - 000078600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2018-01-11 12:42 - 2018-01-03 22:33 - 000064504 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avdevprot.sys
2018-01-11 12:42 - 2018-01-03 22:33 - 000035328 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2018-01-11 12:42 - 2018-01-03 22:33 - 000034128 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avusbflt.sys
2018-01-11 12:41 - 2018-01-11 12:43 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2018-01-11 12:41 - 2018-01-11 12:42 - 000000000 ____D C:\ProgramData\Avira
2018-01-11 12:41 - 2018-01-11 12:42 - 000000000 ____D C:\Program Files (x86)\Avira
2018-01-11 12:41 - 2018-01-11 12:41 - 000001188 _____ C:\Users\Public\Desktop\Avira.lnk

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-06 08:05 - 2015-11-01 11:12 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\vlc
2018-02-06 07:55 - 2015-11-02 13:24 - 001176800 _____ C:\Windows\ntbtlog.txt
2018-02-06 07:26 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-02-06 07:26 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-02-06 07:18 - 2016-11-19 14:58 - 000000000 ____D C:\Users\juergen2\AppData\LocalLow\Mozilla
2018-02-06 07:09 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-05 20:47 - 2017-05-10 13:31 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Electrum
2018-02-05 18:04 - 2015-11-13 17:07 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\IrfanView
2018-02-05 16:25 - 2016-11-18 20:36 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2018-02-05 16:25 - 2015-10-31 22:35 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-02-05 13:03 - 2015-11-01 08:53 - 000000000 ____D C:\xampp
2018-02-05 11:54 - 2016-08-11 20:40 - 000000000 ____D C:\log
2018-02-05 11:48 - 2009-07-14 04:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2018-02-05 11:25 - 2016-07-21 13:39 - 000002177 _____ C:\Users\juergen2\Desktop\JRT.txt
2018-02-05 11:08 - 2016-07-21 13:33 - 000000000 ____D C:\AdwCleaner
2018-02-04 14:26 - 2015-12-23 19:17 - 000000000 ____D C:\filme
2018-02-04 12:23 - 2017-11-16 22:48 - 000000000 ____D C:\Users\juergen2\AppData\Local\CrashDumps
2018-02-03 16:54 - 2015-11-14 12:57 - 000075264 _____ C:\Users\juergen2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-02-03 15:38 - 2016-02-24 19:10 - 000000000 ____D C:\div
2018-02-03 15:38 - 2015-10-31 22:30 - 000000000 ____D C:\datas
2018-02-03 15:07 - 2016-01-24 16:00 - 000000000 ____D C:\Users\juergen2\AppData\Local\QuickPar
2018-02-03 12:24 - 2009-07-14 06:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
2018-02-03 12:24 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2018-02-02 15:15 - 2017-01-04 14:10 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2018-02-02 11:04 - 2009-07-14 06:32 - 000000000 ____D C:\Windows\system32\FxsTmp
2018-02-01 13:52 - 2017-01-04 21:53 - 000000000 ____D C:\Users\Administrator\AppData\LocalLow\Mozilla
2018-02-01 12:26 - 2015-11-02 13:11 - 000000000 ____D C:\Windows\pss
2018-02-01 08:16 - 2016-10-09 09:50 - 000000000 ____D C:\Windows\Minidump
2018-02-01 00:23 - 2015-10-31 22:01 - 000000000 ____D C:\Users\juergen2
2018-01-31 22:47 - 2016-08-18 13:38 - 000000981 _____ C:\Users\juergen2\Desktop\PARI.lnk
2018-01-31 22:34 - 2016-08-18 19:24 - 000000000 ____D C:\tmp
2018-01-31 22:19 - 2016-08-18 13:37 - 000000000 ____D C:\Program Files (x86)\Pari-2-7-6
2018-01-31 22:01 - 2015-12-21 20:28 - 000000000 ____D C:\Program Files (x86)\Google
2018-01-30 20:56 - 2015-11-01 10:23 - 000000000 ____D C:\Users\juergen2\AppData\Local\Adobe
2018-01-30 20:47 - 2016-02-17 17:00 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-30 20:47 - 2015-11-01 10:23 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-30 20:47 - 2015-11-01 10:23 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-30 20:06 - 2017-08-26 17:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-28 21:35 - 2015-11-15 10:42 - 000000000 ____D C:\vhd
2018-01-28 21:10 - 2017-02-20 18:08 - 000000000 ____D C:\Focus sro client
2018-01-28 21:10 - 2015-12-08 14:06 - 000000000 ____D C:\camel
2018-01-26 12:50 - 2015-11-15 10:22 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\gnupg
2018-01-25 00:48 - 2017-06-30 15:19 - 000004100 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1498067933
2018-01-23 19:58 - 2010-11-21 04:27 - 000548000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2018-01-19 14:22 - 2015-11-01 09:42 - 000765656 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2018-01-18 14:27 - 2016-05-12 18:47 - 000001945 _____ C:\Windows\epplauncher.mif
2018-01-18 14:04 - 2009-07-14 06:08 - 000032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-01-15 11:23 - 2017-12-10 15:05 - 000001302 _____ C:\Users\Public\Desktop\Skype.lnk
2018-01-15 11:23 - 2017-12-10 15:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-01-12 17:49 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\rescache
2018-01-12 14:20 - 2009-07-14 05:45 - 000317576 _____ C:\Windows\system32\FNTCACHE.DAT
2018-01-11 16:30 - 2017-12-30 15:22 - 000000000 ____D C:\Program Files\Recuva
2018-01-11 14:15 - 2011-04-12 09:28 - 000000000 ___RD C:\Users\Public\Recorded TV
2018-01-11 12:41 - 2015-11-01 09:41 - 000000000 ____D C:\ProgramData\Package Cache
2018-01-11 02:00 - 2015-11-01 12:47 - 000000000 ____D C:\Windows\system32\MRT
2018-01-11 01:56 - 2017-10-12 02:06 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-01-11 01:56 - 2015-11-01 12:47 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-01-09 15:28 - 2017-09-02 13:28 - 000004486 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier
2018-01-09 09:50 - 2015-12-21 20:28 - 000002187 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk
2018-01-09 09:50 - 2015-12-21 20:28 - 000002175 _____ C:\Users\Public\Desktop\Google Chrome.lnk

==================== Files in the root of some directories =======

2016-03-04 22:10 - 2016-06-19 15:31 - 000000080 _____ () C:\Users\juergen2\AppData\Roaming\mBot.ini
2016-11-24 22:46 - 2017-10-30 10:35 - 000000600 _____ () C:\Users\juergen2\AppData\Roaming\winscp.rnd
2015-11-14 12:57 - 2018-02-03 16:54 - 000075264 _____ () C:\Users\juergen2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-10-31 15:54 - 2017-09-12 19:13 - 000000600 _____ () C:\Users\juergen2\AppData\Local\PUTTY.RND
2016-09-04 11:50 - 2016-09-04 11:50 - 000001192 _____ () C:\Users\juergen2\AppData\Local\recently-used.xbel
2018-02-02 14:52 - 2018-02-02 14:52 - 000000017 _____ () C:\Users\juergen2\AppData\Local\resmon.resmoncfg

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-29 17:35

==================== End of FRST.txt ============================
--- --- ---

cosinus 06.02.2018 09:40
Zitat:
Eine Liste von 120 Dateien in Quarantäne, die als "verdächtige Dateien" bezeichnet werden meist in c:/program files(x86), die ich leider nicht copy / pasten kann.
Schau bitte richtig im Verlauf nach den Logfiles. Ohne zu wissen was genau wo gefunden wurde ist das alles recht sinnfrei.

juergen007 06.02.2018 10:40
Quarantäne avira mit 2 usern
 
Liste der Anhänge anzeigen (Anzahl: 5)
Ich habe 2 Beuzter einen ""Administrator" den ich selbst kreiierte. Der liefert erstes u.a. logfile, komisch da ich das nie gekauft habe.
Einen user "juergen2", um den es mir haupsächlich geht, habe ich auch ein log file gefunden , s.u.
Leider kann ich von dem Quarantäne Bild der abglaufenen Version in juergen2 nur ein sehr düsteres Bild der Quarantän Dateien finde, da wohl die Trial Zeit schon abgelaufen ist.
Ich lade 5 auszugsweise Bilder hoch.. soryy weiss nicht was ich sonst machen kann..

An sich müssten die von avira irgendwann ?? Quartänisierten Daeien ja irgendwo stehen?
Danke!!


User Administrator:

Code:

Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 06. Februar 2018  09:58


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Free
Seriennummer  : 0000149996-AVHOE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : JUERGEN2-PC

Versionsinformationen:
build.dat      : 15.0.34.20    121293 Bytes  29.01.2018 10:05:00
AVSCAN.EXE    : 15.0.34.12  1569480 Bytes  03.01.2018 21:33:34
AVSCANRC.DLL  : 15.0.34.12    73768 Bytes  03.01.2018 21:33:34
LUKE.DLL      : 15.0.34.12    82144 Bytes  03.01.2018 21:33:36
AVSCPLR.DLL    : 15.0.34.12    156888 Bytes  03.01.2018 21:33:34
REPAIR.DLL    : 15.0.34.12    758032 Bytes  03.01.2018 21:33:33
repair.rdf    : 1.0.37.90    1689532 Bytes  05.02.2018 15:36:12
AVREG.DLL      : 15.0.34.12    456632 Bytes  03.01.2018 21:33:33
avlode.dll    : 15.0.34.13    926776 Bytes  03.01.2018 21:33:33
avlode.rdf    : 14.0.5.136    196180 Bytes  11.01.2018 08:09:27
XBV00004.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00005.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00006.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00007.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00008.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00009.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00010.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00011.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00012.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00013.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00014.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00015.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00016.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00017.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00018.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00019.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00020.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00021.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00022.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00023.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00024.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00025.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00026.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00027.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00028.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00029.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00030.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00031.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00032.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00033.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00034.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00035.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00036.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00037.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00038.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00039.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00040.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00041.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00186.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00187.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00188.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00189.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00190.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00191.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00192.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00193.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00194.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00195.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00196.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00197.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00198.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00199.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00200.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00201.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00202.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00203.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00204.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00205.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00206.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00207.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00208.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00209.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00210.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00211.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00212.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00213.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00214.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00215.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00216.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00217.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00218.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00219.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00220.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00221.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00222.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00223.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00224.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00225.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00226.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00227.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00228.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00229.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00230.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00231.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00232.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00233.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00234.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00235.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00236.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00237.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00238.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00239.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00240.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00241.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00242.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00243.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00244.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00245.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00246.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00247.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00248.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00249.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00250.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00251.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00252.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00253.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00254.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00255.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00000.VDF  : 7.14.1.132  155588096 Bytes  25.04.2017 07:56:49
XBV00001.VDF  : 7.14.18.244 21405696 Bytes  26.07.2017 07:56:48
XBV00002.VDF  : 8.14.39.30  23936512 Bytes  20.12.2017 07:56:48
XBV00003.VDF  : 8.14.43.156  6366720 Bytes  17.01.2018 17:59:15
XBV00042.VDF  : 8.14.43.158    20992 Bytes  17.01.2018 21:59:14
XBV00043.VDF  : 8.14.43.160    38400 Bytes  17.01.2018 21:59:14
XBV00044.VDF  : 8.14.43.162    20992 Bytes  17.01.2018 21:59:14
XBV00045.VDF  : 8.14.43.166  107008 Bytes  18.01.2018 13:14:18
XBV00046.VDF  : 8.14.43.168    46592 Bytes  18.01.2018 13:14:18
XBV00047.VDF  : 8.14.43.170    24576 Bytes  18.01.2018 19:14:28
XBV00048.VDF  : 8.14.43.172    28160 Bytes  18.01.2018 19:14:28
XBV00049.VDF  : 8.14.43.174    38400 Bytes  18.01.2018 21:14:31
XBV00050.VDF  : 8.14.43.204  131584 Bytes  19.01.2018 13:14:21
XBV00051.VDF  : 8.14.43.218    14848 Bytes  19.01.2018 13:14:21
XBV00052.VDF  : 8.14.43.232    13312 Bytes  19.01.2018 13:14:21
XBV00053.VDF  : 8.14.43.246    14336 Bytes  19.01.2018 13:14:21
XBV00054.VDF  : 8.14.43.248    15360 Bytes  19.01.2018 13:14:21
XBV00055.VDF  : 8.14.43.250    8704 Bytes  19.01.2018 15:14:18
XBV00056.VDF  : 8.14.43.252    10752 Bytes  19.01.2018 17:14:21
XBV00057.VDF  : 8.14.44.0      9216 Bytes  19.01.2018 19:14:27
XBV00058.VDF  : 8.14.44.2      6144 Bytes  19.01.2018 19:14:27
XBV00059.VDF  : 8.14.44.6      9728 Bytes  19.01.2018 21:14:35
XBV00060.VDF  : 8.14.44.10    45056 Bytes  20.01.2018 10:59:21
XBV00061.VDF  : 8.14.44.12      6656 Bytes  20.01.2018 12:59:36
XBV00062.VDF  : 8.14.44.14    11264 Bytes  20.01.2018 12:59:37
XBV00063.VDF  : 8.14.44.16      7168 Bytes  20.01.2018 14:59:35
XBV00064.VDF  : 8.14.44.18    22016 Bytes  20.01.2018 09:59:42
XBV00065.VDF  : 8.14.44.20    209408 Bytes  21.01.2018 09:59:42
XBV00066.VDF  : 8.14.44.22    54272 Bytes  21.01.2018 12:00:01
XBV00067.VDF  : 8.14.44.24    35840 Bytes  21.01.2018 13:59:48
XBV00068.VDF  : 8.14.44.26    22016 Bytes  21.01.2018 13:59:48
XBV00069.VDF  : 8.14.44.28    195072 Bytes  22.01.2018 13:32:50
XBV00070.VDF  : 8.14.44.30    22016 Bytes  22.01.2018 13:32:50
XBV00071.VDF  : 8.14.44.32    21504 Bytes  22.01.2018 13:32:50
XBV00072.VDF  : 8.14.44.34    33280 Bytes  22.01.2018 13:32:50
XBV00073.VDF  : 8.14.44.36    34304 Bytes  22.01.2018 15:32:57
XBV00074.VDF  : 8.14.44.38    25600 Bytes  22.01.2018 19:32:57
XBV00075.VDF  : 8.14.44.40    19456 Bytes  22.01.2018 19:32:57
XBV00076.VDF  : 8.14.44.42    38400 Bytes  22.01.2018 21:33:15
XBV00077.VDF  : 8.14.44.44    30208 Bytes  22.01.2018 23:34:05
XBV00078.VDF  : 8.14.44.106    99328 Bytes  23.01.2018 11:23:29
XBV00079.VDF  : 8.14.44.120    37376 Bytes  23.01.2018 11:23:29
XBV00080.VDF  : 8.14.44.134    24064 Bytes  23.01.2018 11:23:29
XBV00081.VDF  : 8.14.44.148    17920 Bytes  23.01.2018 14:29:52
XBV00082.VDF  : 8.14.44.152    27136 Bytes  23.01.2018 14:29:52
XBV00083.VDF  : 8.14.44.154    20992 Bytes  23.01.2018 16:29:25
XBV00084.VDF  : 8.14.44.156    18432 Bytes  23.01.2018 18:29:24
XBV00085.VDF  : 8.14.44.158    28160 Bytes  23.01.2018 18:29:24
XBV00086.VDF  : 8.14.44.160    18944 Bytes  23.01.2018 20:29:25
XBV00087.VDF  : 8.14.44.162    19968 Bytes  23.01.2018 22:29:25
XBV00088.VDF  : 8.14.44.168  195584 Bytes  24.01.2018 11:53:48
XBV00089.VDF  : 8.14.44.170    38400 Bytes  24.01.2018 17:53:28
XBV00090.VDF  : 8.14.44.172    30208 Bytes  24.01.2018 17:53:28
XBV00091.VDF  : 8.14.44.174    2048 Bytes  24.01.2018 17:53:28
XBV00092.VDF  : 8.14.44.176    27648 Bytes  24.01.2018 19:53:53
XBV00093.VDF  : 8.14.44.180  167936 Bytes  25.01.2018 12:13:03
XBV00094.VDF  : 8.14.44.182    8704 Bytes  25.01.2018 12:13:04
XBV00095.VDF  : 8.14.44.184    7680 Bytes  25.01.2018 12:13:04
XBV00096.VDF  : 8.14.44.186    12800 Bytes  25.01.2018 12:13:04
XBV00097.VDF  : 8.14.44.188    32768 Bytes  25.01.2018 14:11:52
XBV00098.VDF  : 8.14.44.190    17920 Bytes  25.01.2018 16:11:52
XBV00099.VDF  : 8.14.44.192    17920 Bytes  25.01.2018 18:12:11
XBV00100.VDF  : 8.14.44.194    27648 Bytes  25.01.2018 20:11:58
XBV00101.VDF  : 8.14.44.196    26624 Bytes  25.01.2018 11:17:54
XBV00102.VDF  : 8.14.44.202    82944 Bytes  26.01.2018 11:17:55
XBV00103.VDF  : 8.14.44.204    5120 Bytes  26.01.2018 11:17:55
XBV00104.VDF  : 8.14.44.206    4096 Bytes  26.01.2018 11:17:55
XBV00105.VDF  : 8.14.44.208    11776 Bytes  26.01.2018 13:17:48
XBV00106.VDF  : 8.14.44.210    19456 Bytes  26.01.2018 15:17:48
XBV00107.VDF  : 8.14.44.212    79360 Bytes  26.01.2018 17:17:49
XBV00108.VDF  : 8.14.44.214    36352 Bytes  26.01.2018 19:17:49
XBV00109.VDF  : 8.14.44.216    24576 Bytes  26.01.2018 00:13:36
XBV00110.VDF  : 8.14.44.218    11776 Bytes  26.01.2018 00:13:36
XBV00111.VDF  : 8.14.44.220    8192 Bytes  26.01.2018 00:13:36
XBV00112.VDF  : 8.14.44.236  116736 Bytes  27.01.2018 12:52:40
XBV00113.VDF  : 8.14.44.248    2048 Bytes  27.01.2018 12:52:40
XBV00114.VDF  : 8.14.45.4      25600 Bytes  27.01.2018 12:52:40
XBV00115.VDF  : 8.14.45.16    10752 Bytes  27.01.2018 14:52:25
XBV00116.VDF  : 8.14.45.28    137216 Bytes  28.01.2018 10:09:00
XBV00117.VDF  : 8.14.45.30      2048 Bytes  28.01.2018 10:09:00
XBV00118.VDF  : 8.14.45.32    25088 Bytes  28.01.2018 12:09:05
XBV00119.VDF  : 8.14.45.34    17408 Bytes  28.01.2018 14:09:08
XBV00120.VDF  : 8.14.45.38    154624 Bytes  29.01.2018 11:10:21
XBV00121.VDF  : 8.14.45.40      7680 Bytes  29.01.2018 11:10:21
XBV00122.VDF  : 8.14.45.42    12800 Bytes  29.01.2018 11:10:21
XBV00123.VDF  : 8.14.45.44      8704 Bytes  29.01.2018 11:10:21
XBV00124.VDF  : 8.14.45.46    15360 Bytes  29.01.2018 15:09:26
XBV00125.VDF  : 8.14.45.48    20992 Bytes  29.01.2018 15:09:26
XBV00126.VDF  : 8.14.45.50    27648 Bytes  29.01.2018 17:14:38
XBV00127.VDF  : 8.14.45.52    16384 Bytes  29.01.2018 19:09:55
XBV00128.VDF  : 8.14.45.54    20480 Bytes  29.01.2018 21:09:46
XBV00129.VDF  : 8.14.45.58    134144 Bytes  30.01.2018 11:20:28
XBV00130.VDF  : 8.14.45.60    12800 Bytes  30.01.2018 11:20:28
XBV00131.VDF  : 8.14.45.62      9728 Bytes  30.01.2018 11:20:28
XBV00132.VDF  : 8.14.45.64    14848 Bytes  30.01.2018 11:20:28
XBV00133.VDF  : 8.14.45.66    16384 Bytes  30.01.2018 13:19:48
XBV00134.VDF  : 8.14.45.68    11264 Bytes  30.01.2018 15:19:37
XBV00135.VDF  : 8.14.45.70    12288 Bytes  30.01.2018 15:19:37
XBV00136.VDF  : 8.14.45.72    14336 Bytes  30.01.2018 17:19:37
XBV00137.VDF  : 8.14.45.74    12288 Bytes  30.01.2018 19:20:51
XBV00138.VDF  : 8.14.45.76    17920 Bytes  30.01.2018 19:20:51
XBV00139.VDF  : 8.14.45.78    16896 Bytes  30.01.2018 21:19:39
XBV00140.VDF  : 8.14.45.82    117248 Bytes  31.01.2018 10:14:16
XBV00141.VDF  : 8.14.45.84      2048 Bytes  31.01.2018 10:14:16
XBV00142.VDF  : 8.14.45.86    30720 Bytes  31.01.2018 12:14:18
XBV00143.VDF  : 8.14.45.88    35328 Bytes  31.01.2018 16:14:10
XBV00144.VDF  : 8.14.45.90    27136 Bytes  31.01.2018 20:14:30
XBV00145.VDF  : 8.14.45.92    15360 Bytes  31.01.2018 20:14:30
XBV00146.VDF  : 8.14.45.106  101888 Bytes  01.02.2018 09:53:55
XBV00147.VDF  : 8.14.45.118    10240 Bytes  01.02.2018 09:53:55
XBV00148.VDF  : 8.14.45.130    12288 Bytes  01.02.2018 09:53:55
XBV00149.VDF  : 8.14.45.142    9728 Bytes  01.02.2018 16:12:28
XBV00150.VDF  : 8.14.45.154    14848 Bytes  01.02.2018 16:12:28
XBV00151.VDF  : 8.14.45.156    13312 Bytes  01.02.2018 16:12:28
XBV00152.VDF  : 8.14.45.158    10752 Bytes  01.02.2018 16:12:28
XBV00153.VDF  : 8.14.45.160    13824 Bytes  01.02.2018 18:12:32
XBV00154.VDF  : 8.14.45.162    12800 Bytes  01.02.2018 20:13:53
XBV00155.VDF  : 8.14.45.164    2048 Bytes  01.02.2018 20:13:53
XBV00156.VDF  : 8.14.45.166    27648 Bytes  01.02.2018 22:12:32
XBV00157.VDF  : 8.14.45.170  101376 Bytes  02.02.2018 09:53:08
XBV00158.VDF  : 8.14.45.172    2048 Bytes  02.02.2018 09:53:08
XBV00159.VDF  : 8.14.45.174    36352 Bytes  02.02.2018 12:24:16
XBV00160.VDF  : 8.14.45.176    31232 Bytes  02.02.2018 17:38:36
XBV00161.VDF  : 8.14.45.178    23552 Bytes  02.02.2018 23:38:30
XBV00162.VDF  : 8.14.45.180    2048 Bytes  02.02.2018 23:38:30
XBV00163.VDF  : 8.14.45.182    2048 Bytes  02.02.2018 23:38:30
XBV00164.VDF  : 8.14.45.186  117760 Bytes  03.02.2018 11:31:19
XBV00165.VDF  : 8.14.45.188    10240 Bytes  03.02.2018 11:31:19
XBV00166.VDF  : 8.14.45.190    10752 Bytes  03.02.2018 13:30:36
XBV00167.VDF  : 8.14.45.192    7680 Bytes  03.02.2018 13:30:36
XBV00168.VDF  : 8.14.45.194    13312 Bytes  03.02.2018 15:30:23
XBV00169.VDF  : 8.14.45.196    13312 Bytes  03.02.2018 15:30:23
XBV00170.VDF  : 8.14.45.198  151552 Bytes  04.02.2018 13:08:34
XBV00171.VDF  : 8.14.45.200    13312 Bytes  04.02.2018 13:08:34
XBV00172.VDF  : 8.14.45.202    8704 Bytes  04.02.2018 13:08:34
XBV00173.VDF  : 8.14.45.204    9216 Bytes  04.02.2018 13:08:34
XBV00174.VDF  : 8.14.45.206    9216 Bytes  04.02.2018 15:08:33
XBV00175.VDF  : 8.14.45.208    10752 Bytes  04.02.2018 17:08:35
XBV00176.VDF  : 8.14.45.210    6656 Bytes  04.02.2018 17:08:35
XBV00177.VDF  : 8.14.45.212  116736 Bytes  05.02.2018 09:02:23
XBV00178.VDF  : 8.14.45.214    6656 Bytes  05.02.2018 09:02:23
XBV00179.VDF  : 8.14.45.216    15872 Bytes  05.02.2018 11:03:42
XBV00180.VDF  : 8.14.45.218    15360 Bytes  05.02.2018 15:36:12
XBV00181.VDF  : 8.14.45.220    15360 Bytes  05.02.2018 15:36:12
XBV00182.VDF  : 8.14.45.222    20992 Bytes  05.02.2018 17:35:53
XBV00183.VDF  : 8.14.45.224    18432 Bytes  05.02.2018 17:35:53
XBV00184.VDF  : 8.14.45.226    19968 Bytes  05.02.2018 21:35:57
XBV00185.VDF  : 8.14.45.228    16896 Bytes  05.02.2018 21:35:57
LOCAL001.VDF  : 8.14.45.228 218178048 Bytes  05.02.2018 21:37:29
Engineversion  : 8.3.48.154
AEBB.DLL      : 8.1.3.2        71144 Bytes  11.01.2018 07:48:44
AECORE.DLL    : 8.3.14.0      266480 Bytes  11.01.2018 07:48:44
AECRYPTO.DLL  : 8.2.1.2      141800 Bytes  11.01.2018 07:48:44
AEDROID.DLL    : 8.4.3.410    2801640 Bytes  19.01.2018 13:14:20
AEEMU.DLL      : 8.1.3.10      420248 Bytes  11.01.2018 07:48:44
AEEXP.DLL      : 8.4.4.106    382848 Bytes  11.01.2018 07:48:44
AEGEN.DLL      : 8.1.8.328    702864 Bytes  11.01.2018 07:48:44
AEHELP.DLL    : 8.3.3.0      299728 Bytes  11.01.2018 07:48:44
AEHEUR.DLL    : 8.1.6.168  11699672 Bytes  12.01.2018 13:34:15
AELIBINF.DLL  : 8.2.1.6        79464 Bytes  11.01.2018 07:48:44
AEMOBILE.DLL  : 8.1.18.6      362072 Bytes  11.01.2018 07:48:44
AEOFFICE.DLL  : 8.4.4.8      669616 Bytes  16.01.2018 23:50:03
AEPACK.DLL    : 8.4.2.76      835856 Bytes  11.01.2018 07:48:44
AERDL.DLL      : 8.2.2.50    1263912 Bytes  11.01.2018 07:48:44
AESBX.DLL      : 8.2.22.14    1667056 Bytes  11.01.2018 07:48:44
AESCN.DLL      : 8.3.8.0      158416 Bytes  11.01.2018 07:48:44
AESCRIPT.DLL  : 8.3.4.34      981312 Bytes  02.02.2018 12:24:16
AEVDF.DLL      : 8.3.3.6      154264 Bytes  11.01.2018 07:48:44
AVWINLL.DLL    : 15.0.34.12    37448 Bytes  03.01.2018 21:33:34
AVPREF.DLL    : 15.0.34.12    63920 Bytes  03.01.2018 21:33:33
AVREP.DLL      : 15.0.34.12    234888 Bytes  03.01.2018 21:33:33
AVARKT.DLL    : 15.0.34.12    241096 Bytes  03.01.2018 21:33:33
SQLITE3.DLL    : 15.0.34.12    473256 Bytes  03.01.2018 21:33:37
AVSMTP.DLL    : 15.0.34.12    90392 Bytes  03.01.2018 21:33:34
NETNT.DLL      : 15.0.34.12    26568 Bytes  03.01.2018 21:33:36
CommonImageRc.dll: 15.0.34.12  3878048 Bytes  03.01.2018 21:33:37
CommonTextRc.dll: 15.0.34.12    82592 Bytes  03.01.2018 21:33:37

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Schnelle Prüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\Antivirus\quicksysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, ":,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Auszulassende Dateien.................:

Beginn des Suchlaufs: Dienstag, 06. Februar 2018  09:58

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, ":)'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'MsMpEng.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'BCWipeSvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '148' Modul(e) wurden durchsucht
Durchsuche Prozess 'BCWipeTM.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'BCWipeTM.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'UMVPFSrv.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Fuel.Service.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'dirmngr.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'pabeSvc64.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.ServiceHost.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '176' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'msseces.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNMNSST.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '233' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.Systray.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '70' Modul(e) wurden durchsucht
Durchsuche Prozess 'NisSrv.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '138' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'sppsvc.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'update.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'ipmGui.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '3066' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe'
Beginne mit der Suche in 'C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe'
Der zu durchsuchende Pfad C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe konnte nicht geöffnet werden!
Systemfehler [2]: The system cannot find the file specified.
Beginne mit der Suche in '"C:\Program Files (x86)\Avira\Antivirus\avgnt.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Avira\Antivirus\avgnt.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in 'C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe'
Der zu durchsuchende Pfad C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in 'C:\Program Files\Microsoft Security Client\MpCmdRun.exe'
Beginne mit der Suche in 'C:\Windows\system32\appidpolicyconverter.exe'
Beginne mit der Suche in 'C:\Windows\system32\appidcertstorecheck.exe'
Beginne mit der Suche in 'C:\Windows\system32\aitagent.exe'
Beginne mit der Suche in 'C:\Windows\system32\CompatTelRunner.exe'
Beginne mit der Suche in 'C:\Windows\system32\rundll32.exe'
Beginne mit der Suche in 'C:\Windows\system32\BthUdTask.exe'
Beginne mit der Suche in 'C:\Windows\System32\wsqmcons.exe'
Beginne mit der Suche in 'C:\Windows\system32\defrag.exe'
Beginne mit der Suche in 'C:\Windows\system32\DFDWiz.exe'
Beginne mit der Suche in 'C:\Windows\System32\LocationNotifications.exe'
Beginne mit der Suche in 'C:\Windows\ehome\ehPrivJob.exe'
Beginne mit der Suche in 'C:\Windows\ehome\mcupdate.exe'
Beginne mit der Suche in 'C:\Windows\ehome\ehrec.exe'
Beginne mit der Suche in 'C:\Windows\system32\lpremove.exe'
Beginne mit der Suche in 'C:\Windows\system32\gatherNetworkInfo.vbs'
Beginne mit der Suche in 'C:\Windows\System32\powercfg.exe'
Beginne mit der Suche in 'C:\Windows\system32\RAServer.exe'
Beginne mit der Suche in 'C:\Windows\system32\sc.exe'
Beginne mit der Suche in 'C:\Windows\system32\wermgr.exe'
Beginne mit der Suche in 'C:\Program Files (x86)\Windows Media Player\wmpnscfg.exe"'
Der zu durchsuchende Pfad C:\Program Files (x86)\Windows Media Player\wmpnscfg.exe" konnte nicht geöffnet werden!
Systemfehler [2]: The system cannot find the file specified.
Beginne mit der Suche in 'C:\Windows\System32\sdclt.exe'
Beginne mit der Suche in 'C:\Users\juergen2\AppData\Local\Programs\Opera\launcher.exe'
Beginne mit der Suche in '"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in '"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in '"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in 'C:\Windows\system32\pcalua.exe'


Ende des Suchlaufs: Dienstag, 06. Februar 2018  10:00
Benötigte Zeit: 02:08 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      0 Verzeichnisse wurden überprüft
  4065 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
  4065 Dateien ohne Befall
    30 Archive wurden durchsucht
      0 Warnungen
      0 Hinweise
User juergen2:

Code:


Free Antivirus
Erstellungsdatum der Reportdatei: Dienstag, 06. Februar 2018  10:29


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Free
Seriennummer  : 0000149996-AVHOE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : JUERGEN2-PC

Versionsinformationen:
build.dat      : 15.0.34.20    121293 Bytes  29.01.2018 10:05:00
AVSCAN.EXE    : 15.0.34.12  1569480 Bytes  03.01.2018 21:33:34
AVSCANRC.DLL  : 15.0.34.12    73768 Bytes  03.01.2018 21:33:34
LUKE.DLL      : 15.0.34.12    82144 Bytes  03.01.2018 21:33:36
AVSCPLR.DLL    : 15.0.34.12    156888 Bytes  03.01.2018 21:33:34
REPAIR.DLL    : 15.0.34.12    758032 Bytes  03.01.2018 21:33:33
repair.rdf    : 1.0.37.90    1689532 Bytes  05.02.2018 15:36:12
AVREG.DLL      : 15.0.34.12    456632 Bytes  03.01.2018 21:33:33
avlode.dll    : 15.0.34.13    926776 Bytes  03.01.2018 21:33:33
avlode.rdf    : 14.0.5.136    196180 Bytes  11.01.2018 08:09:27
XBV00004.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00005.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00006.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00007.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00008.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00009.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00010.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00011.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00012.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00013.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00014.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00015.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00016.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00017.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00018.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00019.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00020.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00021.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00022.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00023.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00024.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00025.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00026.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00027.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00028.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00029.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00030.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00031.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00032.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00033.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00034.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00035.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00036.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00037.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00038.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00039.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00040.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00041.VDF  : 8.14.39.30      2048 Bytes  20.12.2017 07:56:48
XBV00188.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00189.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00190.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00191.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00192.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00193.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00194.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00195.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00196.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00197.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00198.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00199.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00200.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00201.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00202.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00203.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00204.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00205.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:19
XBV00206.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00207.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00208.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00209.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00210.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00211.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00212.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00213.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00214.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00215.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00216.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00217.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00218.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00219.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00220.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00221.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00222.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00223.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00224.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00225.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00226.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00227.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00228.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00229.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00230.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00231.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00232.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00233.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00234.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00235.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00236.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00237.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00238.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00239.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00240.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:20
XBV00241.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00242.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00243.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00244.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00245.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00246.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00247.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00248.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00249.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00250.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00251.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00252.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00253.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00254.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00255.VDF  : 8.14.43.156    2048 Bytes  17.01.2018 17:59:21
XBV00000.VDF  : 7.14.1.132  155588096 Bytes  25.04.2017 07:56:49
XBV00001.VDF  : 7.14.18.244 21405696 Bytes  26.07.2017 07:56:48
XBV00002.VDF  : 8.14.39.30  23936512 Bytes  20.12.2017 07:56:48
XBV00003.VDF  : 8.14.43.156  6366720 Bytes  17.01.2018 17:59:15
XBV00042.VDF  : 8.14.43.158    20992 Bytes  17.01.2018 21:59:14
XBV00043.VDF  : 8.14.43.160    38400 Bytes  17.01.2018 21:59:14
XBV00044.VDF  : 8.14.43.162    20992 Bytes  17.01.2018 21:59:14
XBV00045.VDF  : 8.14.43.166  107008 Bytes  18.01.2018 13:14:18
XBV00046.VDF  : 8.14.43.168    46592 Bytes  18.01.2018 13:14:18
XBV00047.VDF  : 8.14.43.170    24576 Bytes  18.01.2018 19:14:28
XBV00048.VDF  : 8.14.43.172    28160 Bytes  18.01.2018 19:14:28
XBV00049.VDF  : 8.14.43.174    38400 Bytes  18.01.2018 21:14:31
XBV00050.VDF  : 8.14.43.204  131584 Bytes  19.01.2018 13:14:21
XBV00051.VDF  : 8.14.43.218    14848 Bytes  19.01.2018 13:14:21
XBV00052.VDF  : 8.14.43.232    13312 Bytes  19.01.2018 13:14:21
XBV00053.VDF  : 8.14.43.246    14336 Bytes  19.01.2018 13:14:21
XBV00054.VDF  : 8.14.43.248    15360 Bytes  19.01.2018 13:14:21
XBV00055.VDF  : 8.14.43.250    8704 Bytes  19.01.2018 15:14:18
XBV00056.VDF  : 8.14.43.252    10752 Bytes  19.01.2018 17:14:21
XBV00057.VDF  : 8.14.44.0      9216 Bytes  19.01.2018 19:14:27
XBV00058.VDF  : 8.14.44.2      6144 Bytes  19.01.2018 19:14:27
XBV00059.VDF  : 8.14.44.6      9728 Bytes  19.01.2018 21:14:35
XBV00060.VDF  : 8.14.44.10    45056 Bytes  20.01.2018 10:59:21
XBV00061.VDF  : 8.14.44.12      6656 Bytes  20.01.2018 12:59:36
XBV00062.VDF  : 8.14.44.14    11264 Bytes  20.01.2018 12:59:37
XBV00063.VDF  : 8.14.44.16      7168 Bytes  20.01.2018 14:59:35
XBV00064.VDF  : 8.14.44.18    22016 Bytes  20.01.2018 09:59:42
XBV00065.VDF  : 8.14.44.20    209408 Bytes  21.01.2018 09:59:42
XBV00066.VDF  : 8.14.44.22    54272 Bytes  21.01.2018 12:00:01
XBV00067.VDF  : 8.14.44.24    35840 Bytes  21.01.2018 13:59:48
XBV00068.VDF  : 8.14.44.26    22016 Bytes  21.01.2018 13:59:48
XBV00069.VDF  : 8.14.44.28    195072 Bytes  22.01.2018 13:32:50
XBV00070.VDF  : 8.14.44.30    22016 Bytes  22.01.2018 13:32:50
XBV00071.VDF  : 8.14.44.32    21504 Bytes  22.01.2018 13:32:50
XBV00072.VDF  : 8.14.44.34    33280 Bytes  22.01.2018 13:32:50
XBV00073.VDF  : 8.14.44.36    34304 Bytes  22.01.2018 15:32:57
XBV00074.VDF  : 8.14.44.38    25600 Bytes  22.01.2018 19:32:57
XBV00075.VDF  : 8.14.44.40    19456 Bytes  22.01.2018 19:32:57
XBV00076.VDF  : 8.14.44.42    38400 Bytes  22.01.2018 21:33:15
XBV00077.VDF  : 8.14.44.44    30208 Bytes  22.01.2018 23:34:05
XBV00078.VDF  : 8.14.44.106    99328 Bytes  23.01.2018 11:23:29
XBV00079.VDF  : 8.14.44.120    37376 Bytes  23.01.2018 11:23:29
XBV00080.VDF  : 8.14.44.134    24064 Bytes  23.01.2018 11:23:29
XBV00081.VDF  : 8.14.44.148    17920 Bytes  23.01.2018 14:29:52
XBV00082.VDF  : 8.14.44.152    27136 Bytes  23.01.2018 14:29:52
XBV00083.VDF  : 8.14.44.154    20992 Bytes  23.01.2018 16:29:25
XBV00084.VDF  : 8.14.44.156    18432 Bytes  23.01.2018 18:29:24
XBV00085.VDF  : 8.14.44.158    28160 Bytes  23.01.2018 18:29:24
XBV00086.VDF  : 8.14.44.160    18944 Bytes  23.01.2018 20:29:25
XBV00087.VDF  : 8.14.44.162    19968 Bytes  23.01.2018 22:29:25
XBV00088.VDF  : 8.14.44.168  195584 Bytes  24.01.2018 11:53:48
XBV00089.VDF  : 8.14.44.170    38400 Bytes  24.01.2018 17:53:28
XBV00090.VDF  : 8.14.44.172    30208 Bytes  24.01.2018 17:53:28
XBV00091.VDF  : 8.14.44.174    2048 Bytes  24.01.2018 17:53:28
XBV00092.VDF  : 8.14.44.176    27648 Bytes  24.01.2018 19:53:53
XBV00093.VDF  : 8.14.44.180  167936 Bytes  25.01.2018 12:13:03
XBV00094.VDF  : 8.14.44.182    8704 Bytes  25.01.2018 12:13:04
XBV00095.VDF  : 8.14.44.184    7680 Bytes  25.01.2018 12:13:04
XBV00096.VDF  : 8.14.44.186    12800 Bytes  25.01.2018 12:13:04
XBV00097.VDF  : 8.14.44.188    32768 Bytes  25.01.2018 14:11:52
XBV00098.VDF  : 8.14.44.190    17920 Bytes  25.01.2018 16:11:52
XBV00099.VDF  : 8.14.44.192    17920 Bytes  25.01.2018 18:12:11
XBV00100.VDF  : 8.14.44.194    27648 Bytes  25.01.2018 20:11:58
XBV00101.VDF  : 8.14.44.196    26624 Bytes  25.01.2018 11:17:54
XBV00102.VDF  : 8.14.44.202    82944 Bytes  26.01.2018 11:17:55
XBV00103.VDF  : 8.14.44.204    5120 Bytes  26.01.2018 11:17:55
XBV00104.VDF  : 8.14.44.206    4096 Bytes  26.01.2018 11:17:55
XBV00105.VDF  : 8.14.44.208    11776 Bytes  26.01.2018 13:17:48
XBV00106.VDF  : 8.14.44.210    19456 Bytes  26.01.2018 15:17:48
XBV00107.VDF  : 8.14.44.212    79360 Bytes  26.01.2018 17:17:49
XBV00108.VDF  : 8.14.44.214    36352 Bytes  26.01.2018 19:17:49
XBV00109.VDF  : 8.14.44.216    24576 Bytes  26.01.2018 00:13:36
XBV00110.VDF  : 8.14.44.218    11776 Bytes  26.01.2018 00:13:36
XBV00111.VDF  : 8.14.44.220    8192 Bytes  26.01.2018 00:13:36
XBV00112.VDF  : 8.14.44.236  116736 Bytes  27.01.2018 12:52:40
XBV00113.VDF  : 8.14.44.248    2048 Bytes  27.01.2018 12:52:40
XBV00114.VDF  : 8.14.45.4      25600 Bytes  27.01.2018 12:52:40
XBV00115.VDF  : 8.14.45.16    10752 Bytes  27.01.2018 14:52:25
XBV00116.VDF  : 8.14.45.28    137216 Bytes  28.01.2018 10:09:00
XBV00117.VDF  : 8.14.45.30      2048 Bytes  28.01.2018 10:09:00
XBV00118.VDF  : 8.14.45.32    25088 Bytes  28.01.2018 12:09:05
XBV00119.VDF  : 8.14.45.34    17408 Bytes  28.01.2018 14:09:08
XBV00120.VDF  : 8.14.45.38    154624 Bytes  29.01.2018 11:10:21
XBV00121.VDF  : 8.14.45.40      7680 Bytes  29.01.2018 11:10:21
XBV00122.VDF  : 8.14.45.42    12800 Bytes  29.01.2018 11:10:21
XBV00123.VDF  : 8.14.45.44      8704 Bytes  29.01.2018 11:10:21
XBV00124.VDF  : 8.14.45.46    15360 Bytes  29.01.2018 15:09:26
XBV00125.VDF  : 8.14.45.48    20992 Bytes  29.01.2018 15:09:26
XBV00126.VDF  : 8.14.45.50    27648 Bytes  29.01.2018 17:14:38
XBV00127.VDF  : 8.14.45.52    16384 Bytes  29.01.2018 19:09:55
XBV00128.VDF  : 8.14.45.54    20480 Bytes  29.01.2018 21:09:46
XBV00129.VDF  : 8.14.45.58    134144 Bytes  30.01.2018 11:20:28
XBV00130.VDF  : 8.14.45.60    12800 Bytes  30.01.2018 11:20:28
XBV00131.VDF  : 8.14.45.62      9728 Bytes  30.01.2018 11:20:28
XBV00132.VDF  : 8.14.45.64    14848 Bytes  30.01.2018 11:20:28
XBV00133.VDF  : 8.14.45.66    16384 Bytes  30.01.2018 13:19:48
XBV00134.VDF  : 8.14.45.68    11264 Bytes  30.01.2018 15:19:37
XBV00135.VDF  : 8.14.45.70    12288 Bytes  30.01.2018 15:19:37
XBV00136.VDF  : 8.14.45.72    14336 Bytes  30.01.2018 17:19:37
XBV00137.VDF  : 8.14.45.74    12288 Bytes  30.01.2018 19:20:51
XBV00138.VDF  : 8.14.45.76    17920 Bytes  30.01.2018 19:20:51
XBV00139.VDF  : 8.14.45.78    16896 Bytes  30.01.2018 21:19:39
XBV00140.VDF  : 8.14.45.82    117248 Bytes  31.01.2018 10:14:16
XBV00141.VDF  : 8.14.45.84      2048 Bytes  31.01.2018 10:14:16
XBV00142.VDF  : 8.14.45.86    30720 Bytes  31.01.2018 12:14:18
XBV00143.VDF  : 8.14.45.88    35328 Bytes  31.01.2018 16:14:10
XBV00144.VDF  : 8.14.45.90    27136 Bytes  31.01.2018 20:14:30
XBV00145.VDF  : 8.14.45.92    15360 Bytes  31.01.2018 20:14:30
XBV00146.VDF  : 8.14.45.106  101888 Bytes  01.02.2018 09:53:55
XBV00147.VDF  : 8.14.45.118    10240 Bytes  01.02.2018 09:53:55
XBV00148.VDF  : 8.14.45.130    12288 Bytes  01.02.2018 09:53:55
XBV00149.VDF  : 8.14.45.142    9728 Bytes  01.02.2018 16:12:28
XBV00150.VDF  : 8.14.45.154    14848 Bytes  01.02.2018 16:12:28
XBV00151.VDF  : 8.14.45.156    13312 Bytes  01.02.2018 16:12:28
XBV00152.VDF  : 8.14.45.158    10752 Bytes  01.02.2018 16:12:28
XBV00153.VDF  : 8.14.45.160    13824 Bytes  01.02.2018 18:12:32
XBV00154.VDF  : 8.14.45.162    12800 Bytes  01.02.2018 20:13:53
XBV00155.VDF  : 8.14.45.164    2048 Bytes  01.02.2018 20:13:53
XBV00156.VDF  : 8.14.45.166    27648 Bytes  01.02.2018 22:12:32
XBV00157.VDF  : 8.14.45.170  101376 Bytes  02.02.2018 09:53:08
XBV00158.VDF  : 8.14.45.172    2048 Bytes  02.02.2018 09:53:08
XBV00159.VDF  : 8.14.45.174    36352 Bytes  02.02.2018 12:24:16
XBV00160.VDF  : 8.14.45.176    31232 Bytes  02.02.2018 17:38:36
XBV00161.VDF  : 8.14.45.178    23552 Bytes  02.02.2018 23:38:30
XBV00162.VDF  : 8.14.45.180    2048 Bytes  02.02.2018 23:38:30
XBV00163.VDF  : 8.14.45.182    2048 Bytes  02.02.2018 23:38:30
XBV00164.VDF  : 8.14.45.186  117760 Bytes  03.02.2018 11:31:19
XBV00165.VDF  : 8.14.45.188    10240 Bytes  03.02.2018 11:31:19
XBV00166.VDF  : 8.14.45.190    10752 Bytes  03.02.2018 13:30:36
XBV00167.VDF  : 8.14.45.192    7680 Bytes  03.02.2018 13:30:36
XBV00168.VDF  : 8.14.45.194    13312 Bytes  03.02.2018 15:30:23
XBV00169.VDF  : 8.14.45.196    13312 Bytes  03.02.2018 15:30:23
XBV00170.VDF  : 8.14.45.198  151552 Bytes  04.02.2018 13:08:34
XBV00171.VDF  : 8.14.45.200    13312 Bytes  04.02.2018 13:08:34
XBV00172.VDF  : 8.14.45.202    8704 Bytes  04.02.2018 13:08:34
XBV00173.VDF  : 8.14.45.204    9216 Bytes  04.02.2018 13:08:34
XBV00174.VDF  : 8.14.45.206    9216 Bytes  04.02.2018 15:08:33
XBV00175.VDF  : 8.14.45.208    10752 Bytes  04.02.2018 17:08:35
XBV00176.VDF  : 8.14.45.210    6656 Bytes  04.02.2018 17:08:35
XBV00177.VDF  : 8.14.45.212  116736 Bytes  05.02.2018 09:02:23
XBV00178.VDF  : 8.14.45.214    6656 Bytes  05.02.2018 09:02:23
XBV00179.VDF  : 8.14.45.216    15872 Bytes  05.02.2018 11:03:42
XBV00180.VDF  : 8.14.45.218    15360 Bytes  05.02.2018 15:36:12
XBV00181.VDF  : 8.14.45.220    15360 Bytes  05.02.2018 15:36:12
XBV00182.VDF  : 8.14.45.222    20992 Bytes  05.02.2018 17:35:53
XBV00183.VDF  : 8.14.45.224    18432 Bytes  05.02.2018 17:35:53
XBV00184.VDF  : 8.14.45.226    19968 Bytes  05.02.2018 21:35:57
XBV00185.VDF  : 8.14.45.228    16896 Bytes  05.02.2018 21:35:57
XBV00186.VDF  : 8.14.45.234  128512 Bytes  06.02.2018 08:58:26
XBV00187.VDF  : 8.14.45.236    8704 Bytes  06.02.2018 08:58:26
LOCAL000.VDF  : 8.14.45.236 218296832 Bytes  06.02.2018 08:58:55
Engineversion  : 8.3.48.154
AEBB.DLL      : 8.1.3.2        71144 Bytes  11.01.2018 07:48:44
AECORE.DLL    : 8.3.14.0      266480 Bytes  11.01.2018 07:48:44
AECRYPTO.DLL  : 8.2.1.2      141800 Bytes  11.01.2018 07:48:44
AEDROID.DLL    : 8.4.3.410    2801640 Bytes  19.01.2018 13:14:20
AEEMU.DLL      : 8.1.3.10      420248 Bytes  11.01.2018 07:48:44
AEEXP.DLL      : 8.4.4.106    382848 Bytes  11.01.2018 07:48:44
AEGEN.DLL      : 8.1.8.328    702864 Bytes  11.01.2018 07:48:44
AEHELP.DLL    : 8.3.3.0      299728 Bytes  11.01.2018 07:48:44
AEHEUR.DLL    : 8.1.6.168  11699672 Bytes  12.01.2018 13:34:15
AELIBINF.DLL  : 8.2.1.6        79464 Bytes  11.01.2018 07:48:44
AEMOBILE.DLL  : 8.1.18.6      362072 Bytes  11.01.2018 07:48:44
AEOFFICE.DLL  : 8.4.4.8      669616 Bytes  16.01.2018 23:50:03
AEPACK.DLL    : 8.4.2.76      835856 Bytes  11.01.2018 07:48:44
AERDL.DLL      : 8.2.2.50    1263912 Bytes  11.01.2018 07:48:44
AESBX.DLL      : 8.2.22.14    1667056 Bytes  11.01.2018 07:48:44
AESCN.DLL      : 8.3.8.0      158416 Bytes  11.01.2018 07:48:44
AESCRIPT.DLL  : 8.3.4.34      981312 Bytes  02.02.2018 12:24:16
AEVDF.DLL      : 8.3.3.6      154264 Bytes  11.01.2018 07:48:44
AVWINLL.DLL    : 15.0.34.12    37448 Bytes  03.01.2018 21:33:34
AVPREF.DLL    : 15.0.34.12    63920 Bytes  03.01.2018 21:33:33
AVREP.DLL      : 15.0.34.12    234888 Bytes  03.01.2018 21:33:33
AVARKT.DLL    : 15.0.34.12    241096 Bytes  03.01.2018 21:33:33
SQLITE3.DLL    : 15.0.34.12    473256 Bytes  03.01.2018 21:33:37
AVSMTP.DLL    : 15.0.34.12    90392 Bytes  03.01.2018 21:33:34
NETNT.DLL      : 15.0.34.12    26568 Bytes  03.01.2018 21:33:36
CommonImageRc.dll: 15.0.34.12  3878048 Bytes  03.01.2018 21:33:37
CommonTextRc.dll: 15.0.34.12    82592 Bytes  03.01.2018 21:33:37

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Schnelle Prüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\Antivirus\quicksysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, ":,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Auszulassende Dateien.................:

Beginn des Suchlaufs: Dienstag, 06. Februar 2018  10:29

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, ":)'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'MsMpEng.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'BCWipeSvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '76' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '153' Modul(e) wurden durchsucht
Durchsuche Prozess 'BCWipeTM.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'BCWipeTM.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'UMVPFSrv.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '73' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'Fuel.Service.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'dirmngr.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'pabeSvc64.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.ServiceHost.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '177' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'msseces.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNMNSST.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '238' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleCrashHandler64.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.Systray.exe' - '144' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'NisSrv.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '150' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '97' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '116' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'notepad.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '179' Modul(e) wurden durchsucht
Durchsuche Prozess 'nusb3mon.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'msseces.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'AMDQuickStream.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'CNMNSST.exe' - '43' Modul(e) wurden durchsucht
Durchsuche Prozess 'MOM.exe' - '83' Modul(e) wurden durchsucht
Durchsuche Prozess 'CCC.exe' - '234' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.Systray.exe' - '159' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '129' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '103' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '118' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '99' Modul(e) wurden durchsucht
Durchsuche Prozess 'TOTALCMD.EXE' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '30' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '3342' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe'
Beginne mit der Suche in 'C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe'
Der zu durchsuchende Pfad C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe konnte nicht geöffnet werden!
Systemfehler [2]: The system cannot find the file specified.
Beginne mit der Suche in '"C:\Program Files (x86)\Avira\Antivirus\avgnt.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Avira\Antivirus\avgnt.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in 'C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe'
Der zu durchsuchende Pfad C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in 'C:\Program Files\Microsoft Security Client\MpCmdRun.exe'
Beginne mit der Suche in 'C:\Windows\system32\appidpolicyconverter.exe'
Beginne mit der Suche in 'C:\Windows\system32\appidcertstorecheck.exe'
Beginne mit der Suche in 'C:\Windows\system32\aitagent.exe'
Beginne mit der Suche in 'C:\Windows\system32\CompatTelRunner.exe'
Beginne mit der Suche in 'C:\Windows\system32\rundll32.exe'
Beginne mit der Suche in 'C:\Windows\system32\BthUdTask.exe'
Beginne mit der Suche in 'C:\Windows\System32\wsqmcons.exe'
Beginne mit der Suche in 'C:\Windows\system32\defrag.exe'
Beginne mit der Suche in 'C:\Windows\system32\DFDWiz.exe'
Beginne mit der Suche in 'C:\Windows\System32\LocationNotifications.exe'
Beginne mit der Suche in 'C:\Windows\ehome\ehPrivJob.exe'
Beginne mit der Suche in 'C:\Windows\ehome\mcupdate.exe'
Beginne mit der Suche in 'C:\Windows\ehome\ehrec.exe'
Beginne mit der Suche in 'C:\Windows\system32\lpremove.exe'
Beginne mit der Suche in 'C:\Windows\system32\gatherNetworkInfo.vbs'
Beginne mit der Suche in 'C:\Windows\System32\powercfg.exe'
Beginne mit der Suche in 'C:\Windows\system32\RAServer.exe'
Beginne mit der Suche in 'C:\Windows\system32\sc.exe'
Beginne mit der Suche in 'C:\Windows\system32\wermgr.exe'
Beginne mit der Suche in 'C:\Program Files (x86)\Windows Media Player\wmpnscfg.exe"'
Der zu durchsuchende Pfad C:\Program Files (x86)\Windows Media Player\wmpnscfg.exe" konnte nicht geöffnet werden!
Systemfehler [2]: The system cannot find the file specified.
Beginne mit der Suche in 'C:\Windows\System32\sdclt.exe'
Beginne mit der Suche in 'C:\Users\juergen2\AppData\Local\Programs\Opera\launcher.exe'
Beginne mit der Suche in '"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in '"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in '"C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe"'
Der zu durchsuchende Pfad "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe" konnte nicht geöffnet werden!
Systemfehler [3]: The system cannot find the path specified.
Beginne mit der Suche in 'C:\Windows\system32\pcalua.exe'


Ende des Suchlaufs: Dienstag, 06. Februar 2018  10:30
Benötigte Zeit: 00:58 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      0 Verzeichnisse wurden überprüft
  4393 Dateien wurden geprüft
      0 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      0 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
  4393 Dateien ohne Befall
    34 Archive wurden durchsucht
      0 Warnungen
      0 Hinweise

cosinus 06.02.2018 10:49
Das ist Junkware. Mehr wollte ich nicht wissen.


Bitte Avira deinstallieren. Wir deinstallieren dann am besten auch gleich weiteren unnötigen oder veralteten Krempel.

Avira empfehlen wir schon seit Jahren aus mehreren Gründen nicht mehr. Ein Grund ist ne rel. hohe Fehlalarmquote, der zweite Hauptgrund ist, dass die immer noch mit ASK zusammenarbeiten (Avira Suchfunktion geht über ASK). Auch andere Freewareanbieter wie AVG, Avast oder Panda sprangen auf diesen Zug auf; so was ist bei Sicherheitssoftware einfach inakzeptabel. Vgl. Antivirensoftware: Schutz Für Ihre Dateien, Aber Auf Kosten Ihrer Privatsphäre? | Emsisoft Blog



Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:


    Adobe Acrobat Reader DC - Deutsch

    Avira

    Avira Antivirus

    Java SE Development Kit 8 Update 102 (64-bit)

    Java SE Development Kit 8 Update 91 (64-bit)

    Java SE Development Kit 8 Update 91

    McAfee Security Scan Plus

    OpenOffice 4.1.3

    TrueCrypt


  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 





Gib Bescheid wenn Avira weg ist; wenn wir hier durch sind, kannst du auf einen anderen Virenscanner umsteigen, Infos folgen dann im Abschlussposting. Bitte JETZT nix mehr ohne Absprache installieren!

juergen007 06.02.2018 11:10
malware
 
Unter dem Link auf revo und revo portable wird man gezwungen eine "packagetracer" mit zu laden. Ist das in eurem Sinne? Wichtig? Richtig?
Ich benutze meine alte Version Danke ich melde mich dann.
Jürgen

Nachfrage während ich dabei bin:
Muss ich ALLe aktionen adwcleaner revo, JRT, etc..
auf beiden Usern ausführen ich nehme an ja?

Auf admin eben:
avira anitivir weg
avira weg
adobe dt. weg
openoffice hätt ich nun gern oder ist das totaler Mist?
Und ein Java sdk hätt ich auch gern...
oder veraltete Version... Vermute..

100 Thx!!

Jürgen

cosinus 06.02.2018 11:16
Das bei dir installierte Jave und OpenOffice ist hornalt. Weg damit.

juergen007 06.02.2018 12:10
fertif!
 
Alles deinstallieret unter Admin und unter juergen ist auch alles weg super!
Dabei wohl aus versehen einen xmlparser KB2758694 deinstalliert..ist der wichtig dann ziehe ich ihn wieder rauf.
Jürgen
200 thx (das ist kein Euro Betrag :dankeschoen:)

Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27.01.2018
Ran by Administrator (administrator) on JUERGEN2-PC (06-02-2018 12:03:45)
Running from D:\backupMaxtor80gb\data\FRSTData
Loaded Profiles: Administrator (Available Profiles: juergen2 & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD64.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(VS Revo Group) C:\Program Files\VS Revo Group\Revo Uninstaller\RevoUnin.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-963683855-2343051469-89585254-500\...\MountPoints2: {3b6eaf21-9024-11e5-b954-8c89a53586cf} - F:\LaunchU3.exe -a
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
GroupPolicyScripts\User: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{4F4DD125-EDDA-44BF-B378-9BAF78A43AC1}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)

FireFox:
========
FF DefaultProfile: iv2ha52p.default-1508386149418
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418 [2018-02-06]
FF Session Restore: Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418 -> is enabled.
FF NewTabOverride: Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418 -> Disabled: _j5Members_@ext.ask.com
FF Extension: (Flash Video Downloader) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\Extensions\artur.dubovoy@gmail.com.xpi [2018-01-27]
FF Extension: (SMSfromBrowser) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\Extensions\_f7Members_@download.smsfrombrowser.com.xpi [2018-01-01]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_137.dll [2018-01-30] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_137.dll [2018-01-30] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)

Chrome:
=======
CHR Profile: C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default [2018-02-05]
CHR Extension: (Google Präsentationen) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2017-01-04]
CHR Extension: (Google Docs) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2017-01-04]
CHR Extension: (Google Drive) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2017-01-04]
CHR Extension: (YouTube) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2017-01-04]
CHR Extension: (Adblock Plus) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2017-07-29]
CHR Extension: (Adobe Acrobat) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj [2017-06-29]
CHR Extension: (Google Tabellen) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2017-01-04]
CHR Extension: (Google Docs Offline) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2017-01-04]
CHR Extension: (Check Grammar) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgagolblcpljkkbglkbinmbdahdifijm [2017-07-29]
CHR Extension: (Chrome Web Store-Zahlungen) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2017-06-28]
CHR Extension: (Google Mail) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2017-01-04]
CHR Extension: (Chrome Media Router) - C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkedcjkdefgpdelpbcmbmeomcjbeemfm [2017-08-01]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [File not signed]
R2 BCWipeSvc; C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe [90592 2015-12-01] (Jetico, Inc.)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [File not signed]
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S4 ManyCam Service; C:\ProgramData\ManyCam\Service\ManyCamService.exe [544984 2016-03-31] (Visicom Media Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10803440 2017-08-29] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 InstallerService; "C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe" [X]
S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.11.667\McCHSvc.exe" [X]
S4 TrueKey; "C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe" [X]
S4 TrueKeyScheduler; "C:\Program Files\TrueKey\McTkSchedulerService.exe" [X]
S3 TrueKeyServiceHelper; "C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [229056 2015-04-03] (AppEx Networks Corporation)
S4 BCSWAP; C:\Windows\System32\Drivers\BCSWAP.sys [94400 2014-11-24] (Jetico, Inc.)
R2 DRHARD64; C:\Windows\system32\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHARD64; C:\Windows\SysWOW64\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHMSR64; C:\Windows\system32\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R2 DRHMSR64; C:\Windows\SysWOW64\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R0 fsh; C:\Windows\System32\Drivers\fsh.sys [57536 2015-05-19] (Jetico Inc. Oy)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
S3 MftWipeFilter; C:\Windows\System32\Drivers\MftWipeFilter.sys [42632 2015-12-01] (Windows (R) Win 7 DDK provider)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [195416 2015-11-17] (IDRIX)
R2 XilinxPC4Driver; C:\Windows\System32\drivers\xpc4drvr.sys [27384 2016-10-09] (Xilinx, Inc.)
S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
U3 aswbdisk; no ImagePath
S1 bcbus; system32\DRIVERS\bcbus.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 X6va037; \??\C:\Windows\SysWOW64\Drivers\X6va037 [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-06 11:54 - 2018-02-06 11:54 - 000000021 _____ C:\Windows\S.dirmngr
2018-02-06 09:28 - 2018-02-05 11:39 - 000001167 _____ C:\Windows\system32\Reinigung.cmd
2018-02-06 09:28 - 2017-12-24 23:03 - 000001820 _____ C:\Windows\system32\Wartung.cmd
2018-02-06 09:00 - 2018-02-06 09:03 - 000000000 ____D C:\daten
2018-02-06 08:08 - 2018-02-06 12:03 - 000000000 ____D C:\FRST
2018-02-05 23:24 - 2018-02-05 23:41 - 000000000 ___HD C:\~BCWipe.tmp
2018-02-05 18:56 - 2018-02-05 18:56 - 000739464 _____ C:\Users\juergen2\Documents\IMG_20180205_0001.pdf
2018-02-05 16:24 - 2018-02-05 16:24 - 000003544 ____N C:\bootsqm.dat
2018-02-05 11:48 - 2018-02-05 11:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BCWipe
2018-02-05 11:47 - 2018-02-05 11:47 - 000000000 ____D C:\Program Files (x86)\Jetico
2018-02-02 15:20 - 2018-02-02 15:20 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\dvdcss
2018-02-02 14:52 - 2018-02-02 14:52 - 000000017 _____ C:\Users\juergen2\AppData\Local\resmon.resmoncfg
2018-02-01 13:05 - 2018-02-01 13:05 - 000001196 _____ C:\Users\Administrator\Desktop\CrystalDiskInfo.lnk
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\Program Files (x86)\CrystalDiskInfo
2018-02-01 12:01 - 2018-02-05 11:39 - 000001167 _____ C:\Windows\SysWOW64\Reinigung.cmd
2018-02-01 12:01 - 2017-12-24 23:03 - 000001820 _____ C:\Windows\SysWOW64\Wartung.cmd
2018-02-01 00:23 - 2018-02-01 00:23 - 000000000 ____D C:\Users\juergen2\PDF
2018-01-31 23:58 - 2018-01-31 23:58 - 000000181 _____ C:\Users\juergen2\Documents\slashesversion.gp
2018-01-31 22:17 - 2018-01-31 22:17 - 000000142 _____ C:\Users\juergen2\new2.gp
2018-01-31 22:01 - 2018-01-31 22:01 - 000002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
2018-01-31 22:01 - 2018-01-31 22:01 - 000002172 _____ C:\Users\Public\Desktop\Google Earth Pro.lnk
2018-01-31 22:00 - 2018-01-31 21:57 - 000000096 _____ C:\Users\juergen2\Documents\new.txt
2018-01-31 21:17 - 2018-02-01 00:12 - 000007841 _____ C:\Users\juergen2\Documents11.pdf
2018-01-30 23:39 - 2018-01-30 23:40 - 000000127 _____ C:\Users\juergen2\Documents\anmachenFilipina.txt
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Macromedia
2018-01-29 22:31 - 2018-02-04 13:04 - 000004740 _____ C:\Users\juergen2\Documents\23.txt
2018-01-29 22:11 - 2018-01-30 23:09 - 000003173 _____ C:\Users\juergen2\Documents\13.txt
2018-01-29 22:09 - 2018-01-29 22:09 - 001332457 _____ C:\Users\juergen2\Documents\1013.txt
2018-01-29 21:01 - 2018-01-29 21:58 - 000003016 _____ C:\Users\juergen2\Desktop\mmmma.txt
2018-01-28 23:59 - 2018-01-28 23:59 - 000001182 _____ C:\Users\juergen2\Desktop\MailWasherPro.lnk
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Program Files (x86)\Firetrust
2018-01-28 23:58 - 2018-01-29 00:00 - 000000000 ____D C:\ProgramData\Firetrust
2018-01-28 12:57 - 2018-01-31 21:20 - 000000000 ____D C:\Users\juergen2\Documents\Wolfram Mathematica
2018-01-28 12:57 - 2018-01-29 19:37 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Mathematica
2018-01-28 12:57 - 2018-01-28 12:58 - 000000000 ____D C:\Users\juergen2\AppData\Local\Mathematica
2018-01-28 12:57 - 2018-01-28 12:57 - 000000000 ____D C:\Users\juergen2\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\Documents\Wolfram Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\ProgramData\Mathematica
2018-01-27 12:30 - 2018-01-27 12:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica 11.2
2018-01-27 12:27 - 2018-01-27 12:27 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\OpenOffice
2018-01-27 12:17 - 2018-01-27 12:17 - 000000000 ____D C:\Program Files\Wolfram Research
2018-01-27 12:00 - 2018-01-27 12:03 - 000000000 ____D C:\Users\Administrator\Downloads\M-WIN-L-11.2.0-5822651
2018-01-27 12:00 - 2018-01-27 12:00 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram Research
2018-01-18 14:27 - 2018-01-18 14:27 - 000002077 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files\Microsoft Security Client
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2018-01-12 13:00 - 2018-01-01 03:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-01-12 13:00 - 2018-01-01 03:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-01-12 13:00 - 2018-01-01 03:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-01-12 13:00 - 2018-01-01 03:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 03:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-01-12 13:00 - 2018-01-01 03:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-01-12 13:00 - 2018-01-01 03:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-01-12 13:00 - 2018-01-01 02:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-01-12 13:00 - 2018-01-01 02:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-01-12 13:00 - 2018-01-01 02:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-01-12 13:00 - 2018-01-01 02:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll
2018-01-12 13:00 - 2018-01-01 02:46 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\vmictimeprovider.dll
2018-01-12 13:00 - 2018-01-01 02:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-01-12 13:00 - 2018-01-01 02:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 02:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-01-12 13:00 - 2018-01-01 02:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-01-12 13:00 - 2018-01-01 02:39 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 02:36 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-01-12 13:00 - 2018-01-01 02:35 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2017-12-30 08:29 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-01-12 13:00 - 2017-12-30 07:42 - 000347328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-01-12 13:00 - 2017-12-29 19:39 - 020274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-01-12 13:00 - 2017-12-29 19:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 19:13 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-01-12 13:00 - 2017-12-29 19:13 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-01-12 13:00 - 2017-12-29 19:12 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-01-12 13:00 - 2017-12-29 19:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 19:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 19:09 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-01-12 13:00 - 2017-12-29 19:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 18:55 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 18:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-01-12 13:00 - 2017-12-29 18:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-01-12 13:00 - 2017-12-29 18:47 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 18:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 18:45 - 004508160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-01-12 13:00 - 2017-12-29 18:44 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-01-12 13:00 - 2017-12-29 18:39 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 18:37 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 18:36 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 18:19 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-01-12 13:00 - 2017-12-29 18:15 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-01-12 13:00 - 2017-12-29 18:13 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-01-12 13:00 - 2017-12-29 10:15 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-01-12 13:00 - 2017-12-29 10:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 10:04 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-01-12 13:00 - 2017-12-29 09:52 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 005796352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-01-12 13:00 - 2017-12-29 09:50 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 09:44 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 09:43 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-01-12 13:00 - 2017-12-29 09:40 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 09:39 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-01-12 13:00 - 2017-12-29 09:32 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-01-12 13:00 - 2017-12-29 09:28 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 09:22 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-01-12 13:00 - 2017-12-29 09:22 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 09:21 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 09:16 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 09:14 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-01-12 13:00 - 2017-12-29 09:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-01-12 13:00 - 2017-12-29 09:04 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-01-12 13:00 - 2017-12-29 09:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 09:01 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 08:50 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-01-12 13:00 - 2017-12-29 08:39 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-01-12 13:00 - 2017-12-29 08:27 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-01-12 13:00 - 2017-12-21 07:27 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-01-12 13:00 - 2017-12-13 17:31 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-01-12 13:00 - 2017-12-13 17:15 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-01-12 13:00 - 2017-12-13 16:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-01-12 13:00 - 2017-12-05 16:59 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-01-12 13:00 - 2017-12-05 16:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-01-11 17:13 - 2018-01-11 17:42 - 000000000 ____D C:\recov
2018-01-11 12:43 - 2018-01-11 12:43 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avusbflt_01011.Wdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-06 12:04 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-02-06 12:04 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-02-06 12:00 - 2017-01-04 21:53 - 000000000 ____D C:\Users\Administrator\AppData\LocalLow\Mozilla
2018-02-06 11:58 - 2015-11-02 13:24 - 001965366 _____ C:\Windows\ntbtlog.txt
2018-02-06 11:54 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-06 11:46 - 2015-11-01 09:41 - 000000000 ____D C:\ProgramData\Package Cache
2018-02-06 11:39 - 2017-01-03 13:33 - 000065744 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2018-02-06 11:38 - 2009-07-14 05:45 - 000291024 _____ C:\Windows\system32\FNTCACHE.DAT
2018-02-06 10:04 - 2016-11-19 14:58 - 000000000 ____D C:\Users\juergen2\AppData\LocalLow\Mozilla
2018-02-06 09:49 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2018-02-06 09:46 - 2009-07-14 04:20 - 000000000 __RSD C:\Windows\Media
2018-02-06 08:54 - 2016-05-16 15:01 - 000000000 ____D C:\Program Files\TrueKey
2018-02-06 08:50 - 2015-12-21 20:28 - 000000000 ____D C:\Users\juergen2\AppData\Local\Google
2018-02-06 08:48 - 2015-12-21 20:28 - 000000000 ____D C:\Program Files (x86)\Google
2018-02-06 08:47 - 2016-10-02 17:45 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\NCH Software
2018-02-06 08:05 - 2015-11-01 11:12 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\vlc
2018-02-05 20:47 - 2017-05-10 13:31 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Electrum
2018-02-05 18:04 - 2015-11-13 17:07 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\IrfanView
2018-02-05 16:25 - 2016-11-18 20:36 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2018-02-05 16:25 - 2015-10-31 22:35 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-02-05 13:03 - 2015-11-01 08:53 - 000000000 ____D C:\xampp
2018-02-05 11:48 - 2009-07-14 04:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2018-02-05 11:25 - 2016-07-21 13:39 - 000002177 _____ C:\Users\juergen2\Desktop\JRT.txt
2018-02-05 11:08 - 2016-07-21 13:33 - 000000000 ____D C:\AdwCleaner
2018-02-04 12:23 - 2017-11-16 22:48 - 000000000 ____D C:\Users\juergen2\AppData\Local\CrashDumps
2018-02-03 16:54 - 2015-11-14 12:57 - 000075264 _____ C:\Users\juergen2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-02-03 15:38 - 2016-02-24 19:10 - 000000000 ____D C:\div
2018-02-03 15:38 - 2015-10-31 22:30 - 000000000 ____D C:\datas
2018-02-03 15:07 - 2016-01-24 16:00 - 000000000 ____D C:\Users\juergen2\AppData\Local\QuickPar
2018-02-03 12:24 - 2009-07-14 06:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
2018-02-02 15:15 - 2017-01-04 14:10 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2018-02-02 11:04 - 2009-07-14 06:32 - 000000000 ____D C:\Windows\system32\FxsTmp
2018-02-01 08:16 - 2016-10-09 09:50 - 000000000 ____D C:\Windows\Minidump
2018-02-01 00:23 - 2015-10-31 22:01 - 000000000 ____D C:\Users\juergen2
2018-01-31 22:47 - 2016-08-18 13:38 - 000000981 _____ C:\Users\juergen2\Desktop\PARI.lnk
2018-01-31 22:34 - 2016-08-18 19:24 - 000000000 ____D C:\tmp
2018-01-31 22:19 - 2016-08-18 13:37 - 000000000 ____D C:\Program Files (x86)\Pari-2-7-6
2018-01-30 20:56 - 2015-11-01 10:23 - 000000000 ____D C:\Users\juergen2\AppData\Local\Adobe
2018-01-30 20:47 - 2016-02-17 17:00 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-30 20:47 - 2015-11-01 10:23 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-30 20:47 - 2015-11-01 10:23 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-30 20:06 - 2017-08-26 17:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-28 21:35 - 2015-11-15 10:42 - 000000000 ____D C:\vhd
2018-01-26 12:50 - 2015-11-15 10:22 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\gnupg
2018-01-25 00:48 - 2017-06-30 15:19 - 000004100 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1498067933
2018-01-23 19:58 - 2010-11-21 04:27 - 000548000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2018-01-19 14:22 - 2015-11-01 09:42 - 000765656 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2018-01-18 14:27 - 2016-05-12 18:47 - 000001945 _____ C:\Windows\epplauncher.mif
2018-01-18 14:04 - 2009-07-14 06:08 - 000032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-01-15 11:23 - 2017-12-10 15:05 - 000001302 _____ C:\Users\Public\Desktop\Skype.lnk
2018-01-15 11:23 - 2017-12-10 15:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-01-12 17:49 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\rescache
2018-01-11 16:30 - 2017-12-30 15:22 - 000000000 ____D C:\Program Files\Recuva
2018-01-11 14:15 - 2011-04-12 09:28 - 000000000 ___RD C:\Users\Public\Recorded TV
2018-01-11 02:00 - 2015-11-01 12:47 - 000000000 ____D C:\Windows\system32\MRT
2018-01-11 01:56 - 2017-10-12 02:06 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-01-11 01:56 - 2015-11-01 12:47 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-01-09 15:28 - 2017-09-02 13:28 - 000004486 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier

==================== Files in the root of some directories =======

2017-07-20 19:34 - 2017-07-20 19:34 - 000003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-29 17:35

==================== End of FRST.txt ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by Administrator (06-02-2018 12:04:58)
Running from D:\backupMaxtor80gb\data\FRSTData
Windows 7 Professional Service Pack 1 (X64) (2015-10-31 21:00:58)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-963683855-2343051469-89585254-500 - Administrator - Enabled) => C:\Users\Administrator
Guest (S-1-5-21-963683855-2343051469-89585254-501 - Limited - Disabled)
juergen2 (S-1-5-21-963683855-2343051469-89585254-1000 - Administrator - Enabled) => C:\Users\juergen2

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 28 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 28.0.0.137 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (HKLM\...\{F15287C6-10E3-1676-AF50-CB0355A302F1}) (Version: 2.00.0002 - Advanced Micro Devices, Inc.)
AMD APP SDK Runtime (HKLM\...\{503F672D-6C84-448A-8F8F-4BC35AC83441}) (Version: 10.0.873.1 - Advanced Micro Devices Inc.)
AMD Catalyst Control Center (HKLM-x32\...\{20AE3A4E-38CA-C6F8-4E60-5DF41A2CC0AC}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
AMD Catalyst Install Manager (HKLM\...\{7E5DC2C5-115A-322B-976C-219237FAED66}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (HKLM\...\{CF84CD21-FC52-857E-AF41-9DEE9C76D245}) (Version: 2.00.0000 - Advanced Micro Devices, Inc.)
AMD Fuel (HKLM\...\{AA20E9E6-96D0-C201-E44D-F7D921F595FD}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 4.0.0.0 - AppEx Networks)
AMD Steady Video Plug-In  (HKLM\...\{94BFDEF9-D91D-4B5D-8A60-08514C7191AF}) (Version: 2.08.0000 - AMD)
AMD USB 3.0 Device Detector (HKLM\...\{F5733897-B788-4AB1-B399-166A9FBB47A8}) (Version: 2.1.30.0 - Advanced Micro Devices, Inc.)
AMD Wireless Display v3.0 (HKLM\...\{630E5EF7-72F8-9E5D-BEF5-ED85B698E160}) (Version: 1.0.0.15 - Advanced Micro Devices, Inc.)
Arasan 20.2 (HKLM-x32\...\Arasan_is1) (Version:  - )
Backup and Sync from Google (HKLM-x32\...\{908DB568-E5FA-40C7-A2AA-AB340190858B}) (Version: 3.38.7642.3857 - Google, Inc.)
BCWipe 6.0 (HKLM-x32\...\BCWipe) (Version: 6.08.3 - Jetico Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer Driver Add-On Module (HKLM\...\CANONIJINBOXADDON100) (Version:  - )
Canon MG5500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5500_series) (Version: 1.02 - Canon Inc.)
Catalyst Control Center Graphics Previews Common (HKLM-x32\...\{9114BDDB-A6A6-152D-060A-E99307057AD1}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Catalyst Control Center InstallProxy (HKLM-x32\...\{66CDB8EB-80D3-A762-32B4-80DA61A1C6C8}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Catalyst Control Center Localization All (HKLM-x32\...\{315D9E6B-98B1-1E2B-9E93-B36A0B104224}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Standard (HKLM-x32\...\{703F229F-573E-10E7-3B44-341DB59AD86B}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Traditional (HKLM-x32\...\{489E5436-B101-CAD9-5571-14746675ECE3}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Czech (HKLM-x32\...\{BBA1614E-6470-7841-8A42-ABD5BA7B3FFE}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Danish (HKLM-x32\...\{AA0E1433-8F16-AA01-E8E9-E6408579D0D8}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Dutch (HKLM-x32\...\{504819D1-3C0A-2695-0007-BBDFA5936D68}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help English (HKLM-x32\...\{6C495748-5F03-0B97-568B-76D0368FB460}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Finnish (HKLM-x32\...\{D9CBA021-DB41-9736-923F-52E3E426912D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help French (HKLM-x32\...\{B03A580A-5D67-DAC5-59A1-7AD7C513381C}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help German (HKLM-x32\...\{69DF4822-9B16-CE04-7587-22E09FB5FD1D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Greek (HKLM-x32\...\{968C0E92-6DA9-5784-9A0B-1061D0CB2C14}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Hungarian (HKLM-x32\...\{11BC8F83-7260-65EB-3E0A-FA7AC894B42D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Italian (HKLM-x32\...\{FE4DC915-D724-E72C-EF86-DC5B89961ACF}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Japanese (HKLM-x32\...\{C9353DBC-A47C-2C9B-AF32-5E2C8B4E3D3A}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Korean (HKLM-x32\...\{37DBC990-C514-3821-D6FB-12E0745AA990}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Norwegian (HKLM-x32\...\{79E3071B-8A0C-C105-6442-CF611732601E}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Polish (HKLM-x32\...\{A12E8E1A-A77D-94E5-72F8-E83D6256AF11}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Portuguese (HKLM-x32\...\{AD5E3969-F0C0-ECBF-45E5-C36B84904281}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Russian (HKLM-x32\...\{CFA2067C-AE90-3BF9-06AF-E7E65E679B3D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Spanish (HKLM-x32\...\{110E4EE7-85A9-B76B-B943-C0C1CF0C2F74}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Swedish (HKLM-x32\...\{42A97797-A255-49F9-4250-D58A9CEA2904}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Thai (HKLM-x32\...\{31BC0B51-0676-A531-3940-1818B609EEA7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Turkish (HKLM-x32\...\{9DB45EC2-90E7-642D-7CF9-5AC2FBDC14F7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
ccc-utility64 (HKLM\...\{C3463F9A-E635-02E0-C351-41D16074E202}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Convert XLS (HKLM-x32\...\Convert XLS_is1) (Version:  - Softinterface, Inc.)
CrystalDiskInfo 7.5.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.5.1 - Crystal Dew World)
Dr. Hardware 2015 15.5d (HKLM-x32\...\Dr. Hardware 2015_is1) (Version:  - Peter A. Gebhard)
Free Pascal 3.0.0 (HKLM-x32\...\FreePascal_is1) (Version:  - Free Pascal Team)
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.195.0 - International GeoGebra Institute)
Google Earth Pro (HKLM-x32\...\{76AADFE7-3416-419C-A30B-41E762231584}) (Version: 7.3.1.4505 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gpg4win (2.3.3) (HKLM-x32\...\GPG4Win) (Version: 2.3.3 - The Gpg4win Project)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
GUI Turbo Assembler Ver 3.0.1 (HKLM-x32\...\{F522C947-52FA-4C01-B933-16292944E000}) (Version: 3.0.1 - Lakhya's Innovation Inc.)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan)
Lazarus 1.6.2 (HKLM\...\lazarus_is1) (Version: 1.6.2 - Lazarus Team)
MailWasherPro (HKLM-x32\...\{D16B61A0-A55E-47A9-BA73-8A5E92C26DB2}) (Version: 7.11.05 - Firetrust)
ManyCam 5.3.0 (HKLM-x32\...\ManyCam) (Version: 5.3.0 - Visicom Media Inc.)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 58.0.1 (x64 de) (HKLM\...\Mozilla Firefox 58.0.1 (x64 de)) (Version: 58.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 53.0.3 - Mozilla)
Mozilla Thunderbird 52.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.6.0 (x86 de)) (Version: 52.6.0 - Mozilla)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.4 - Notepad++ Team)
Pari-2-7-6 (remove only) (HKLM-x32\...\Pari-2-7-6) (Version:  - )
PC Inspector File Recovery (HKLM-x32\...\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}) (Version: 4.0 - )
PilotEdit Lite 10.7.0 (HKLM-x32\...\PilotEdit Lite_is1) (Version:  - )
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Revo Uninstaller 2.0.4 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.4 - VS Revo Group, Ltd.)
Scid vs PC 4.16 (HKLM-x32\...\Scid vs PC_is1) (Version: 4.16 - Steven Atkinson)
SharpKeys (HKLM\...\{F6908C45-459A-4332-A3F2-03DAAB64939D}) (Version: 3.6.0000 - RandyRants.com)
Shotcut (HKLM-x32\...\Shotcut) (Version:  - )
Skype version 8.13 (HKLM-x32\...\Skype_is1) (Version: 8.13 - Skype Technologies S.A.)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.83369 - TeamViewer)
Total Commander 64-bit (Remove or Repair) (HKLM-x32\...\Totalcmd64) (Version: 9.0a - Ghisler Software GmbH)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.16 - IDRIX)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Web Companion (HKLM-x32\...\{37c882f6-40f7-46a4-9ccb-8e2808e1a79e}) (Version: 2.4.1558.3001 - Lavasoft)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Wolfram Mathematica 11.2 (M-WIN-L 11.2.0 5822651) (HKLM\...\M-WIN-L 11.2.0 5822651_is1) (Version: 11.2.0 - Wolfram Research, Inc.)
Wondershare Data Recovery(Build 6.5.1.5) (HKLM-x32\...\{FEA3976F-D621-45F3-AFBD-E812A1F2F00D}_is1) (Version: 6.5.1.5 - Wondershare Software Co.,Ltd.)
Wondershare Helper Compact 2.5.2 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.2 - Wondershare)
Xaldon WebSpider2 (HKLM-x32\...\WebSpider2) (Version:  - )
Xilinx Design Tools Vivado HL WebPACK 2016.3 (C:\Xilinx) (HKLM\...\Xilinx_Vivado HL WebPACK_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx DocNav (C:\Xilinx) (HKLM\...\Xilinx_DocNav_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx Information Center (C:\Xilinx) (HKLM\...\Xilinx_Xilinx Information Center_2016.3#0) (Version: 2016.3 - Xilinx Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-01-01] ()
ContextMenuHandlers1: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-20] (Google)
ContextMenuHandlers1: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers1: [PilotEdit] -> {277B9550-37E2-47DE-B533-89A1EBD82DB9} => C:\Program Files (x86)\PilotEdit Lite\EShell_x64.dll [2013-01-01] (PilotEdit)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers2: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-20] (Google)
ContextMenuHandlers4: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\atiacm64.dll [2015-08-04] (Advanced Micro Devices, Inc.)
ContextMenuHandlers6: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1FB3732E-9592-444D-A701-81DF304F14A9} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe
Task: {21022CE6-BFE7-40E7-AAFA-15A6CC72356B} - System32\Tasks\{E140102B-F244-4775-9758-5FA77AFD8886} => C:\Windows\system32\pcalua.exe -a "C:\Users\juergen2\Downloads\chromeinstall-8u77 (1).exe" -d C:\Users\juergen2\Downloads
Task: {213D38E2-E0E5-4EFB-88BC-AC61BF33552B} - System32\Tasks\{849B1E16-7952-40E5-887E-DAAD93154E62} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\putty.exe -d D:\backupMaxtor80gb\data
Task: {22DA9795-90BD-4731-AB6A-BD01A662D2F9} - System32\Tasks\{9C6CF1E7-9264-4314-BC30-F7778072B17B} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\wlsetup3528-all.exe -d d:\backupMaxtor80gb\data\
Task: {3B11371B-11AB-415E-8185-32A4F05C4B0F} - System32\Tasks\{471AF2D6-FC39-423E-8A09-1CE6E304D7BB} => C:\Windows\system32\pcalua.exe -a C:\camel\SilkroadOnlineGlobal_Official_v1_486.exe -d c:\camel\
Task: {4ADE3327-7150-4BB8-87C3-76601FC67879} - System32\Tasks\{FD09F9C6-B58A-406E-8536-F1B82AF22BBE} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\i2pinstall_0.9.30_windows.exe -d D:\backupMaxtor80gb\data
Task: {6ADA2DE3-F929-4442-BCBE-E1D403613F2F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)
Task: {70FC73DB-5C4F-4CB5-9833-76B9D3A491A6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {A6D9A0B3-82A7-4937-910D-C86CC1F2F571} - System32\Tasks\{C61837B8-EABF-4B5E-B96E-3C6EC1BD2343} => C:\Windows\system32\pcalua.exe -a C:\datas\jxpiinstall(4).exe -d C:\datas
Task: {AD24AC21-72E8-4AFB-8BA6-BC0413019E02} - System32\Tasks\Opera scheduled Autoupdate 1498067933 => C:\Users\juergen2\AppData\Local\Programs\Opera\launcher.exe [2018-01-22] (Opera Software)
Task: {BE9E6706-8A73-4F34-8BC7-F4B899EDF1C0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {C9EBDDE4-403C-409F-9422-0D76AB33DF39} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {DAC363AC-634F-4411-8C93-334B4E476B58} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe
Task: {E302C505-2A7A-4384-87A8-489CE462BC3D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {F4DDD129-C6FA-4772-AC2D-CE369BA97A92} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {F6F30DFE-BB87-4833-A1E0-CEE92CCDEE3C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2015-08-04 00:25 - 2015-08-04 00:25 - 000214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 000817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 003650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2016-08-18 09:27 - 2016-08-18 09:27 - 000216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2015-08-04 00:25 - 2015-08-04 00:25 - 000102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2018-01-01 02:07 - 2018-01-01 02:07 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000222720 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2016-08-18 09:09 - 2016-08-18 09:09 - 000103424 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2016-08-18 09:03 - 2016-08-18 09:03 - 000050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000073728 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2016-08-18 09:17 - 2016-08-18 09:17 - 000751104 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2017-11-30 16:41 - 000002026 _____ C:\Windows\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-963683855-2343051469-89585254-500\Control Panel\Desktop\\Wallpaper -> C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: LavasoftAdAwareService11 => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: vssbrigde64 => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^juergen2^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MailWasherPro.lnk => C:\Windows\pss\MailWasherPro.lnk.Startup
MSCONFIG\startupreg: AvgUi => "C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe" /lps=fmw

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{E08E8243-C2A1-4221-90A7-14736621DBE5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9EA08C55-5310-4A9E-8ABB-32F4A49FF91B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{97587CB0-9EAA-4B76-AE0F-849E608FE32D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{81373308-C4D3-45DA-ABFB-9FF3613C6D5D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{27E94056-EE89-40C2-88F9-FCDD1B8E5D43}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{D80E4AD5-8012-4DE4-B0FE-3695EFEBEAED}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{E4AFD96A-B990-4558-B5EE-3F16F3B150B1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4EFF6531-5BDD-4CC8-BCE4-8C1B36A92B77}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1144CB11-19E6-41BF-BAFF-C3CBF53D788E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{D076BE44-8E6B-4596-BDAA-38B73655C620}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{BA663251-09BF-4823-8DE3-357013B1B8CE}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [UDP Query User{E5E54FE6-C09E-4ABB-90E3-E86CBF75A6F2}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [TCP Query User{3562059C-09AD-49C5-B7A8-F01122A24FF9}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{F0D6FC0B-D3F6-4346-A980-F46D4C9D1B96}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{98C9BD54-7195-421F-8622-82F19A588534}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [UDP Query User{823BFEF5-2144-437C-A54B-BCCA12451298}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [TCP Query User{43DE325D-FD61-460D-842E-290A5202FB7F}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{DFCF343D-2298-479B-820C-A9D87E56AFF7}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [TCP Query User{A1496639-68D5-46B4-967E-A505FB7D9C89}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [UDP Query User{D2661694-9DE9-4B85-AA71-E76B9FE67E92}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [TCP Query User{DA6A1C4E-6658-4536-B8A6-C2F9FD65FD61}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [UDP Query User{4C306084-351A-440E-86A7-02F33064F80E}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [TCP Query User{82621B54-D4E3-4191-A32E-7FB2E966AFE0}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{FA455FFB-BB85-4880-8324-9ED51129A541}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [TCP Query User{AFDB542D-C34E-4DBA-A5E8-13FD772F4676}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{821974AD-1244-4300-8892-42C965D1C906}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [{EE884B1A-0A33-4F7E-BE89-6C013F4282AB}] => (Allow) C:\Users\juergen2\AppData\Local\IQA\Application\chrome.exe
FirewallRules: [{776A7697-A9FA-4D00-AE02-02733E032793}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{179DB254-E4A7-44FD-8180-A252E383B707}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [TCP Query User{5881A1B3-618E-4628-AF81-07C027281C34}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [UDP Query User{B1095A5C-EA19-4532-BE33-41EF9C86B1D8}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [TCP Query User{B12981FF-B265-4AD8-90CC-1CAA78AFF9D3}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{17966661-BA79-4C90-BC0D-63434C7A2A9F}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{359222EA-9F94-4EDA-A978-E08B0C015F21}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{DCC70F92-DA66-4518-B65F-551E06FAED96}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{0C48E5AD-B230-4661-BAFF-D286C90BF7ED}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{5E82995E-38F3-476B-98A0-E4055D9530E6}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{FF3B1697-47E7-4E15-A46F-14DAD9A34297}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{91BF5810-5F2B-4B0B-89A6-13C7BD7AF7E0}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [{A15FD59F-4DEB-48C5-B0AB-C560507A5BD9}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{7B27A2F1-A1C2-40B1-856F-69E72A5FDD68}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{109B94D2-FB0C-44F2-A49B-C1ABC4AE84C2}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{0E26162C-0928-4A55-BFA2-D3D7A388B22E}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{8BAD0C4F-C654-432F-8A46-8CBC4BFF20AF}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{81FA3FFE-6DEF-4F3D-871E-6120D650F375}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{E12FBEE4-11A9-4252-B72E-9DA5B9A82CDB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{7DA09561-F33A-4F74-AE93-BE232605E318}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{C619FF61-7405-4E6D-B469-F5ED7A4CEBEE}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{5D49AA65-E9EC-4E40-AF85-819A887C58C3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{97B5B131-9D32-4BAD-8E9A-E1780ABF9A4D}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{054F0F09-AE56-4599-9BA5-F86C9D31FFB5}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{A5989984-670A-4953-A4B2-97E2981C1C4E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.58\opera.exe
FirewallRules: [{51A58F52-6A7A-4F9F-A9D3-54673771201E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.67\opera.exe
FirewallRules: [{858D641F-B90B-4B90-9641-DFF96825B635}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{36275EA3-11DB-4932-AC9B-19B7D18F4C95}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{A9C5985A-EEDC-40A3-BBEC-1E2E964F227C}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{A6DED921-ACDB-4F33-8FF6-E322906C2092}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{9D3AC6F5-DD80-4C6C-AC12-2DE855E84AE0}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe
FirewallRules: [{719EF127-CBDB-42E9-AA42-01703EB925AD}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe

==================== Restore Points =========================

05-02-2018 23:59:14 Windows Update
06-02-2018 08:36:28 Revo Uninstaller's restore point - Debut Videorekorder
06-02-2018 08:48:01 Revo Uninstaller's restore point - Google Chrome
06-02-2018 10:45:05 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser (KB2758694)
06-02-2018 10:59:34 Revo Uninstaller's restore point - Adobe Acrobat Reader DC - Deutsch
06-02-2018 11:03:18 Revo Uninstaller's restore point - Avira
06-02-2018 11:04:42 Revo Uninstaller's restore point - Avira Antivirus
06-02-2018 11:13:09 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 102 (64-bit)
06-02-2018 11:13:34 Removed Java SE Development Kit 8 Update 102 (64-bit)
06-02-2018 11:16:26 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 91
06-02-2018 11:16:53 Removed Java SE Development Kit 8 Update 91
06-02-2018 11:19:30 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 91 (64-bit)
06-02-2018 11:19:55 Removed Java SE Development Kit 8 Update 91 (64-bit)
06-02-2018 11:23:47 Revo Uninstaller's restore point - McAfee Security Scan Plus
06-02-2018 11:26:06 Revo Uninstaller's restore point - OpenOffice 4.1.3
06-02-2018 11:28:56 Revo Uninstaller's restore point - TrueCrypt
06-02-2018 11:29:21 TrueCrypt uninstallation
06-02-2018 11:32:47 Revo Uninstaller's restore point - Silkroad
06-02-2018 11:44:48 Revo Uninstaller's restore point - Avira
06-02-2018 11:48:25 Revo Uninstaller's restore point - MBOT_PureSRO_2016 version Final
06-02-2018 11:49:56 Revo Uninstaller's restore point - TDM-GCC

==================== Faulty Device Manager Devices =============

Name: ZAM Guard Driver
Description: ZAM Guard Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM_Guard
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: AODDriver4.1
Description: AODDriver4.1
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: AODDriver4.1
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: ZAM Helper Driver
Description: ZAM Helper Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/06/2018 11:56:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 11:44:41 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
  Gathering Writer Data

Context:
  Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
  Writer Name: System Writer
  Writer Instance ID: {6908a91b-07af-41aa-9760-bc83cc80c3fd}

Error: (02/06/2018 11:40:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 10:45:02 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
  Gathering Writer Data

Context:
  Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
  Writer Name: System Writer
  Writer Instance ID: {79287d94-32e6-4795-939e-1fb809449ef7}

Error: (02/06/2018 09:53:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:49:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:35:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:28:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:21:57 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:12:43 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program TOTALCMD.EXE version 9.0.1.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: e68

Start Time: 01d39f220645e838

Termination Time: 0

Application Path: C:\totalcmd\TOTALCMD.EXE

Report Id: 7bcd5d1b-0b15-11e8-be10-8c89a53586cf


System errors:
=============
Error: (02/06/2018 11:56:19 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/06/2018 11:56:19 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/06/2018 11:56:19 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The AMD FUEL Service service hung on starting.

Error: (02/06/2018 11:56:03 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/06/2018 11:54:51 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/06/2018 11:40:28 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/06/2018 11:40:27 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/06/2018 11:40:19 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/06/2018 11:39:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/06/2018 11:25:45 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The McAfee Security Scan Component Host Service service terminated unexpectedly.  It has done this 1 time(s).


CodeIntegrity:
===================================
  Date: 2015-11-05 07:09:53.063
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.061
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.029
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.027
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD A6-3650 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 35%
Total physical RAM: 7665.37 MB
Available physical RAM: 4935.96 MB
Total Virtual: 11759.54 MB
Available Virtual: 9009.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:488.18 GB) (Free:196.05 GB) NTFS
Drive d: (neueMaxTor) (Fixed) (Total:443.23 GB) (Free:176.41 GB) NTFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive g: (Dritte Externe Teil 1) (Fixed) (Total:351.38 GB) (Free:50.38 GB) NTFS
Drive h: (Poops) (Fixed) (Total:347.16 GB) (Free:24.97 GB) NTFS
Drive i: (PalleMalle) (Fixed) (Total:931.51 GB) (Free:29.39 GB) NTFS
Drive j: (TOSHIBA EXT) (Fixed) (Total:931.41 GB) (Free:23.05 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 9A083BDB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=443.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 7191D59B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=351.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=347.2 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 002EFF55)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 931.5 GB) (Disk ID: AAE66568)
Partition 1: (Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

cosinus 06.02.2018 12:15
Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

juergen007 06.02.2018 12:33
ok ich muss ne stunde weg hoffe wir kriegen dass durchgezogen
Btw.:Wer zum Teufel ist dubovoy@gmail.com ??
Nicht so wichtig, aber:
Das mbar wird das wohl erkennen.

FF Extension: (Flash Video Downloader) - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\Extensions\artur.dubovoy@gmail.com.xpi [2018-01-27]

in dem Verzeichnis
C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\Extensions

Und auch
C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions

steht sehr viel Mist anscheinend, es gelang mir aber nicht, es total zu entfernen.
Wie?
Thx again. :)

Jürgen

cosinus 06.02.2018 14:17
Bitte keine Nacherzählungen posten! Mach das was in den Instruktionen steht --> Logfile posten

juergen007 06.02.2018 14:25
Ok der 2.te Lauf laüft in admin.

Kann ich währenddessen browsen auf meinem User?
Oder gar nichts machen? ( Ich tus ja schon aber nur brausen nix neues;)


Der erste Lauf fand nur einen registry entry:
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{EE884B1A-0A33-4F7E-BE89-6C013F4282AB} (Adware.Ghokswa.Generic)

Das ist wohl das Ghostery add on in mozilla FF.
abzuraten?

Zu deinem Lesestoff: meine ich hätte ich das immer richtig gemacht.
Als ich deine erste Antwort las heute morgen, waren da noch so generelle Tips dabei zum cleanen, bitte nochmal wenn du Zeit hast.

Dann habe ich noch ein Programm "mailwasher", erkennt junkmail etc. direkt auf dem imap server.
Das gehört zwar nicht hierher.
ich frag einfache... aber das zieht 75% CPU Ressourcen und kakkt ab nach 5 Minuten..
Hinweis auf alten Computer, miese software oder was?
Kann zwar CPU priority low setzen, kakkt auch ab.
Nur am Rande..

Deinstall?

Greetinx Jürgen

cosinus 06.02.2018 14:39
Meine Güte, kannst du nicht einfach mal den Rechner in Ruhe lassen? Ist das nicht möglich mal n Stunde nix zu machen :balla:

Und es sollen immer noch die Logs vollständig gepostet werden

juergen007 06.02.2018 15:46
logs
 
Log files von mbar 1ten Lauf und Frst

HtH..

Ich habe das mit dem CODE eichtig gemacht.. hoff ich

Code:
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.10.3.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.18893

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, F:\ DRIVE_FIXED, G:\ DRIVE_FIXED, H:\ DRIVE_FIXED, I:\ DRIVE_FIXED, J:\ DRIVE_FIXED
CPU speed: 2.595000 GHz
Memory total: 8037724160, free: 5219184640

Downloaded database version: v2018.02.06.04
Downloaded database version: v2018.01.23.01
Downloaded database version: v2018.01.20.01
=======================================
Initializing...
Driver version: 4.3.0.15
------------ Kernel report ------------
    02/06/2018 12:25:38
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\amd_sata.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\amd_xata.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\fsh.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\drivers\veracrypt.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\amdxhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\drivers\usbohci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\amdppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\mcvidrv.sys
\SystemRoot\system32\DRIVERS\STREAM.SYS
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\mcaudrv_x64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\amdhub30.sys
\SystemRoot\system32\drivers\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\AtihdW76.sys
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_amd_sata.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\drivers\usbccgp.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\appexDrv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\??\C:\Windows\system32\drivers\DRHARD64.sys
\??\C:\Windows\system32\drivers\DRHMSR64.sys
\??\C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\drivers\xpc4drvr.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\43221302.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\advapi32.dll
\Windows\System32\setupapi.dll
\Windows\System32\shlwapi.dll
\Windows\System32\psapi.dll
\Windows\System32\shell32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\imagehlp.dll
\Windows\System32\imm32.dll
\Windows\System32\msctf.dll
\Windows\System32\urlmon.dll
\Windows\System32\msvcrt.dll
\Windows\System32\normaliz.dll
\Windows\System32\ole32.dll
\Windows\System32\nsi.dll
\Windows\System32\comdlg32.dll
\Windows\System32\kernel32.dll
\Windows\System32\ws2_32.dll
\Windows\System32\usp10.dll
\Windows\System32\wininet.dll
\Windows\System32\difxapi.dll
\Windows\System32\sechost.dll
\Windows\System32\user32.dll
\Windows\System32\lpk.dll
\Windows\System32\iertutil.dll
\Windows\System32\gdi32.dll
\Windows\System32\clbcatq.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\Wldap32.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\KernelBase.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\userenv.dll
\Windows\System32\wintrust.dll
\Windows\System32\crypt32.dll
\Windows\System32\comctl32.dll
\Windows\System32\devobj.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\profapi.dll
\Windows\System32\msasn1.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!

Scan started
Database versions:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8007755060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80075a0890, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007755060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80074b0ac0, DeviceName: Unknown, DriverName: \Driver\amd_xata\
DevicePointer: 0xfffffa80074ae060, DeviceName: \Device\00000071\, DriverName: \Driver\amd_sata\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 9A083BDB

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1023793152
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1024000000  Numsec = 929519616
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa8008aa4790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8008aad1c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008aa4790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8008aa4060, DeviceName: \Device\0000008f\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 7191D59B

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 736899072
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 737105920  Numsec = 728037376
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 750156374016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa8008d7f790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8008d7f2c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008d7f790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8008d4bb60, DeviceName: \Device\00000090\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2EFF55

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63  Numsec = 1953525105
    Partition is not bootable
    Partition file system is NTFS

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 3, DevicePointer: 0xfffffa80090df060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80090dbb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80090df060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80090dc060, DeviceName: \Device\0000009a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 3
Scanning MBR on drive 3...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: AAE66568

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1953315840
    Partition is not bootable
    Partition file system is NTFS

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
File "C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-58280BB7DEC29D559241FFD5FF13CFE3BE52EFAB.bin.79" is compressed (flags = 1)
File "C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-58280BB7DEC29D559241FFD5FF13CFE3BE52EFAB.bin.7C" is compressed (flags = 1)
File "C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-58280BB7DEC29D559241FFD5FF13CFE3BE52EFAB.bin.83" is compressed (flags = 1)
Infected: HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{EE884B1A-0A33-4F7E-BE89-6C013F4282AB} --> [Adware.Ghokswa.Generic]
Scan finished
Creating System Restore point...
Cleaning up...
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action reg.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Executing an action cmd.exe...
Success!
Removal scheduling successful. System shutdown needed.
System shutdown occurred
=======================================


---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.10.3.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.18893

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, F:\ DRIVE_FIXED, G:\ DRIVE_FIXED, H:\ DRIVE_FIXED, I:\ DRIVE_FIXED, J:\ DRIVE_FIXED
CPU speed: 2.595000 GHz
Memory total: 8037724160, free: 5862580224

Downloaded database version: v2018.02.06.04
Downloaded database version: v2018.01.23.01
Downloaded database version: v2018.01.20.01
=======================================
Initializing...
Driver version: 4.3.0.15
------------ Kernel report ------------
    02/06/2018 13:39:33
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\amd_sata.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\amd_xata.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\fsh.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\drivers\veracrypt.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\amdxhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\drivers\usbohci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\amdppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\mcvidrv.sys
\SystemRoot\system32\DRIVERS\STREAM.SYS
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\mcaudrv_x64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\amdhub30.sys
\SystemRoot\system32\drivers\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\AtihdW76.sys
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_amd_sata.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\drivers\usbccgp.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\appexDrv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\??\C:\Windows\system32\drivers\DRHARD64.sys
\??\C:\Windows\system32\drivers\DRHMSR64.sys
\??\C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\drivers\xpc4drvr.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\3353E5FC.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\imm32.dll
\Windows\System32\shell32.dll
\Windows\System32\lpk.dll
\Windows\System32\ole32.dll
\Windows\System32\msvcrt.dll
\Windows\System32\psapi.dll
\Windows\System32\advapi32.dll
\Windows\System32\wininet.dll
\Windows\System32\setupapi.dll
\Windows\System32\urlmon.dll
\Windows\System32\sechost.dll
\Windows\System32\usp10.dll
\Windows\System32\oleaut32.dll
\Windows\System32\msctf.dll
\Windows\System32\normaliz.dll
\Windows\System32\gdi32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\user32.dll
\Windows\System32\ws2_32.dll
\Windows\System32\difxapi.dll
\Windows\System32\nsi.dll
\Windows\System32\imagehlp.dll
\Windows\System32\Wldap32.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\comdlg32.dll
\Windows\System32\kernel32.dll
\Windows\System32\iertutil.dll
\Windows\System32\clbcatq.dll
\Windows\System32\KernelBase.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\wintrust.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\devobj.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\comctl32.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\userenv.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\crypt32.dll
\Windows\System32\profapi.dll
\Windows\System32\msasn1.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!

Scan started
Database versions:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800777c060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800777cb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800777c060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80074c6ac0, DeviceName: Unknown, DriverName: \Driver\amd_xata\
DevicePointer: 0xfffffa80074b5060, DeviceName: \Device\00000071\, DriverName: \Driver\amd_sata\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 9A083BDB

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1023793152
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1024000000  Numsec = 929519616
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa8008cf7060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8008cf62d0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008cf7060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80080e96a0, DeviceName: \Device\0000008f\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 7191D59B

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 736899072
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 737105920  Numsec = 728037376
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 750156374016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa8008d9e790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8008d9e2c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008d9e790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8008cf1a20, DeviceName: \Device\00000090\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2EFF55

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63  Numsec = 1953525105
    Partition is not bootable
    Partition file system is NTFS

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 3, DevicePointer: 0xfffffa8009141060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8009141b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8009141060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800915a750, DeviceName: \Device\0000009a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 3
Scanning MBR on drive 3...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: AAE66568

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1953315840
    Partition is not bootable
    Partition file system is NTFS

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Scan Interrupted
Scan was aborted.
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-2-1024000000-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-1-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-2-737105920-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-63-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-3-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-3-0-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-3-r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.10.3.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.18893

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, F:\ DRIVE_FIXED, G:\ DRIVE_FIXED, H:\ DRIVE_FIXED, I:\ DRIVE_FIXED, J:\ DRIVE_FIXED
CPU speed: 2.595000 GHz
Memory total: 8037724160, free: 5995368448

Initializing...
=======================================
Driver version: 4.3.0.15
------------ Kernel report ------------
    02/06/2018 13:49:34
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_AuthenticAMD.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\amd_sata.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\amd_xata.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\fsh.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\System32\drivers\veracrypt.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\atikmpag.sys
\SystemRoot\system32\DRIVERS\atikmdag.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\amdxhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbfilter.sys
\SystemRoot\system32\drivers\usbohci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\parport.sys
\SystemRoot\system32\DRIVERS\sdbus.sys
\SystemRoot\system32\DRIVERS\amdppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\mcvidrv.sys
\SystemRoot\system32\DRIVERS\STREAM.SYS
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\mcaudrv_x64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\amdhub30.sys
\SystemRoot\system32\drivers\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\AtihdW76.sys
\SystemRoot\system32\drivers\HdAudio.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_amd_sata.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\drivers\usbccgp.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\appexDrv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\??\C:\Windows\system32\drivers\DRHARD64.sys
\??\C:\Windows\system32\drivers\DRHMSR64.sys
\??\C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\drivers\xpc4drvr.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\656387A4.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\user32.dll
\Windows\System32\kernel32.dll
\Windows\System32\clbcatq.dll
\Windows\System32\msctf.dll
\Windows\System32\ole32.dll
\Windows\System32\oleaut32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\urlmon.dll
\Windows\System32\imm32.dll
\Windows\System32\sechost.dll
\Windows\System32\wininet.dll
\Windows\System32\imagehlp.dll
\Windows\System32\msvcrt.dll
\Windows\System32\psapi.dll
\Windows\System32\shell32.dll
\Windows\System32\ws2_32.dll
\Windows\System32\usp10.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\iertutil.dll
\Windows\System32\advapi32.dll
\Windows\System32\setupapi.dll
\Windows\System32\nsi.dll
\Windows\System32\Wldap32.dll
\Windows\System32\lpk.dll
\Windows\System32\difxapi.dll
\Windows\System32\comdlg32.dll
\Windows\System32\normaliz.dll
\Windows\System32\gdi32.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\comctl32.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\crypt32.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\userenv.dll
\Windows\System32\devobj.dll
\Windows\System32\KernelBase.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\wintrust.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\msasn1.dll
\Windows\System32\profapi.dll
\Windows\SysWOW64\normaliz.dll
----------- End -----------
Done!

Scan started
Database versions:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8007a8b060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007a8bb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007a8b060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007658ac0, DeviceName: Unknown, DriverName: \Driver\amd_xata\
DevicePointer: 0xfffffa8007656060, DeviceName: \Device\00000071\, DriverName: \Driver\amd_sata\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 9A083BDB

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1023793152
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1024000000  Numsec = 929519616
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa80080be060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80080b7620, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80080be060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80080b7af0, DeviceName: \Device\0000008f\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 7191D59B

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition is bootable
    Partition file system is NTFS

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 736899072
    Partition is not bootable
    Partition file system is NTFS

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 737105920  Numsec = 728037376
    Partition is not bootable
    Partition file system is NTFS

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 750156374016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa8008d40790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8008d402c0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008d40790, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80080d9060, DeviceName: \Device\00000090\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 2EFF55

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 63  Numsec = 1953525105
    Partition is not bootable
    Partition file system is NTFS

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 3, DevicePointer: 0xfffffa8008f58790, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8008f59040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008f58790, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8008f59750, DeviceName: \Device\00000099\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 3
Scanning MBR on drive 3...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: AAE66568

Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1953315840
    Partition is not bootable
    Partition file system is NTFS

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
File "C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-58280BB7DEC29D559241FFD5FF13CFE3BE52EFAB.bin.79" is compressed (flags = 1)
File "C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-58280BB7DEC29D559241FFD5FF13CFE3BE52EFAB.bin.7C" is compressed (flags = 1)
File "C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\mpcache-58280BB7DEC29D559241FFD5FF13CFE3BE52EFAB.bin.83" is compressed (flags = 1)
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-2-1024000000-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-1-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-1-2-737105920-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-63-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-3-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-3-0-206848-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-3-r.mbam...
Removal finished
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 27.01.2018
Ran by Administrator (administrator) on JUERGEN2-PC (06-02-2018 15:31:53)
Running from D:\backupMaxtor80gb\data\FRSTData
Loaded Profiles: Administrator (Available Profiles: juergen2 & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe
(Jetico, Inc.) C:\Program Files (x86)\Jetico\BCWipe\BCWipeTM.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE
(Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-963683855-2343051469-89585254-500\...\MountPoints2: {3b6eaf21-9024-11e5-b954-8c89a53586cf} - F:\LaunchU3.exe -a
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter
GroupPolicyScripts\User: Restriction <==== ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{4F4DD125-EDDA-44BF-B378-9BAF78A43AC1}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)

FireFox:
========
FF DefaultProfile: iv2ha52p.default-1508386149418
FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418 [2018-02-06]
FF Session Restore: Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418 -> is enabled.
FF NewTabOverride: Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418 -> Disabled: _j5Members_@ext.ask.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_137.dll [2018-01-30] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_137.dll [2018-01-30] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [File not signed]
R2 BCWipeSvc; C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe [90592 2015-12-01] (Jetico, Inc.)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [File not signed]
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S4 ManyCam Service; C:\ProgramData\ManyCam\Service\ManyCamService.exe [544984 2016-03-31] (Visicom Media Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10803440 2017-08-29] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 InstallerService; "C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe" [X]
S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.11.667\McCHSvc.exe" [X]
S4 TrueKey; "C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe" [X]
S4 TrueKeyScheduler; "C:\Program Files\TrueKey\McTkSchedulerService.exe" [X]
S3 TrueKeyServiceHelper; "C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [229056 2015-04-03] (AppEx Networks Corporation)
S4 BCSWAP; C:\Windows\System32\Drivers\BCSWAP.sys [94400 2014-11-24] (Jetico, Inc.)
R2 DRHARD64; C:\Windows\system32\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHARD64; C:\Windows\SysWOW64\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHMSR64; C:\Windows\system32\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R2 DRHMSR64; C:\Windows\SysWOW64\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R0 fsh; C:\Windows\System32\Drivers\fsh.sys [57536 2015-05-19] (Jetico Inc. Oy)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
S3 MftWipeFilter; C:\Windows\System32\Drivers\MftWipeFilter.sys [42632 2015-12-01] (Windows (R) Win 7 DDK provider)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [195416 2015-11-17] (IDRIX)
R2 XilinxPC4Driver; C:\Windows\System32\drivers\xpc4drvr.sys [27384 2016-10-09] (Xilinx, Inc.)
S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
U3 aswbdisk; no ImagePath
S1 bcbus; system32\DRIVERS\bcbus.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 X6va037; \??\C:\Windows\SysWOW64\Drivers\X6va037 [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-06 13:49 - 2018-02-06 13:49 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\656387A4.sys
2018-02-06 13:47 - 2018-02-06 13:47 - 000000021 _____ C:\Windows\S.dirmngr
2018-02-06 13:39 - 2018-02-06 13:39 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\3353E5FC.sys
2018-02-06 12:25 - 2018-02-06 12:25 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\43221302.sys
2018-02-06 12:25 - 2018-02-06 12:25 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-02-06 12:23 - 2018-02-06 15:31 - 000000000 ____D C:\Users\Administrator\Desktop\mbar
2018-02-06 12:23 - 2018-02-06 13:48 - 000192952 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2018-02-06 09:28 - 2018-02-05 11:39 - 000001167 _____ C:\Windows\system32\Reinigung.cmd
2018-02-06 09:28 - 2017-12-24 23:03 - 000001820 _____ C:\Windows\system32\Wartung.cmd
2018-02-06 09:00 - 2018-02-06 09:03 - 000000000 ____D C:\daten
2018-02-06 08:08 - 2018-02-06 15:31 - 000000000 ____D C:\FRST
2018-02-05 23:24 - 2018-02-05 23:41 - 000000000 ___HD C:\~BCWipe.tmp
2018-02-05 18:56 - 2018-02-05 18:56 - 000739464 _____ C:\Users\juergen2\Documents\IMG_20180205_0001.pdf
2018-02-05 16:24 - 2018-02-05 16:24 - 000003544 ____N C:\bootsqm.dat
2018-02-05 11:48 - 2018-02-05 11:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BCWipe
2018-02-05 11:47 - 2018-02-05 11:47 - 000000000 ____D C:\Program Files (x86)\Jetico
2018-02-02 15:20 - 2018-02-02 15:20 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\dvdcss
2018-02-02 14:52 - 2018-02-02 14:52 - 000000017 _____ C:\Users\juergen2\AppData\Local\resmon.resmoncfg
2018-02-01 13:05 - 2018-02-01 13:05 - 000001196 _____ C:\Users\Administrator\Desktop\CrystalDiskInfo.lnk
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\Program Files (x86)\CrystalDiskInfo
2018-02-01 12:01 - 2018-02-05 11:39 - 000001167 _____ C:\Windows\SysWOW64\Reinigung.cmd
2018-02-01 12:01 - 2017-12-24 23:03 - 000001820 _____ C:\Windows\SysWOW64\Wartung.cmd
2018-02-01 00:23 - 2018-02-01 00:23 - 000000000 ____D C:\Users\juergen2\PDF
2018-01-31 23:58 - 2018-01-31 23:58 - 000000181 _____ C:\Users\juergen2\Documents\slashesversion.gp
2018-01-31 22:17 - 2018-01-31 22:17 - 000000142 _____ C:\Users\juergen2\new2.gp
2018-01-31 22:01 - 2018-01-31 22:01 - 000002210 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
2018-01-31 22:01 - 2018-01-31 22:01 - 000002172 _____ C:\Users\Public\Desktop\Google Earth Pro.lnk
2018-01-31 22:00 - 2018-01-31 21:57 - 000000096 _____ C:\Users\juergen2\Documents\new.txt
2018-01-31 21:17 - 2018-02-01 00:12 - 000007841 _____ C:\Users\juergen2\Documents11.pdf
2018-01-30 23:39 - 2018-01-30 23:40 - 000000127 _____ C:\Users\juergen2\Documents\anmachenFilipina.txt
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Macromedia
2018-01-29 22:31 - 2018-02-04 13:04 - 000004740 _____ C:\Users\juergen2\Documents\23.txt
2018-01-29 22:11 - 2018-01-30 23:09 - 000003173 _____ C:\Users\juergen2\Documents\13.txt
2018-01-29 22:09 - 2018-01-29 22:09 - 001332457 _____ C:\Users\juergen2\Documents\1013.txt
2018-01-29 21:01 - 2018-01-29 21:58 - 000003016 _____ C:\Users\juergen2\Desktop\mmmma.txt
2018-01-28 23:59 - 2018-01-28 23:59 - 000001182 _____ C:\Users\juergen2\Desktop\MailWasherPro.lnk
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Program Files (x86)\Firetrust
2018-01-28 23:58 - 2018-01-29 00:00 - 000000000 ____D C:\ProgramData\Firetrust
2018-01-28 12:57 - 2018-01-31 21:20 - 000000000 ____D C:\Users\juergen2\Documents\Wolfram Mathematica
2018-01-28 12:57 - 2018-01-29 19:37 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Mathematica
2018-01-28 12:57 - 2018-01-28 12:58 - 000000000 ____D C:\Users\juergen2\AppData\Local\Mathematica
2018-01-28 12:57 - 2018-01-28 12:57 - 000000000 ____D C:\Users\juergen2\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\Documents\Wolfram Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\ProgramData\Mathematica
2018-01-27 12:30 - 2018-01-27 12:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica 11.2
2018-01-27 12:27 - 2018-01-27 12:27 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\OpenOffice
2018-01-27 12:17 - 2018-01-27 12:17 - 000000000 ____D C:\Program Files\Wolfram Research
2018-01-27 12:00 - 2018-01-27 12:03 - 000000000 ____D C:\Users\Administrator\Downloads\M-WIN-L-11.2.0-5822651
2018-01-27 12:00 - 2018-01-27 12:00 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram Research
2018-01-18 14:27 - 2018-01-18 14:27 - 000002077 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files\Microsoft Security Client
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2018-01-12 13:00 - 2018-01-01 03:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-01-12 13:00 - 2018-01-01 03:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-01-12 13:00 - 2018-01-01 03:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-01-12 13:00 - 2018-01-01 03:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 03:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-01-12 13:00 - 2018-01-01 03:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-01-12 13:00 - 2018-01-01 03:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-01-12 13:00 - 2018-01-01 02:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-01-12 13:00 - 2018-01-01 02:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-01-12 13:00 - 2018-01-01 02:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-01-12 13:00 - 2018-01-01 02:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll
2018-01-12 13:00 - 2018-01-01 02:46 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\vmictimeprovider.dll
2018-01-12 13:00 - 2018-01-01 02:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-01-12 13:00 - 2018-01-01 02:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 02:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-01-12 13:00 - 2018-01-01 02:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-01-12 13:00 - 2018-01-01 02:39 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 02:36 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-01-12 13:00 - 2018-01-01 02:35 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2017-12-30 08:29 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-01-12 13:00 - 2017-12-30 07:42 - 000347328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-01-12 13:00 - 2017-12-29 19:39 - 020274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-01-12 13:00 - 2017-12-29 19:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 19:13 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-01-12 13:00 - 2017-12-29 19:13 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-01-12 13:00 - 2017-12-29 19:12 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-01-12 13:00 - 2017-12-29 19:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 19:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 19:09 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-01-12 13:00 - 2017-12-29 19:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 18:55 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 18:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-01-12 13:00 - 2017-12-29 18:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-01-12 13:00 - 2017-12-29 18:47 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 18:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 18:45 - 004508160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-01-12 13:00 - 2017-12-29 18:44 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-01-12 13:00 - 2017-12-29 18:39 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 18:37 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 18:36 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 18:19 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-01-12 13:00 - 2017-12-29 18:15 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-01-12 13:00 - 2017-12-29 18:13 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-01-12 13:00 - 2017-12-29 10:15 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-01-12 13:00 - 2017-12-29 10:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 10:04 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-01-12 13:00 - 2017-12-29 09:52 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 005796352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-01-12 13:00 - 2017-12-29 09:50 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 09:44 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 09:43 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-01-12 13:00 - 2017-12-29 09:40 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 09:39 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-01-12 13:00 - 2017-12-29 09:32 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-01-12 13:00 - 2017-12-29 09:28 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 09:22 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-01-12 13:00 - 2017-12-29 09:22 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 09:21 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 09:16 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 09:14 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-01-12 13:00 - 2017-12-29 09:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-01-12 13:00 - 2017-12-29 09:04 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-01-12 13:00 - 2017-12-29 09:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 09:01 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 08:50 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-01-12 13:00 - 2017-12-29 08:39 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-01-12 13:00 - 2017-12-29 08:27 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-01-12 13:00 - 2017-12-21 07:27 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-01-12 13:00 - 2017-12-13 17:31 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-01-12 13:00 - 2017-12-13 17:15 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-01-12 13:00 - 2017-12-13 16:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-01-12 13:00 - 2017-12-05 16:59 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-01-12 13:00 - 2017-12-05 16:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-01-11 17:13 - 2018-01-11 17:42 - 000000000 ____D C:\recov
2018-01-11 12:43 - 2018-01-11 12:43 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avusbflt_01011.Wdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-06 15:32 - 2017-01-04 21:53 - 000000000 ____D C:\Users\Administrator\AppData\LocalLow\Mozilla
2018-02-06 15:31 - 2016-07-15 12:40 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-02-06 14:07 - 2016-11-19 14:58 - 000000000 ____D C:\Users\juergen2\AppData\LocalLow\Mozilla
2018-02-06 14:06 - 2015-10-31 22:15 - 000065744 _____ C:\Users\juergen2\AppData\Local\GDIPFONTCACHEV1.DAT
2018-02-06 13:56 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-02-06 13:56 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-02-06 13:51 - 2015-11-02 13:24 - 002000634 _____ C:\Windows\ntbtlog.txt
2018-02-06 13:47 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-06 12:17 - 2017-01-03 13:32 - 000000000 ____D C:\Users\Administrator\AppData\Local\Google
2018-02-06 12:05 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2018-02-06 11:46 - 2015-11-01 09:41 - 000000000 ____D C:\ProgramData\Package Cache
2018-02-06 11:39 - 2017-01-03 13:33 - 000065744 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2018-02-06 11:38 - 2009-07-14 05:45 - 000291024 _____ C:\Windows\system32\FNTCACHE.DAT
2018-02-06 09:46 - 2009-07-14 04:20 - 000000000 __RSD C:\Windows\Media
2018-02-06 08:54 - 2016-05-16 15:01 - 000000000 ____D C:\Program Files\TrueKey
2018-02-06 08:50 - 2015-12-21 20:28 - 000000000 ____D C:\Users\juergen2\AppData\Local\Google
2018-02-06 08:48 - 2015-12-21 20:28 - 000000000 ____D C:\Program Files (x86)\Google
2018-02-06 08:47 - 2016-10-02 17:45 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\NCH Software
2018-02-06 08:05 - 2015-11-01 11:12 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\vlc
2018-02-05 20:47 - 2017-05-10 13:31 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Electrum
2018-02-05 18:04 - 2015-11-13 17:07 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\IrfanView
2018-02-05 16:25 - 2016-11-18 20:36 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2018-02-05 16:25 - 2015-10-31 22:35 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-02-05 13:03 - 2015-11-01 08:53 - 000000000 ____D C:\xampp
2018-02-05 11:48 - 2009-07-14 04:20 - 000000000 ___HD C:\Windows\system32\GroupPolicy
2018-02-05 11:25 - 2016-07-21 13:39 - 000002177 _____ C:\Users\juergen2\Desktop\JRT.txt
2018-02-05 11:08 - 2016-07-21 13:33 - 000000000 ____D C:\AdwCleaner
2018-02-04 12:23 - 2017-11-16 22:48 - 000000000 ____D C:\Users\juergen2\AppData\Local\CrashDumps
2018-02-03 16:54 - 2015-11-14 12:57 - 000075264 _____ C:\Users\juergen2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-02-03 15:38 - 2016-02-24 19:10 - 000000000 ____D C:\div
2018-02-03 15:38 - 2015-10-31 22:30 - 000000000 ____D C:\datas
2018-02-03 15:07 - 2016-01-24 16:00 - 000000000 ____D C:\Users\juergen2\AppData\Local\QuickPar
2018-02-03 12:24 - 2009-07-14 06:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
2018-02-02 15:15 - 2017-01-04 14:10 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2018-02-02 11:04 - 2009-07-14 06:32 - 000000000 ____D C:\Windows\system32\FxsTmp
2018-02-01 08:16 - 2016-10-09 09:50 - 000000000 ____D C:\Windows\Minidump
2018-02-01 00:23 - 2015-10-31 22:01 - 000000000 ____D C:\Users\juergen2
2018-01-31 22:47 - 2016-08-18 13:38 - 000000981 _____ C:\Users\juergen2\Desktop\PARI.lnk
2018-01-31 22:34 - 2016-08-18 19:24 - 000000000 ____D C:\tmp
2018-01-31 22:19 - 2016-08-18 13:37 - 000000000 ____D C:\Program Files (x86)\Pari-2-7-6
2018-01-30 20:56 - 2015-11-01 10:23 - 000000000 ____D C:\Users\juergen2\AppData\Local\Adobe
2018-01-30 20:47 - 2016-02-17 17:00 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-30 20:47 - 2015-11-01 10:23 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-30 20:47 - 2015-11-01 10:23 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-30 20:06 - 2017-08-26 17:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-28 21:35 - 2015-11-15 10:42 - 000000000 ____D C:\vhd
2018-01-26 12:50 - 2015-11-15 10:22 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\gnupg
2018-01-25 00:48 - 2017-06-30 15:19 - 000004100 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1498067933
2018-01-23 19:58 - 2010-11-21 04:27 - 000548000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2018-01-19 14:22 - 2015-11-01 09:42 - 000765656 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2018-01-18 14:27 - 2016-05-12 18:47 - 000001945 _____ C:\Windows\epplauncher.mif
2018-01-18 14:04 - 2009-07-14 06:08 - 000032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-01-15 11:23 - 2017-12-10 15:05 - 000001302 _____ C:\Users\Public\Desktop\Skype.lnk
2018-01-15 11:23 - 2017-12-10 15:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-01-12 17:49 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\rescache
2018-01-11 16:30 - 2017-12-30 15:22 - 000000000 ____D C:\Program Files\Recuva
2018-01-11 14:15 - 2011-04-12 09:28 - 000000000 ___RD C:\Users\Public\Recorded TV
2018-01-11 02:00 - 2015-11-01 12:47 - 000000000 ____D C:\Windows\system32\MRT
2018-01-11 01:56 - 2017-10-12 02:06 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-01-11 01:56 - 2015-11-01 12:47 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2018-01-09 15:28 - 2017-09-02 13:28 - 000004486 _____ C:\Windows\System32\Tasks\Adobe Flash Player PPAPI Notifier

==================== Files in the root of some directories =======

2017-07-20 19:34 - 2017-07-20 19:34 - 000003584 _____ () C:\Users\Administrator\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-01-29 17:35

==================== End of FRST.txt ============================
--- --- ---

--- --- ---

--- --- ---

juergen007 06.02.2018 15:46
addition
 
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27.01.2018
Ran by Administrator (06-02-2018 15:32:59)
Running from D:\backupMaxtor80gb\data\FRSTData
Windows 7 Professional Service Pack 1 (X64) (2015-10-31 21:00:58)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-963683855-2343051469-89585254-500 - Administrator - Enabled) => C:\Users\Administrator
Guest (S-1-5-21-963683855-2343051469-89585254-501 - Limited - Disabled)
juergen2 (S-1-5-21-963683855-2343051469-89585254-1000 - Administrator - Enabled) => C:\Users\juergen2

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 28 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 28.0.0.137 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (HKLM\...\{F15287C6-10E3-1676-AF50-CB0355A302F1}) (Version: 2.00.0002 - Advanced Micro Devices, Inc.)
AMD APP SDK Runtime (HKLM\...\{503F672D-6C84-448A-8F8F-4BC35AC83441}) (Version: 10.0.873.1 - Advanced Micro Devices Inc.)
AMD Catalyst Control Center (HKLM-x32\...\{20AE3A4E-38CA-C6F8-4E60-5DF41A2CC0AC}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
AMD Catalyst Install Manager (HKLM\...\{7E5DC2C5-115A-322B-976C-219237FAED66}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (HKLM\...\{CF84CD21-FC52-857E-AF41-9DEE9C76D245}) (Version: 2.00.0000 - Advanced Micro Devices, Inc.)
AMD Fuel (HKLM\...\{AA20E9E6-96D0-C201-E44D-F7D921F595FD}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 4.0.0.0 - AppEx Networks)
AMD Steady Video Plug-In  (HKLM\...\{94BFDEF9-D91D-4B5D-8A60-08514C7191AF}) (Version: 2.08.0000 - AMD)
AMD USB 3.0 Device Detector (HKLM\...\{F5733897-B788-4AB1-B399-166A9FBB47A8}) (Version: 2.1.30.0 - Advanced Micro Devices, Inc.)
AMD Wireless Display v3.0 (HKLM\...\{630E5EF7-72F8-9E5D-BEF5-ED85B698E160}) (Version: 1.0.0.15 - Advanced Micro Devices, Inc.)
Arasan 20.2 (HKLM-x32\...\Arasan_is1) (Version:  - )
Backup and Sync from Google (HKLM-x32\...\{908DB568-E5FA-40C7-A2AA-AB340190858B}) (Version: 3.38.7642.3857 - Google, Inc.)
BCWipe 6.0 (HKLM-x32\...\BCWipe) (Version: 6.08.3 - Jetico Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer Driver Add-On Module (HKLM\...\CANONIJINBOXADDON100) (Version:  - )
Canon MG5500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5500_series) (Version: 1.02 - Canon Inc.)
Catalyst Control Center Graphics Previews Common (HKLM-x32\...\{9114BDDB-A6A6-152D-060A-E99307057AD1}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Catalyst Control Center InstallProxy (HKLM-x32\...\{66CDB8EB-80D3-A762-32B4-80DA61A1C6C8}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Catalyst Control Center Localization All (HKLM-x32\...\{315D9E6B-98B1-1E2B-9E93-B36A0B104224}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Standard (HKLM-x32\...\{703F229F-573E-10E7-3B44-341DB59AD86B}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Traditional (HKLM-x32\...\{489E5436-B101-CAD9-5571-14746675ECE3}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Czech (HKLM-x32\...\{BBA1614E-6470-7841-8A42-ABD5BA7B3FFE}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Danish (HKLM-x32\...\{AA0E1433-8F16-AA01-E8E9-E6408579D0D8}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Dutch (HKLM-x32\...\{504819D1-3C0A-2695-0007-BBDFA5936D68}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help English (HKLM-x32\...\{6C495748-5F03-0B97-568B-76D0368FB460}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Finnish (HKLM-x32\...\{D9CBA021-DB41-9736-923F-52E3E426912D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help French (HKLM-x32\...\{B03A580A-5D67-DAC5-59A1-7AD7C513381C}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help German (HKLM-x32\...\{69DF4822-9B16-CE04-7587-22E09FB5FD1D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Greek (HKLM-x32\...\{968C0E92-6DA9-5784-9A0B-1061D0CB2C14}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Hungarian (HKLM-x32\...\{11BC8F83-7260-65EB-3E0A-FA7AC894B42D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Italian (HKLM-x32\...\{FE4DC915-D724-E72C-EF86-DC5B89961ACF}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Japanese (HKLM-x32\...\{C9353DBC-A47C-2C9B-AF32-5E2C8B4E3D3A}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Korean (HKLM-x32\...\{37DBC990-C514-3821-D6FB-12E0745AA990}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Norwegian (HKLM-x32\...\{79E3071B-8A0C-C105-6442-CF611732601E}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Polish (HKLM-x32\...\{A12E8E1A-A77D-94E5-72F8-E83D6256AF11}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Portuguese (HKLM-x32\...\{AD5E3969-F0C0-ECBF-45E5-C36B84904281}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Russian (HKLM-x32\...\{CFA2067C-AE90-3BF9-06AF-E7E65E679B3D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Spanish (HKLM-x32\...\{110E4EE7-85A9-B76B-B943-C0C1CF0C2F74}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Swedish (HKLM-x32\...\{42A97797-A255-49F9-4250-D58A9CEA2904}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Thai (HKLM-x32\...\{31BC0B51-0676-A531-3940-1818B609EEA7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Turkish (HKLM-x32\...\{9DB45EC2-90E7-642D-7CF9-5AC2FBDC14F7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
ccc-utility64 (HKLM\...\{C3463F9A-E635-02E0-C351-41D16074E202}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Convert XLS (HKLM-x32\...\Convert XLS_is1) (Version:  - Softinterface, Inc.)
CrystalDiskInfo 7.5.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.5.1 - Crystal Dew World)
Dr. Hardware 2015 15.5d (HKLM-x32\...\Dr. Hardware 2015_is1) (Version:  - Peter A. Gebhard)
Free Pascal 3.0.0 (HKLM-x32\...\FreePascal_is1) (Version:  - Free Pascal Team)
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.195.0 - International GeoGebra Institute)
Google Earth Pro (HKLM-x32\...\{76AADFE7-3416-419C-A30B-41E762231584}) (Version: 7.3.1.4505 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gpg4win (2.3.3) (HKLM-x32\...\GPG4Win) (Version: 2.3.3 - The Gpg4win Project)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
GUI Turbo Assembler Ver 3.0.1 (HKLM-x32\...\{F522C947-52FA-4C01-B933-16292944E000}) (Version: 3.0.1 - Lakhya's Innovation Inc.)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan)
Lazarus 1.6.2 (HKLM\...\lazarus_is1) (Version: 1.6.2 - Lazarus Team)
MailWasherPro (HKLM-x32\...\{D16B61A0-A55E-47A9-BA73-8A5E92C26DB2}) (Version: 7.11.05 - Firetrust)
ManyCam 5.3.0 (HKLM-x32\...\ManyCam) (Version: 5.3.0 - Visicom Media Inc.)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 58.0.1 (x64 de) (HKLM\...\Mozilla Firefox 58.0.1 (x64 de)) (Version: 58.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 53.0.3 - Mozilla)
Mozilla Thunderbird 52.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.6.0 (x86 de)) (Version: 52.6.0 - Mozilla)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.4 - Notepad++ Team)
Pari-2-7-6 (remove only) (HKLM-x32\...\Pari-2-7-6) (Version:  - )
PC Inspector File Recovery (HKLM-x32\...\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}) (Version: 4.0 - )
PilotEdit Lite 10.7.0 (HKLM-x32\...\PilotEdit Lite_is1) (Version:  - )
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Revo Uninstaller 2.0.4 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.4 - VS Revo Group, Ltd.)
Scid vs PC 4.16 (HKLM-x32\...\Scid vs PC_is1) (Version: 4.16 - Steven Atkinson)
SharpKeys (HKLM\...\{F6908C45-459A-4332-A3F2-03DAAB64939D}) (Version: 3.6.0000 - RandyRants.com)
Shotcut (HKLM-x32\...\Shotcut) (Version:  - )
Skype version 8.13 (HKLM-x32\...\Skype_is1) (Version: 8.13 - Skype Technologies S.A.)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.83369 - TeamViewer)
Total Commander 64-bit (Remove or Repair) (HKLM-x32\...\Totalcmd64) (Version: 9.0a - Ghisler Software GmbH)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.16 - IDRIX)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Web Companion (HKLM-x32\...\{37c882f6-40f7-46a4-9ccb-8e2808e1a79e}) (Version: 2.4.1558.3001 - Lavasoft)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Wolfram Mathematica 11.2 (M-WIN-L 11.2.0 5822651) (HKLM\...\M-WIN-L 11.2.0 5822651_is1) (Version: 11.2.0 - Wolfram Research, Inc.)
Wondershare Data Recovery(Build 6.5.1.5) (HKLM-x32\...\{FEA3976F-D621-45F3-AFBD-E812A1F2F00D}_is1) (Version: 6.5.1.5 - Wondershare Software Co.,Ltd.)
Wondershare Helper Compact 2.5.2 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.2 - Wondershare)
Xaldon WebSpider2 (HKLM-x32\...\WebSpider2) (Version:  - )
Xilinx Design Tools Vivado HL WebPACK 2016.3 (C:\Xilinx) (HKLM\...\Xilinx_Vivado HL WebPACK_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx DocNav (C:\Xilinx) (HKLM\...\Xilinx_DocNav_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx Information Center (C:\Xilinx) (HKLM\...\Xilinx_Xilinx Information Center_2016.3#0) (Version: 2016.3 - Xilinx Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2017-11-20] (Google)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-01-01] ()
ContextMenuHandlers1: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-20] (Google)
ContextMenuHandlers1: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers1: [PilotEdit] -> {277B9550-37E2-47DE-B533-89A1EBD82DB9} => C:\Program Files (x86)\PilotEdit Lite\EShell_x64.dll [2013-01-01] (PilotEdit)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers2: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2017-11-20] (Google)
ContextMenuHandlers4: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\atiacm64.dll [2015-08-04] (Advanced Micro Devices, Inc.)
ContextMenuHandlers6: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1FB3732E-9592-444D-A701-81DF304F14A9} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe
Task: {21022CE6-BFE7-40E7-AAFA-15A6CC72356B} - System32\Tasks\{E140102B-F244-4775-9758-5FA77AFD8886} => C:\Windows\system32\pcalua.exe -a "C:\Users\juergen2\Downloads\chromeinstall-8u77 (1).exe" -d C:\Users\juergen2\Downloads
Task: {213D38E2-E0E5-4EFB-88BC-AC61BF33552B} - System32\Tasks\{849B1E16-7952-40E5-887E-DAAD93154E62} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\putty.exe -d D:\backupMaxtor80gb\data
Task: {22DA9795-90BD-4731-AB6A-BD01A662D2F9} - System32\Tasks\{9C6CF1E7-9264-4314-BC30-F7778072B17B} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\wlsetup3528-all.exe -d d:\backupMaxtor80gb\data\
Task: {2B956E7E-A592-418D-A99E-DB739E3B9B5E} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {3B11371B-11AB-415E-8185-32A4F05C4B0F} - System32\Tasks\{471AF2D6-FC39-423E-8A09-1CE6E304D7BB} => C:\Windows\system32\pcalua.exe -a C:\camel\SilkroadOnlineGlobal_Official_v1_486.exe -d c:\camel\
Task: {4ADE3327-7150-4BB8-87C3-76601FC67879} - System32\Tasks\{FD09F9C6-B58A-406E-8536-F1B82AF22BBE} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\i2pinstall_0.9.30_windows.exe -d D:\backupMaxtor80gb\data
Task: {6ADA2DE3-F929-4442-BCBE-E1D403613F2F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)
Task: {70FC73DB-5C4F-4CB5-9833-76B9D3A491A6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {A6D9A0B3-82A7-4937-910D-C86CC1F2F571} - System32\Tasks\{C61837B8-EABF-4B5E-B96E-3C6EC1BD2343} => C:\Windows\system32\pcalua.exe -a C:\datas\jxpiinstall(4).exe -d C:\datas
Task: {AD24AC21-72E8-4AFB-8BA6-BC0413019E02} - System32\Tasks\Opera scheduled Autoupdate 1498067933 => C:\Users\juergen2\AppData\Local\Programs\Opera\launcher.exe [2018-01-22] (Opera Software)
Task: {BE9E6706-8A73-4F34-8BC7-F4B899EDF1C0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {DAC363AC-634F-4411-8C93-334B4E476B58} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe
Task: {E302C505-2A7A-4384-87A8-489CE462BC3D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {F4DDD129-C6FA-4772-AC2D-CE369BA97A92} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {F6F30DFE-BB87-4833-A1E0-CEE92CCDEE3C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


==================== Loaded Modules (Whitelisted) ==============

2015-08-04 00:25 - 2015-08-04 00:25 - 000214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 000817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 003650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2016-08-18 09:27 - 2016-08-18 09:27 - 000216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2018-01-01 02:07 - 2018-01-01 02:07 - 000230064 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2015-08-04 00:25 - 2015-08-04 00:25 - 000102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000222720 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2016-08-18 09:09 - 2016-08-18 09:09 - 000103424 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2016-08-18 09:03 - 2016-08-18 09:03 - 000050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000073728 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2016-08-18 09:17 - 2016-08-18 09:17 - 000751104 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll
2016-12-19 15:36 - 2016-12-14 09:00 - 000132176 _____ () C:\totalcmd\wcmzip32.dll
2018-01-01 02:07 - 2018-01-01 02:07 - 000021680 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2017-11-30 16:41 - 000002026 _____ C:\Windows\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-963683855-2343051469-89585254-500\Control Panel\Desktop\\Wallpaper -> C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: LavasoftAdAwareService11 => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: vssbrigde64 => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^juergen2^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MailWasherPro.lnk => C:\Windows\pss\MailWasherPro.lnk.Startup
MSCONFIG\startupreg: AvgUi => "C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe" /lps=fmw

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{E08E8243-C2A1-4221-90A7-14736621DBE5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9EA08C55-5310-4A9E-8ABB-32F4A49FF91B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{97587CB0-9EAA-4B76-AE0F-849E608FE32D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{81373308-C4D3-45DA-ABFB-9FF3613C6D5D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{27E94056-EE89-40C2-88F9-FCDD1B8E5D43}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{D80E4AD5-8012-4DE4-B0FE-3695EFEBEAED}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{E4AFD96A-B990-4558-B5EE-3F16F3B150B1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4EFF6531-5BDD-4CC8-BCE4-8C1B36A92B77}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1144CB11-19E6-41BF-BAFF-C3CBF53D788E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{D076BE44-8E6B-4596-BDAA-38B73655C620}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{BA663251-09BF-4823-8DE3-357013B1B8CE}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [UDP Query User{E5E54FE6-C09E-4ABB-90E3-E86CBF75A6F2}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [TCP Query User{3562059C-09AD-49C5-B7A8-F01122A24FF9}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{F0D6FC0B-D3F6-4346-A980-F46D4C9D1B96}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{98C9BD54-7195-421F-8622-82F19A588534}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [UDP Query User{823BFEF5-2144-437C-A54B-BCCA12451298}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [TCP Query User{43DE325D-FD61-460D-842E-290A5202FB7F}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{DFCF343D-2298-479B-820C-A9D87E56AFF7}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [TCP Query User{A1496639-68D5-46B4-967E-A505FB7D9C89}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [UDP Query User{D2661694-9DE9-4B85-AA71-E76B9FE67E92}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [TCP Query User{DA6A1C4E-6658-4536-B8A6-C2F9FD65FD61}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [UDP Query User{4C306084-351A-440E-86A7-02F33064F80E}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [TCP Query User{82621B54-D4E3-4191-A32E-7FB2E966AFE0}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{FA455FFB-BB85-4880-8324-9ED51129A541}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [TCP Query User{AFDB542D-C34E-4DBA-A5E8-13FD772F4676}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{821974AD-1244-4300-8892-42C965D1C906}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [{776A7697-A9FA-4D00-AE02-02733E032793}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{179DB254-E4A7-44FD-8180-A252E383B707}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [TCP Query User{5881A1B3-618E-4628-AF81-07C027281C34}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [UDP Query User{B1095A5C-EA19-4532-BE33-41EF9C86B1D8}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [TCP Query User{B12981FF-B265-4AD8-90CC-1CAA78AFF9D3}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{17966661-BA79-4C90-BC0D-63434C7A2A9F}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{359222EA-9F94-4EDA-A978-E08B0C015F21}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{DCC70F92-DA66-4518-B65F-551E06FAED96}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{0C48E5AD-B230-4661-BAFF-D286C90BF7ED}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{5E82995E-38F3-476B-98A0-E4055D9530E6}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{FF3B1697-47E7-4E15-A46F-14DAD9A34297}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{91BF5810-5F2B-4B0B-89A6-13C7BD7AF7E0}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [{A15FD59F-4DEB-48C5-B0AB-C560507A5BD9}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{7B27A2F1-A1C2-40B1-856F-69E72A5FDD68}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{109B94D2-FB0C-44F2-A49B-C1ABC4AE84C2}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{0E26162C-0928-4A55-BFA2-D3D7A388B22E}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{8BAD0C4F-C654-432F-8A46-8CBC4BFF20AF}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{81FA3FFE-6DEF-4F3D-871E-6120D650F375}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{E12FBEE4-11A9-4252-B72E-9DA5B9A82CDB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{7DA09561-F33A-4F74-AE93-BE232605E318}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{C619FF61-7405-4E6D-B469-F5ED7A4CEBEE}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{5D49AA65-E9EC-4E40-AF85-819A887C58C3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{97B5B131-9D32-4BAD-8E9A-E1780ABF9A4D}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{054F0F09-AE56-4599-9BA5-F86C9D31FFB5}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{A5989984-670A-4953-A4B2-97E2981C1C4E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.58\opera.exe
FirewallRules: [{51A58F52-6A7A-4F9F-A9D3-54673771201E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.67\opera.exe
FirewallRules: [{858D641F-B90B-4B90-9641-DFF96825B635}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{36275EA3-11DB-4932-AC9B-19B7D18F4C95}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{A9C5985A-EEDC-40A3-BBEC-1E2E964F227C}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{A6DED921-ACDB-4F33-8FF6-E322906C2092}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{9D3AC6F5-DD80-4C6C-AC12-2DE855E84AE0}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe
FirewallRules: [{719EF127-CBDB-42E9-AA42-01703EB925AD}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe

==================== Restore Points =========================

05-02-2018 23:59:14 Windows Update
06-02-2018 08:36:28 Revo Uninstaller's restore point - Debut Videorekorder
06-02-2018 08:48:01 Revo Uninstaller's restore point - Google Chrome
06-02-2018 10:45:05 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser (KB2758694)
06-02-2018 10:59:34 Revo Uninstaller's restore point - Adobe Acrobat Reader DC - Deutsch
06-02-2018 11:03:18 Revo Uninstaller's restore point - Avira
06-02-2018 11:04:42 Revo Uninstaller's restore point - Avira Antivirus
06-02-2018 11:13:09 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 102 (64-bit)
06-02-2018 11:13:34 Removed Java SE Development Kit 8 Update 102 (64-bit)
06-02-2018 11:16:26 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 91
06-02-2018 11:16:53 Removed Java SE Development Kit 8 Update 91
06-02-2018 11:19:30 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 91 (64-bit)
06-02-2018 11:19:55 Removed Java SE Development Kit 8 Update 91 (64-bit)
06-02-2018 11:23:47 Revo Uninstaller's restore point - McAfee Security Scan Plus
06-02-2018 11:26:06 Revo Uninstaller's restore point - OpenOffice 4.1.3
06-02-2018 11:28:56 Revo Uninstaller's restore point - TrueCrypt
06-02-2018 11:29:21 TrueCrypt uninstallation
06-02-2018 11:32:47 Revo Uninstaller's restore point - Silkroad
06-02-2018 11:44:48 Revo Uninstaller's restore point - Avira
06-02-2018 11:48:25 Revo Uninstaller's restore point - MBOT_PureSRO_2016 version Final
06-02-2018 11:49:56 Revo Uninstaller's restore point - TDM-GCC
06-02-2018 13:30:26 Malwarebytes Anti-Rootkit Restore Point

==================== Faulty Device Manager Devices =============

Name: ZAM Helper Driver
Description: ZAM Helper Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: ZAM Guard Driver
Description: ZAM Guard Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM_Guard
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: AODDriver4.1
Description: AODDriver4.1
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: AODDriver4.1
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/06/2018 01:48:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 01:34:37 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 11:56:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 11:44:41 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
  Gathering Writer Data

Context:
  Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
  Writer Name: System Writer
  Writer Instance ID: {6908a91b-07af-41aa-9760-bc83cc80c3fd}

Error: (02/06/2018 11:40:33 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 10:45:02 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
  Gathering Writer Data

Context:
  Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
  Writer Name: System Writer
  Writer Instance ID: {79287d94-32e6-4795-939e-1fb809449ef7}

Error: (02/06/2018 09:53:15 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:49:37 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:35:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 09:28:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (02/06/2018 01:48:46 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/06/2018 01:48:46 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/06/2018 01:48:29 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/06/2018 01:47:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/06/2018 01:34:59 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/06/2018 01:34:28 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/06/2018 01:34:28 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/06/2018 01:32:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/06/2018 11:56:19 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/06/2018 11:56:19 AM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.


CodeIntegrity:
===================================
  Date: 2015-11-05 07:09:53.063
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.061
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.029
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.027
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD A6-3650 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 45%
Total physical RAM: 7665.37 MB
Available physical RAM: 4163.39 MB
Total Virtual: 11759.54 MB
Available Virtual: 7930.29 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:488.18 GB) (Free:196.32 GB) NTFS
Drive d: (neueMaxTor) (Fixed) (Total:443.23 GB) (Free:176.39 GB) NTFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive g: (Dritte Externe Teil 1) (Fixed) (Total:351.38 GB) (Free:50.38 GB) NTFS
Drive h: (Poops) (Fixed) (Total:347.16 GB) (Free:24.97 GB) NTFS
Drive i: (PalleMalle) (Fixed) (Total:931.51 GB) (Free:29.29 GB) NTFS
Drive j: (TOSHIBA EXT) (Fixed) (Total:931.41 GB) (Free:23.04 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 9A083BDB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=443.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 7191D59B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=351.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=347.2 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 002EFF55)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 931.5 GB) (Disk ID: AAE66568)
Partition 1: (Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

cosinus 06.02.2018 16:12
Und wieder die bitte mal endlich richtig zu lesen...!

1. RICHTIGES Logfile von MBAR!
2. von neuen FRST-Logs war nicht die Rede
3. ist das denn so schwierig mal richtig zu lesen und einfach nur das zu zun was in den Instruktionen steht :balla:

juergen007 07.02.2018 13:09
Code:
Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18893
Administrator :: JUERGEN2-PC [administrator]

06.02.2018 12:25:49
mbar-log-2018-02-06 (12-25-49).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 314515
Time elapsed: 57 minute(s), 52 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{EE884B1A-0A33-4F7E-BE89-6C013F4282AB} (Adware.Ghokswa.Generic) -> Data: v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:\Users\juergen2\AppData\Local\IQA\Application\chrome.exe|Name=IQA (mDNS-In)|Desc=Inbound rule for IQA to allow mDNS traffic.|EmbedCtxt=IQA| -> Delete on reboot. [b04c36abb40345f19d0d8988c63ae41c]

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 07.02.2018 13:49
Sinnigerweise ALLE Logs mit Funden posten. Komlett. Oder ich bin hier raus.

juergen007 07.02.2018 18:35
Jetzt machst du mir etwas Angst dass ich zuviel oder zuwenig poste.
Also ich hatte 4 Mbar läufe und noch einen adwcleaner.
Diese 4 bringe ich mit dem Risiko getötet zu werden.

Code:
# AdwCleaner 7.0.7.0 - Logfile created on Wed Feb 07 12:18:40 2018
# Updated on 2018/18/01 by Malwarebytes
# Running on Windows 7 Professional (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

Plugin deleted: __MSG_appName__ -


***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [1601 B] - [2016/9/2 23:20:52]
C:/AdwCleaner/AdwCleaner[C10].txt - [2962 B] - [2017/2/3 11:33:41]
C:/AdwCleaner/AdwCleaner[C11].txt - [3282 B] - [2017/3/3 14:44:46]
C:/AdwCleaner/AdwCleaner[C12].txt - [3513 B] - [2017/3/15 13:2:20]
C:/AdwCleaner/AdwCleaner[C13].txt - [3829 B] - [2017/4/2 12:43:5]
C:/AdwCleaner/AdwCleaner[C14].txt - [4180 B] - [2017/6/18 16:17:28]
C:/AdwCleaner/AdwCleaner[C15].txt - [4066 B] - [2017/6/28 17:14:42]
C:/AdwCleaner/AdwCleaner[C2].txt - [1707 B] - [2016/9/20 18:12:53]
C:/AdwCleaner/AdwCleaner[C3].txt - [1354 B] - [2016/9/28 14:28:40]
C:/AdwCleaner/AdwCleaner[C4].txt - [1503 B] - [2016/10/2 10:0:44]
C:/AdwCleaner/AdwCleaner[C5].txt - [9963 B] - [2016/11/4 0:38:18]
C:/AdwCleaner/AdwCleaner[C6].txt - [2102 B] - [2016/11/15 11:42:40]
C:/AdwCleaner/AdwCleaner[C7].txt - [2381 B] - [2016/11/28 19:18:11]
C:/AdwCleaner/AdwCleaner[C8].txt - [2468 B] - [2016/12/15 17:33:32]
C:/AdwCleaner/AdwCleaner[C9].txt - [3240 B] - [2017/1/16 8:47:55]
C:/AdwCleaner/AdwCleaner[S10].txt - [2196 B] - [2016/11/9 9:1:41]
C:/AdwCleaner/AdwCleaner[S11].txt - [2270 B] - [2016/11/15 11:42:29]
C:/AdwCleaner/AdwCleaner[S12].txt - [2515 B] - [2016/11/28 19:15:23]
C:/AdwCleaner/AdwCleaner[S13].txt - [2602 B] - [2016/12/15 10:13:11]
C:/AdwCleaner/AdwCleaner[S14].txt - [2710 B] - [2016/12/16 9:49:35]
C:/AdwCleaner/AdwCleaner[S15].txt - [2785 B] - [2016/12/30 16:44:39]
C:/AdwCleaner/AdwCleaner[S16].txt - [2859 B] - [2017/1/5 12:27:45]
C:/AdwCleaner/AdwCleaner[S17].txt - [3337 B] - [2017/1/16 8:47:35]
C:/AdwCleaner/AdwCleaner[S18].txt - [3097 B] - [2017/2/3 11:17:24]
C:/AdwCleaner/AdwCleaner[S19].txt - [3347 B] - [2017/2/3 15:56:8]
C:/AdwCleaner/AdwCleaner[S1].txt - [809 B] - [2016/7/21 12:34:46]
C:/AdwCleaner/AdwCleaner[S20].txt - [3416 B] - [2017/3/3 14:43:57]
C:/AdwCleaner/AdwCleaner[S21].txt - [3449 B] - [2017/3/7 19:20:53]
C:/AdwCleaner/AdwCleaner[S22].txt - [3647 B] - [2017/3/15 13:1:59]
C:/AdwCleaner/AdwCleaner[S23].txt - [3671 B] - [2017/3/17 18:44:20]
C:/AdwCleaner/AdwCleaner[S24].txt - [3913 B] - [2017/4/2 12:42:42]
C:/AdwCleaner/AdwCleaner[S25].txt - [4162 B] - [2017/6/5 16:38:10]
C:/AdwCleaner/AdwCleaner[S26].txt - [4236 B] - [2017/6/17 11:46:40]
C:/AdwCleaner/AdwCleaner[S27].txt - [4309 B] - [2017/6/18 16:15:19]
C:/AdwCleaner/AdwCleaner[S28].txt - [4189 B] - [2017/6/21 17:51:48]
C:/AdwCleaner/AdwCleaner[S29].txt - [3974 B] - [2017/6/28 17:11:29]
C:/AdwCleaner/AdwCleaner[S2].txt - [1758 B] - [2016/9/2 22:48:8]
C:/AdwCleaner/AdwCleaner[S3].txt - [1776 B] - [2016/9/20 18:12:25]
C:/AdwCleaner/AdwCleaner[S4].txt - [1522 B] - [2016/9/28 13:55:38]
C:/AdwCleaner/AdwCleaner[S5].txt - [1671 B] - [2016/10/2 10:0:33]
C:/AdwCleaner/AdwCleaner[S6].txt - [1817 B] - [2016/10/6 2:7:2]
C:/AdwCleaner/AdwCleaner[S7].txt - [1887 B] - [2016/10/17 3:6:2]
C:/AdwCleaner/AdwCleaner[S8].txt - [1959 B] - [2016/10/22 0:47:29]
C:/AdwCleaner/AdwCleaner[S9].txt - [10485 B] - [2016/11/4 0:37:40]


########## EOF - C:\AdwCleaner\AdwCleaner[C15].txt ##########
Code:
Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18893
Administrator :: JUERGEN2-PC [administrator]

06.02.2018 12:25:49
mbar-log-2018-02-06 (12-25-49).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 314515
Time elapsed: 57 minute(s), 52 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{EE884B1A-0A33-4F7E-BE89-6C013F4282AB} (Adware.Ghokswa.Generic) -> Data: v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:\Users\juergen2\AppData\Local\IQA\Application\chrome.exe|Name=IQA (mDNS-In)|Desc=Inbound rule for IQA to allow mDNS traffic.|EmbedCtxt=IQA| -> Delete on reboot. [b04c36abb40345f19d0d8988c63ae41c]

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Code:
Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18893
Administrator :: JUERGEN2-PC [administrator]

06.02.2018 12:25:49
mbar-log-2018-02-06 (12-25-49).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 314515
Time elapsed: 57 minute(s), 52 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\FIREWALLRULES|{EE884B1A-0A33-4F7E-BE89-6C013F4282AB} (Adware.Ghokswa.Generic) -> Data: v2.10|Action=Allow|Active=TRUE|Dir=In|Protocol=17|LPort=5353|App=C:\Users\juergen2\AppData\Local\IQA\Application\chrome.exe|Name=IQA (mDNS-In)|Desc=Inbound rule for IQA to allow mDNS traffic.|EmbedCtxt=IQA| -> Delete on reboot. [b04c36abb40345f19d0d8988c63ae41c]

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Code:
Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18893
Administrator :: JUERGEN2-PC [administrator]

06.02.2018 13:39:44
mbar-log-2018-02-06 (13-39-44).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 36288
Time elapsed: 6 minute(s), 46 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Code:
Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.02.06.04
  rootkit: v2018.01.23.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18893
Administrator :: JUERGEN2-PC [administrator]

06.02.2018 13:49:46
mbar-log-2018-02-06 (13-49-46).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 314514
Time elapsed: 1 hour(s), 2 minute(s), 44 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
Code:
Malwarebytes Anti-Rootkit BETA 1.10.3.1001
www.malwarebytes.org

Database version:
  main:    v2018.02.07.02
  rootkit: v2018.01.23.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18893
Administrator :: JUERGEN2-PC [administrator]

07.02.2018 10:38:14
mbar-log-2018-02-07 (10-38-14).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 316075
Time elapsed: 1 hour(s), 9 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
ansonsten scheint das System recht sauber zu sein Danke anyway

cosinus 08.02.2018 00:50
Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!



adwCleaner v7.x

Downloade Dir bitte http://deeprybka.trojaner-board.de/adwcleaner/adwc.pngAdwCleaner auf Deinen Desktop (Bebilderte Anleitung).
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Werkzeuge > Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • Tracing Schlüssel
    • Prefetch Dateien
    • Proxy
    • Winsock
    • IE Richtlinien
    • Chrome Richtlinien
  • Bestätige die Auswahl mit Ok.
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist. Am Ende des Suchlaufs öffnet sich automatisch eine Logdatei. Schließe diese.
  • Klicke nun auf Löschen (auch dann wenn AdwCleaner sagt, dass nichts gefunden wurde) und bestätige auftretende Hinweise mit Ok.
  • Klicke am Ende der Bereinigung auf Jetzt neu starten. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

juergen007 08.02.2018 18:29
OK.
Code:
# AdwCleaner 7.0.7.0 - Logfile created on Thu Feb 08 17:23:21 2018
# Updated on 2018/18/01 by Malwarebytes
# Running on Windows 7 Professional (X64)
# Mode: clean
# Support: https://www.malwarebytes.com/support

***** [ Services ] *****

No malicious services deleted.

***** [ Folders ] *****

No malicious folders deleted.

***** [ Files ] *****

No malicious files deleted.

***** [ DLL ] *****

No malicious DLLs cleaned.

***** [ WMI ] *****

No malicious WMI cleaned.

***** [ Shortcuts ] *****

No malicious shortcuts cleaned.

***** [ Tasks ] *****

No malicious tasks deleted.

***** [ Registry ] *****

No malicious registry entries deleted.

***** [ Firefox (and derivatives) ] *****

Plugin deleted: __MSG_appName__ -


***** [ Chromium (and derivatives) ] *****

No malicious Chromium entries deleted.

*************************

::Tracing keys deleted
::Winsock settings cleared
::Prefetch files deleted
::IE policies deleted
::Chrome policies deleted
::Additional Actions: 0



*************************

C:/AdwCleaner/AdwCleaner[C0].txt - [1601 B] - [2016/9/2 23:20:52]
C:/AdwCleaner/AdwCleaner[C10].txt - [2962 B] - [2017/2/3 11:33:41]
C:/AdwCleaner/AdwCleaner[C11].txt - [3282 B] - [2017/3/3 14:44:46]
C:/AdwCleaner/AdwCleaner[C12].txt - [3513 B] - [2017/3/15 13:2:20]
C:/AdwCleaner/AdwCleaner[C13].txt - [3829 B] - [2017/4/2 12:43:5]
C:/AdwCleaner/AdwCleaner[C14].txt - [4180 B] - [2017/6/18 16:17:28]
C:/AdwCleaner/AdwCleaner[C15].txt - [4066 B] - [2017/6/28 17:14:42]
C:/AdwCleaner/AdwCleaner[C2].txt - [1707 B] - [2016/9/20 18:12:53]
C:/AdwCleaner/AdwCleaner[C3].txt - [1354 B] - [2016/9/28 14:28:40]
C:/AdwCleaner/AdwCleaner[C4].txt - [1503 B] - [2016/10/2 10:0:44]
C:/AdwCleaner/AdwCleaner[C5].txt - [9963 B] - [2016/11/4 0:38:18]
C:/AdwCleaner/AdwCleaner[C6].txt - [2102 B] - [2016/11/15 11:42:40]
C:/AdwCleaner/AdwCleaner[C7].txt - [2381 B] - [2016/11/28 19:18:11]
C:/AdwCleaner/AdwCleaner[C8].txt - [2468 B] - [2016/12/15 17:33:32]
C:/AdwCleaner/AdwCleaner[C9].txt - [3240 B] - [2017/1/16 8:47:55]
C:/AdwCleaner/AdwCleaner[S10].txt - [2196 B] - [2016/11/9 9:1:41]
C:/AdwCleaner/AdwCleaner[S11].txt - [2270 B] - [2016/11/15 11:42:29]
C:/AdwCleaner/AdwCleaner[S12].txt - [2515 B] - [2016/11/28 19:15:23]
C:/AdwCleaner/AdwCleaner[S13].txt - [2602 B] - [2016/12/15 10:13:11]
C:/AdwCleaner/AdwCleaner[S14].txt - [2710 B] - [2016/12/16 9:49:35]
C:/AdwCleaner/AdwCleaner[S15].txt - [2785 B] - [2016/12/30 16:44:39]
C:/AdwCleaner/AdwCleaner[S16].txt - [2859 B] - [2017/1/5 12:27:45]
C:/AdwCleaner/AdwCleaner[S17].txt - [3337 B] - [2017/1/16 8:47:35]
C:/AdwCleaner/AdwCleaner[S18].txt - [3097 B] - [2017/2/3 11:17:24]
C:/AdwCleaner/AdwCleaner[S19].txt - [3347 B] - [2017/2/3 15:56:8]
C:/AdwCleaner/AdwCleaner[S1].txt - [809 B] - [2016/7/21 12:34:46]
C:/AdwCleaner/AdwCleaner[S20].txt - [3416 B] - [2017/3/3 14:43:57]
C:/AdwCleaner/AdwCleaner[S21].txt - [3449 B] - [2017/3/7 19:20:53]
C:/AdwCleaner/AdwCleaner[S22].txt - [3647 B] - [2017/3/15 13:1:59]
C:/AdwCleaner/AdwCleaner[S23].txt - [3671 B] - [2017/3/17 18:44:20]
C:/AdwCleaner/AdwCleaner[S24].txt - [3913 B] - [2017/4/2 12:42:42]
C:/AdwCleaner/AdwCleaner[S25].txt - [4162 B] - [2017/6/5 16:38:10]
C:/AdwCleaner/AdwCleaner[S26].txt - [4236 B] - [2017/6/17 11:46:40]
C:/AdwCleaner/AdwCleaner[S27].txt - [4309 B] - [2017/6/18 16:15:19]
C:/AdwCleaner/AdwCleaner[S28].txt - [4189 B] - [2017/6/21 17:51:48]
C:/AdwCleaner/AdwCleaner[S29].txt - [3974 B] - [2017/6/28 17:11:29]
C:/AdwCleaner/AdwCleaner[S2].txt - [1758 B] - [2016/9/2 22:48:8]
C:/AdwCleaner/AdwCleaner[S3].txt - [1776 B] - [2016/9/20 18:12:25]
C:/AdwCleaner/AdwCleaner[S4].txt - [1522 B] - [2016/9/28 13:55:38]
C:/AdwCleaner/AdwCleaner[S5].txt - [1671 B] - [2016/10/2 10:0:33]
C:/AdwCleaner/AdwCleaner[S6].txt - [1817 B] - [2016/10/6 2:7:2]
C:/AdwCleaner/AdwCleaner[S7].txt - [1887 B] - [2016/10/17 3:6:2]
C:/AdwCleaner/AdwCleaner[S8].txt - [1959 B] - [2016/10/22 0:47:29]
C:/AdwCleaner/AdwCleaner[S9].txt - [10485 B] - [2016/11/4 0:37:40]


########## EOF - C:\AdwCleaner\AdwCleaner[C15].txt ##########

cosinus 08.02.2018 18:53
Ich brauche neue FRST-Logs . Haken setzen bei addition.txt dann auf Untersuchen klicken.

http://www.trojaner-board.de/picture...&pictureid=611

juergen007 09.02.2018 12:34
Jo!


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 08.02.2018
Ran by juergen2 (administrator) on JUERGEN2-PC (09-02-2018 12:17:19)
Running from D:\backupMaxtor80gb\data\FRSTData
Loaded Profiles: juergen2 (Available Profiles: juergen2 & Administrator)
Platform: Windows 7 Professional Service Pack 1 (X64) Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices, Inc.) C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe
() C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(Intel(R) Corporation) C:\Program Files\Intel\BCA\pabeSvc64.exe
(Copyright (c) 2017 Plays.tv, LLC) C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AMDQuickStream.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Ghisler Software GmbH) C:\totalcmd\TOTALCMD.EXE

==================== Registry (Whitelisted) ===========================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NUSB3MON] => C:\Program Files (x86)\ATI Technologies\AMDUSB3DeviceDetector\nusb3mon.exe [97280 2012-04-11] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1353680 2016-11-14] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2015-08-04] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [453736 2013-02-19] (CANON INC.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Run: [AppEx Accelerator UI] => C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [488640 2015-04-06] (AppEx Networks Corporation)
HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Policies\Explorer: [NoThumbNailCache] 1
HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\MountPoints2: F - F:\LaunchU3.exe -a
HKU\S-1-5-21-963683855-2343051469-89585254-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\ssText3d.scr [333824 2010-11-21] (Microsoft Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\TrueKey\McAfeeTrueKeyPasswordFilter

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{4F4DD125-EDDA-44BF-B378-9BAF78A43AC1}: [DhcpNameServer] 192.168.0.1

Internet Explorer:
==================
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page =
HKU\S-1-5-21-963683855-2343051469-89585254-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=SL5M&ocid=SL5MDHP&osmkt=de-at
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll [2012-02-14] (Advanced Micro Devices)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll [2011-06-08] (Advanced Micro Devices)

FireFox:
========
FF ProfilePath: C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 [2018-02-09]
FF Homepage: Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 -> hxxps://www.google.de/
FF NetworkProxy: Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 -> http", "106.38.251.63"
FF Session Restore: Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037 -> is enabled.
FF Extension: (Add HTTPS) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\@add-https.xpi [2018-01-30]
FF Extension: (Avira Browser Safety) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\abs@avira.com [2018-01-11]
FF Extension: (YouTube Video and Audio Downloader) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\feca4b87-3be4-43da-a1b1-137c24220968@jetpack.xpi [2017-05-24] [Legacy]
FF Extension: (Video Downloader professional) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\ffext_basicvideoext@startpage24.xpi [2017-12-11]
FF Extension: (Name) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\firefox@ghostery.com.xpi [2018-02-09]
FF Extension: (HTTPS Everywhere) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\https-everywhere@eff.org.xpi [2018-01-30]
FF Extension: (Google search link fix) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\jid0-XWJxt5VvCXkKzQK99PhZqAn7Xbg@jetpack.xpi [2018-01-10]
FF Extension: (Easy Video Downloader) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\vdpure@link64.xpi [2017-08-21]
FF Extension: (bvd2) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{170503FA-3349-4F17-BC86-001888A5C8E2}.xpi [2017-12-02]
FF Extension: (Adblock Plus) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2017-12-12]
FF Extension: (YouTube Video and Audio Downloader (Dev Edt.)) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{f73df109-8fb4-453e-8373-f59e61ca4da3}.xpi [2017-12-11]
FF Extension: (Adblock Edge) - C:\Users\juergen2\AppData\Roaming\Mozilla\Firefox\Profiles\pxidv9qv.default-1475719002037\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2016-10-06] [Legacy]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_137.dll [2018-01-30] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.6 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2017-05-24] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_28_0_0_137.dll [2018-01-30] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50907.0\npctrl.dll [2017-05-03] ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.33.7\npGoogleUpdate3.dll [2017-11-14] (Google Inc.)

Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Service.exe [344064 2015-08-04] (Advanced Micro Devices, Inc.) [File not signed]
S4 BCWipeSvc; C:\Program Files (x86)\Jetico\BCWipe\BCWipeSvc.exe [90592 2015-12-01] (Jetico, Inc.)
R2 DirMngr; C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [216576 2016-08-18] () [File not signed]
R2 IntelBCAsvc; C:\Program Files\Intel\BCA\pabeSvc64.exe [3026584 2016-05-06] (Intel(R) Corporation)
S4 ManyCam Service; C:\ProgramData\ManyCam\Service\ManyCamService.exe [544984 2016-03-31] (Visicom Media Inc.)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [119864 2016-11-14] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [361816 2016-11-14] (Microsoft Corporation)
R2 PlaysService; C:\Program Files (x86)\Raptr Inc\PlaysTV\plays_service.exe [55000 2017-12-12] (Copyright (c) 2017 Plays.tv, LLC)
S4 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [10803440 2017-08-29] (TeamViewer GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S4 InstallerService; "C:\Program Files\TrueKey\Mcafee.TrueKey.InstallerService.exe" [X]
S3 McComponentHostService; "C:\Program Files\McAfee Security Scan\3.11.667\McCHSvc.exe" [X]
S4 TrueKey; "C:\Program Files\TrueKey\McAfee.TrueKey.Service.exe" [X]
S4 TrueKeyScheduler; "C:\Program Files\TrueKey\McTkSchedulerService.exe" [X]
S3 TrueKeyServiceHelper; "C:\Program Files\TrueKey\McAfee.TrueKey.ServiceHelper.exe" [X]

===================== Drivers (Whitelisted) ======================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 AODDriver4.3; C:\Program Files\AMD\ATI.ACE\Fuel\amd64\AODDriver2.sys [59616 2014-02-11] (Advanced Micro Devices)
R2 APXACC; C:\Windows\System32\DRIVERS\appexDrv.sys [229056 2015-04-03] (AppEx Networks Corporation)
S4 BCSWAP; C:\Windows\System32\Drivers\BCSWAP.sys [94400 2014-11-24] (Jetico, Inc.)
R2 DRHARD64; C:\Windows\system32\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHARD64; C:\Windows\SysWOW64\drivers\DRHARD64.sys [21984 2011-11-03] (Licensed for Gebhard Software)
R2 DRHMSR64; C:\Windows\system32\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R2 DRHMSR64; C:\Windows\SysWOW64\drivers\DRHMSR64.sys [13760 2013-07-21] ()
R0 fsh; C:\Windows\System32\Drivers\fsh.sys [57536 2015-05-19] (Jetico Inc. Oy)
R3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv.sys [49304 2014-12-29] (Visicom Media Inc.)
R3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [35992 2014-12-29] (Visicom Media Inc.)
S3 MftWipeFilter; C:\Windows\System32\Drivers\MftWipeFilter.sys [42632 2015-12-01] (Windows (R) Win 7 DDK provider)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [295000 2016-08-25] (Microsoft Corporation)
R1 MpKsl6dc49900; C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{565A4C4D-987A-42B7-99F3-106A198DE1CC}\MpKsl6dc49900.sys [58120 2018-02-09] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [135928 2016-08-25] (Microsoft Corporation)
R1 veracrypt; C:\Windows\System32\drivers\veracrypt.sys [195416 2015-11-17] (IDRIX)
R2 XilinxPC4Driver; C:\Windows\System32\drivers\xpc4drvr.sys [27384 2016-10-09] (Xilinx, Inc.)
S2 AODDriver4.1; \??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [X]
U3 aswbdisk; no ImagePath
S1 bcbus; system32\DRIVERS\bcbus.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
S3 X6va037; \??\C:\Windows\SysWOW64\Drivers\X6va037 [X]
S1 ZAM; \??\C:\Windows\System32\drivers\zam64.sys [X]
S1 ZAM_Guard; \??\C:\Windows\System32\drivers\zamguard64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-09 11:59 - 2018-02-09 11:59 - 000000021 _____ C:\Windows\S.dirmngr
2018-02-08 20:24 - 2018-02-08 20:24 - 000000000 ____D C:\My Files(juergen-PC)
2018-02-08 18:12 - 2018-02-08 18:10 - 008206624 _____ (Malwarebytes) C:\Users\Administrator\Desktop\adwcleaner_7.0.7.0(3).exe
2018-02-08 16:03 - 2018-02-08 16:03 - 000002220 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Earth Pro.lnk
2018-02-08 16:03 - 2018-02-08 16:03 - 000002182 _____ C:\Users\Public\Desktop\Google Earth Pro.lnk
2018-02-07 10:38 - 2018-02-07 10:38 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\77E7F59C.sys
2018-02-07 07:43 - 2018-02-07 07:43 - 000008189 _____ C:\Users\Administrator\Desktop\export_reply_3.nb
2018-02-07 07:41 - 2018-02-07 07:41 - 000000000 ____D C:\Users\Administrator\Desktop\mathe
2018-02-07 07:36 - 2018-02-07 07:37 - 000000000 ____D C:\Users\juergen2\Desktop\Mathe
2018-02-07 05:35 - 2018-02-07 05:35 - 000000000 ____D C:\Users\juergen2\.QtWebEngineProcess
2018-02-07 05:35 - 2018-02-07 05:35 - 000000000 ____D C:\Users\juergen2\.Plays.tv
2018-02-07 05:33 - 2018-02-07 05:35 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Raptr
2018-02-07 05:33 - 2018-02-07 05:35 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\PlaysTV
2018-02-06 19:52 - 2018-02-06 19:52 - 000000000 ____D C:\Users\Administrator\AppData\Local\AppEx Networks
2018-02-06 18:41 - 2018-02-06 18:41 - 000002015 _____ C:\Users\Public\Desktop\Raptr.lnk
2018-02-06 18:41 - 2018-02-06 18:41 - 000000000 ____D C:\Users\Administrator\.QtWebEngineProcess
2018-02-06 18:41 - 2018-02-06 18:41 - 000000000 ____D C:\Users\Administrator\.Plays.tv
2018-02-06 18:40 - 2018-02-06 22:02 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\PlaysTV
2018-02-06 18:40 - 2018-02-06 18:41 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2018-02-06 18:38 - 2018-02-06 18:39 - 000000000 ____D C:\Program Files (x86)\Raptr Inc
2018-02-06 18:38 - 2018-02-06 18:38 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\library_dir
2018-02-06 18:37 - 2018-02-06 22:02 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Raptr
2018-02-06 18:37 - 2018-02-06 18:37 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Quick Stream
2018-02-06 18:37 - 2018-02-06 18:37 - 000000000 ____D C:\Program Files\AMD Quick Stream
2018-02-06 18:37 - 2015-04-03 01:14 - 000229056 _____ (AppEx Networks Corporation) C:\Windows\system32\Drivers\appexDrv.sys
2018-02-06 18:28 - 2018-02-06 18:28 - 000000000 ____D C:\Users\Administrator\AppData\Local\RadeonInstaller
2018-02-06 18:27 - 2018-02-06 18:27 - 041047112 _____ (AMD Inc.) C:\Users\Administrator\Downloads\radeon-software-adrenalin-18.2.1-minimalsetup-180201_web.exe
2018-02-06 13:49 - 2018-02-06 13:49 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\656387A4.sys
2018-02-06 13:39 - 2018-02-06 13:39 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\3353E5FC.sys
2018-02-06 12:25 - 2018-02-06 12:25 - 000255928 _____ (Malwarebytes) C:\Windows\system32\Drivers\43221302.sys
2018-02-06 12:25 - 2018-02-06 12:25 - 000000000 ____D C:\ProgramData\Malwarebytes
2018-02-06 12:23 - 2018-02-07 12:49 - 000000000 ____D C:\Users\Administrator\Desktop\mbar
2018-02-06 12:23 - 2018-02-07 10:37 - 000192952 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2018-02-06 09:28 - 2018-02-05 11:39 - 000001167 _____ C:\Windows\system32\Reinigung.cmd
2018-02-06 09:28 - 2017-12-24 23:03 - 000001820 _____ C:\Windows\system32\Wartung.cmd
2018-02-06 09:00 - 2018-02-06 09:03 - 000000000 ____D C:\daten
2018-02-06 08:08 - 2018-02-09 12:17 - 000000000 ____D C:\FRST
2018-02-05 23:24 - 2018-02-05 23:41 - 000000000 ___HD C:\~BCWipe.tmp
2018-02-05 18:56 - 2018-02-05 18:56 - 000739464 _____ C:\Users\juergen2\Documents\IMG_20180205_0001.pdf
2018-02-05 11:48 - 2018-02-05 11:48 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BCWipe
2018-02-05 11:47 - 2018-02-05 11:47 - 000000000 ____D C:\Program Files (x86)\Jetico
2018-02-02 15:20 - 2018-02-02 15:20 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\dvdcss
2018-02-02 14:52 - 2018-02-02 14:52 - 000000017 _____ C:\Users\juergen2\AppData\Local\resmon.resmoncfg
2018-02-01 13:05 - 2018-02-01 13:05 - 000001196 _____ C:\Users\Administrator\Desktop\CrystalDiskInfo.lnk
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CrystalDiskInfo
2018-02-01 13:05 - 2018-02-01 13:05 - 000000000 ____D C:\Program Files (x86)\CrystalDiskInfo
2018-02-01 12:01 - 2018-02-05 11:39 - 000001167 _____ C:\Windows\SysWOW64\Reinigung.cmd
2018-02-01 12:01 - 2017-12-24 23:03 - 000001820 _____ C:\Windows\SysWOW64\Wartung.cmd
2018-02-01 00:23 - 2018-02-01 00:23 - 000000000 ____D C:\Users\juergen2\PDF
2018-01-31 23:58 - 2018-01-31 23:58 - 000000181 _____ C:\Users\juergen2\Documents\slashesversion.gp
2018-01-31 22:17 - 2018-01-31 22:17 - 000000142 _____ C:\Users\juergen2\new2.gp
2018-01-31 22:00 - 2018-01-31 21:57 - 000000096 _____ C:\Users\juergen2\Documents\new.txt
2018-01-31 21:17 - 2018-02-01 00:12 - 000007841 _____ C:\Users\juergen2\Documents11.pdf
2018-01-30 23:39 - 2018-01-30 23:40 - 000000127 _____ C:\Users\juergen2\Documents\anmachenFilipina.txt
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Windows\system32\Macromed
2018-01-30 20:47 - 2018-01-30 20:47 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Macromedia
2018-01-29 22:31 - 2018-02-04 13:04 - 000004740 _____ C:\Users\juergen2\Documents\23.txt
2018-01-29 22:11 - 2018-01-30 23:09 - 000003173 _____ C:\Users\juergen2\Documents\13.txt
2018-01-29 22:09 - 2018-01-29 22:09 - 001332457 _____ C:\Users\juergen2\Documents\1013.txt
2018-01-29 21:01 - 2018-01-29 21:58 - 000003016 _____ C:\Users\juergen2\Desktop\mmmma.txt
2018-01-28 23:59 - 2018-01-28 23:59 - 000001182 _____ C:\Users\juergen2\Desktop\MailWasherPro.lnk
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Firetrust
2018-01-28 23:59 - 2018-01-28 23:59 - 000000000 ____D C:\Program Files (x86)\Firetrust
2018-01-28 23:58 - 2018-01-29 00:00 - 000000000 ____D C:\ProgramData\Firetrust
2018-01-28 12:57 - 2018-01-31 21:20 - 000000000 ____D C:\Users\juergen2\Documents\Wolfram Mathematica
2018-01-28 12:57 - 2018-01-29 19:37 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Mathematica
2018-01-28 12:57 - 2018-01-28 12:58 - 000000000 ____D C:\Users\juergen2\AppData\Local\Mathematica
2018-01-28 12:57 - 2018-01-28 12:57 - 000000000 ____D C:\Users\juergen2\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-02-07 07:42 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\Mathematica
2018-01-27 12:34 - 2018-02-07 07:41 - 000000000 ____D C:\Users\Administrator\AppData\Local\Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\Documents\Wolfram Mathematica
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram
2018-01-27 12:34 - 2018-01-27 12:34 - 000000000 ____D C:\ProgramData\Mathematica
2018-01-27 12:30 - 2018-01-27 12:30 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram Mathematica 11.2
2018-01-27 12:27 - 2018-01-27 12:27 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\OpenOffice
2018-01-27 12:17 - 2018-01-27 12:17 - 000000000 ____D C:\Program Files\Wolfram Research
2018-01-27 12:00 - 2018-01-27 12:03 - 000000000 ____D C:\Users\Administrator\Downloads\M-WIN-L-11.2.0-5822651
2018-01-27 12:00 - 2018-01-27 12:00 - 000000000 ____D C:\Users\Administrator\AppData\Local\Wolfram Research
2018-01-18 14:27 - 2018-01-18 14:27 - 000002077 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files\Microsoft Security Client
2018-01-18 14:27 - 2018-01-18 14:27 - 000000000 ____D C:\Program Files (x86)\Microsoft Security Client
2018-01-12 13:00 - 2018-01-01 03:21 - 005581544 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 001680616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000948968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000708328 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2018-01-12 13:00 - 2018-01-01 03:21 - 000288488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fltMgr.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000262376 _____ (Microsoft Corporation) C:\Windows\system32\hal.dll
2018-01-12 13:00 - 2018-01-01 03:21 - 000213736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdyboost.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000154856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2018-01-12 13:00 - 2018-01-01 03:21 - 000114408 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2018-01-12 13:00 - 2018-01-01 03:21 - 000095464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2018-01-12 13:00 - 2018-01-01 03:19 - 001665384 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 014183936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002066432 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 002004480 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001942016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001867776 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001741312 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001361408 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistSvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001212928 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 001110528 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000977408 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000961024 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000880640 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000863232 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000842752 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000828928 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000749568 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000731648 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000705024 _____ (Microsoft Corporation) C:\Windows\system32\BFE.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000690688 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000512000 _____ (Microsoft Corporation) C:\Windows\system32\rpcss.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000473600 _____ (Microsoft Corporation) C:\Windows\system32\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000463872 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000444928 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000439296 _____ (Microsoft Corporation) C:\Windows\system32\p2psvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000419840 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000366592 _____ (Microsoft Corporation) C:\Windows\system32\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000361984 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000345600 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000327168 _____ (Microsoft Corporation) C:\Windows\system32\pnrpsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:18 - 000316928 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000312320 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000264704 _____ (Microsoft Corporation) C:\Windows\system32\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000223232 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000215552 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000210432 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000190464 _____ (Microsoft Corporation) C:\Windows\system32\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000181760 _____ (Microsoft Corporation) C:\Windows\system32\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistWSDDiscoProv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000123904 _____ (Microsoft Corporation) C:\Windows\system32\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000120320 _____ (Microsoft Corporation) C:\Windows\system32\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000108544 _____ (Microsoft Corporation) C:\Windows\system32\icfupgd.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000101376 _____ (Microsoft Corporation) C:\Windows\system32\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000095744 _____ (Microsoft Corporation) C:\Windows\system32\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000084480 _____ (Microsoft Corporation) C:\Windows\system32\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000076288 _____ (Microsoft Corporation) C:\Windows\system32\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000060928 _____ (Microsoft Corporation) C:\Windows\system32\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000059904 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000053760 _____ (Microsoft Corporation) C:\Windows\system32\vmicres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000051200 _____ (Microsoft Corporation) C:\Windows\system32\PeerDistHttpTrans.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000047104 _____ (Microsoft Corporation) C:\Windows\system32\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 03:18 - 000044032 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000043520 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000039424 _____ (Microsoft Corporation) C:\Windows\system32\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000034816 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000029696 _____ (Microsoft Corporation) C:\Windows\system32\rasser.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000026112 _____ (Microsoft Corporation) C:\Windows\system32\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024576 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022528 _____ (Microsoft Corporation) C:\Windows\system32\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016896 _____ (Microsoft Corporation) C:\Windows\system32\wshqos.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wshnetbs.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000008704 _____ (Microsoft Corporation) C:\Windows\system32\comcat.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 03:18 - 000002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 03:13 - 000631680 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2018-01-12 13:00 - 2018-01-01 03:04 - 000559616 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2018-01-12 13:00 - 2018-01-01 03:02 - 001314112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 012880384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001499648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001417728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001390080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 001114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000741888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000666112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000554496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000463360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000351744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winhttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000304640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\taskcomp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000276992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wcncsvc.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000275456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000261120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000254464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000217600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\P2P.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2018-01-12 13:00 - 2018-01-01 03:00 - 000172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000162304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000141312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpchttp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000139776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PeerDist.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000084480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\INETRES.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\bcrypt.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fdWCN.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rascfg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasdiag.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ndptsp.tsp
2018-01-12 13:00 - 2018-01-01 03:00 - 000043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\traffic.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000026112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleres.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2018-01-12 13:00 - 2018-01-01 03:00 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 001806848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000644096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000342528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000309760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:59 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:55 - 000131584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pacer.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000088576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wanarp.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000058368 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndproxy.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000045056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netbios.sys
2018-01-12 13:00 - 2018-01-01 02:55 - 000024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndistapi.sys
2018-01-12 13:00 - 2018-01-01 02:54 - 004013800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 003959016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2018-01-12 13:00 - 2018-01-01 02:54 - 000077312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2018-01-12 13:00 - 2018-01-01 02:50 - 000455680 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000148480 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:49 - 000062464 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2018-01-12 13:00 - 2018-01-01 02:49 - 000017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2018-01-12 13:00 - 2018-01-01 02:47 - 000244224 _____ (Microsoft Corporation) C:\Windows\system32\vmicsvc.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2018-01-12 13:00 - 2018-01-01 02:46 - 000128512 _____ (Microsoft Corporation) C:\Windows\system32\IcCoinstall.dll
2018-01-12 13:00 - 2018-01-01 02:46 - 000051712 _____ (Microsoft Corporation) C:\Windows\system32\vmictimeprovider.dll
2018-01-12 13:00 - 2018-01-01 02:45 - 000296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2018-01-12 13:00 - 2018-01-01 02:43 - 000086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnApi.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000038912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kmddsp.tsp
2018-01-12 13:00 - 2018-01-01 02:43 - 000033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasmxs.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000022528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rasser.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000020480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapPeerProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000019968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcnEapAuthProxy.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wfapigp.dll
2018-01-12 13:00 - 2018-01-01 02:43 - 000013824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshqos.dll
2018-01-12 13:00 - 2018-01-01 02:42 - 000460288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000406016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2018-01-12 13:00 - 2018-01-01 02:42 - 000159744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000754176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000291328 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000129536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000106496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dfsc.sys
2018-01-12 13:00 - 2018-01-01 02:41 - 000030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2018-01-12 13:00 - 2018-01-01 02:41 - 000007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comcat.dll
2018-01-12 13:00 - 2018-01-01 02:39 - 000050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2018-01-12 13:00 - 2018-01-01 02:36 - 000007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2018-01-12 13:00 - 2018-01-01 02:36 - 000002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2018-01-12 13:00 - 2018-01-01 02:35 - 000036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2018-01-12 13:00 - 2018-01-01 02:35 - 000003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2018-01-12 13:00 - 2017-12-30 08:29 - 000395968 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2018-01-12 13:00 - 2017-12-30 07:42 - 000347328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2018-01-12 13:00 - 2017-12-29 19:39 - 020274688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2018-01-12 13:00 - 2017-12-29 19:24 - 002724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 19:13 - 000499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2018-01-12 13:00 - 2017-12-29 19:13 - 000062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2018-01-12 13:00 - 2017-12-29 19:12 - 000341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2018-01-12 13:00 - 2017-12-29 19:12 - 000047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 19:11 - 000064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 19:09 - 002294272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 19:06 - 000030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2018-01-12 13:00 - 2017-12-29 19:04 - 000476160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000662528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 19:03 - 000115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 18:55 - 000416256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 18:51 - 000060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000091136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2018-01-12 13:00 - 2017-12-29 18:50 - 000073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2018-01-12 13:00 - 2017-12-29 18:47 - 000168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2018-01-12 13:00 - 2017-12-29 18:47 - 000076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 18:46 - 000279040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 18:45 - 004508160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2018-01-12 13:00 - 2017-12-29 18:44 - 000130048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2018-01-12 13:00 - 2017-12-29 18:39 - 000230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 013680128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2018-01-12 13:00 - 2017-12-29 18:38 - 000694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 18:37 - 002058752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 18:36 - 001155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 18:19 - 002767872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2018-01-12 13:00 - 2017-12-29 18:15 - 001313792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2018-01-12 13:00 - 2017-12-29 18:13 - 000710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2018-01-12 13:00 - 2017-12-29 10:15 - 025737728 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2018-01-12 13:00 - 2017-12-29 10:04 - 002724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2018-01-12 13:00 - 2017-12-29 10:04 - 000004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2018-01-12 13:00 - 2017-12-29 09:52 - 002900480 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 005796352 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2018-01-12 13:00 - 2017-12-29 09:51 - 000066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000577024 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2018-01-12 13:00 - 2017-12-29 09:50 - 000088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2018-01-12 13:00 - 2017-12-29 09:50 - 000048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2018-01-12 13:00 - 2017-12-29 09:44 - 000054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2018-01-12 13:00 - 2017-12-29 09:43 - 000034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2018-01-12 13:00 - 2017-12-29 09:40 - 000615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000817152 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2018-01-12 13:00 - 2017-12-29 09:39 - 000144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2018-01-12 13:00 - 2017-12-29 09:39 - 000116224 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2018-01-12 13:00 - 2017-12-29 09:32 - 000969216 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2018-01-12 13:00 - 2017-12-29 09:28 - 000489984 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2018-01-12 13:00 - 2017-12-29 09:22 - 000087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2018-01-12 13:00 - 2017-12-29 09:22 - 000077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2018-01-12 13:00 - 2017-12-29 09:21 - 000107520 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2018-01-12 13:00 - 2017-12-29 09:18 - 000092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2018-01-12 13:00 - 2017-12-29 09:16 - 000315392 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2018-01-12 13:00 - 2017-12-29 09:14 - 000152064 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2018-01-12 13:00 - 2017-12-29 09:05 - 000262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2018-01-12 13:00 - 2017-12-29 09:04 - 015284224 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000807936 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2018-01-12 13:00 - 2017-12-29 09:03 - 000726528 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2018-01-12 13:00 - 2017-12-29 09:01 - 002134528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2018-01-12 13:00 - 2017-12-29 09:01 - 001359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2018-01-12 13:00 - 2017-12-29 08:50 - 003241472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2018-01-12 13:00 - 2017-12-29 08:39 - 001545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2018-01-12 13:00 - 2017-12-29 08:27 - 000800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2018-01-12 13:00 - 2017-12-21 07:27 - 000634312 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2018-01-12 13:00 - 2017-12-13 17:31 - 000383720 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:27 - 000014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2018-01-12 13:00 - 2017-12-13 17:15 - 000309480 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000071168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2018-01-12 13:00 - 2017-12-13 17:11 - 000010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2018-01-12 13:00 - 2017-12-13 16:50 - 000034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000625664 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000250880 _____ (Microsoft Corporation) C:\Windows\system32\icm32.dll
2018-01-12 13:00 - 2017-12-05 18:36 - 000040960 _____ (Microsoft Corporation) C:\Windows\system32\WcsPlugInService.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000481792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2018-01-12 13:00 - 2017-12-05 18:08 - 000215040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icm32.dll
2018-01-12 13:00 - 2017-12-05 16:59 - 003222528 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2018-01-12 13:00 - 2017-12-05 16:49 - 000032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WcsPlugInService.dll
2018-01-11 17:13 - 2018-01-11 17:42 - 000000000 ____D C:\recov
2018-01-11 12:43 - 2018-01-11 12:43 - 000000000 ____H C:\Windows\system32\Drivers\Msft_Kernel_avusbflt_01011.Wdf

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2018-02-09 12:14 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2018-02-09 12:14 - 2009-07-14 05:45 - 000021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2018-02-09 12:03 - 2015-11-02 13:24 - 002191246 _____ C:\Windows\ntbtlog.txt
2018-02-09 12:02 - 2016-11-19 14:58 - 000000000 ____D C:\Users\juergen2\AppData\LocalLow\Mozilla
2018-02-09 11:59 - 2009-07-14 06:08 - 000000006 ____H C:\Windows\Tasks\SA.DAT
2018-02-08 19:53 - 2015-11-01 11:12 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\vlc
2018-02-08 18:27 - 2017-01-04 21:53 - 000000000 ____D C:\Users\Administrator\AppData\LocalLow\Mozilla
2018-02-08 18:15 - 2016-07-21 13:33 - 000000000 ____D C:\AdwCleaner
2018-02-08 16:03 - 2015-12-21 20:28 - 000000000 ____D C:\Program Files (x86)\Google
2018-02-08 16:02 - 2017-10-30 10:23 - 000002048 _____ C:\Users\Public\Desktop\Google Slides.lnk
2018-02-08 16:02 - 2017-10-30 10:23 - 000002046 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2018-02-08 16:02 - 2017-10-30 10:23 - 000002036 _____ C:\Users\Public\Desktop\Google Docs.lnk
2018-02-08 16:02 - 2017-10-30 10:23 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Backup and Sync from Google
2018-02-07 13:34 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\inf
2018-02-07 12:49 - 2016-07-15 12:40 - 000000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2018-02-07 06:27 - 2016-08-18 13:38 - 000000981 _____ C:\Users\juergen2\Desktop\PARI.lnk
2018-02-07 05:35 - 2015-10-31 22:01 - 000000000 ____D C:\Users\juergen2
2018-02-06 23:32 - 2017-01-04 18:02 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\gnupg
2018-02-06 18:41 - 2017-01-03 13:31 - 000000000 ____D C:\Users\Administrator
2018-02-06 18:36 - 2015-11-01 09:41 - 000000000 ____D C:\ProgramData\Package Cache
2018-02-06 18:30 - 2015-11-01 09:39 - 000000000 ____D C:\AMD
2018-02-06 14:06 - 2015-10-31 22:15 - 000065744 _____ C:\Users\juergen2\AppData\Local\GDIPFONTCACHEV1.DAT
2018-02-06 12:17 - 2017-01-03 13:32 - 000000000 ____D C:\Users\Administrator\AppData\Local\Google
2018-02-06 11:39 - 2017-01-03 13:33 - 000065744 _____ C:\Users\Administrator\AppData\Local\GDIPFONTCACHEV1.DAT
2018-02-06 11:38 - 2009-07-14 05:45 - 000291024 _____ C:\Windows\system32\FNTCACHE.DAT
2018-02-06 09:46 - 2009-07-14 04:20 - 000000000 __RSD C:\Windows\Media
2018-02-06 08:54 - 2016-05-16 15:01 - 000000000 ____D C:\Program Files\TrueKey
2018-02-06 08:50 - 2015-12-21 20:28 - 000000000 ____D C:\Users\juergen2\AppData\Local\Google
2018-02-06 08:47 - 2016-10-02 17:45 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\NCH Software
2018-02-05 20:47 - 2017-05-10 13:31 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\Electrum
2018-02-05 18:04 - 2015-11-13 17:07 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\IrfanView
2018-02-05 16:25 - 2016-11-18 20:36 - 000000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2018-02-05 16:25 - 2015-10-31 22:35 - 000000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2018-02-05 13:03 - 2015-11-01 08:53 - 000000000 ____D C:\xampp
2018-02-05 11:25 - 2016-07-21 13:39 - 000002177 _____ C:\Users\juergen2\Desktop\JRT.txt
2018-02-04 12:23 - 2017-11-16 22:48 - 000000000 ____D C:\Users\juergen2\AppData\Local\CrashDumps
2018-02-03 16:54 - 2015-11-14 12:57 - 000075264 _____ C:\Users\juergen2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2018-02-03 15:38 - 2016-02-24 19:10 - 000000000 ____D C:\div
2018-02-03 15:38 - 2015-10-31 22:30 - 000000000 ____D C:\datas
2018-02-03 15:07 - 2016-01-24 16:00 - 000000000 ____D C:\Users\juergen2\AppData\Local\QuickPar
2018-02-03 12:24 - 2009-07-14 06:13 - 000781790 _____ C:\Windows\system32\PerfStringBackup.INI
2018-02-02 15:15 - 2017-01-04 14:10 - 000000000 ____D C:\Users\Administrator\AppData\Roaming\vlc
2018-02-02 11:04 - 2009-07-14 06:32 - 000000000 ____D C:\Windows\system32\FxsTmp
2018-02-01 08:16 - 2016-10-09 09:50 - 000000000 ____D C:\Windows\Minidump
2018-01-31 22:34 - 2016-08-18 19:24 - 000000000 ____D C:\tmp
2018-01-31 22:19 - 2016-08-18 13:37 - 000000000 ____D C:\Program Files (x86)\Pari-2-7-6
2018-01-30 20:56 - 2015-11-01 10:23 - 000000000 ____D C:\Users\juergen2\AppData\Local\Adobe
2018-01-30 20:47 - 2016-02-17 17:00 - 000803328 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2018-01-30 20:47 - 2015-11-01 10:23 - 000144896 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2018-01-30 20:47 - 2015-11-01 10:23 - 000000000 ____D C:\Windows\SysWOW64\Macromed
2018-01-30 20:06 - 2017-08-26 17:12 - 000000000 ____D C:\Program Files (x86)\Mozilla Firefox
2018-01-28 21:35 - 2015-11-15 10:42 - 000000000 ____D C:\vhd
2018-01-26 12:50 - 2015-11-15 10:22 - 000000000 ____D C:\Users\juergen2\AppData\Roaming\gnupg
2018-01-25 00:48 - 2017-06-30 15:19 - 000004100 _____ C:\Windows\System32\Tasks\Opera scheduled Autoupdate 1498067933
2018-01-23 19:58 - 2010-11-21 04:27 - 000548000 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2018-01-19 14:22 - 2015-11-01 09:42 - 000765656 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2018-01-18 14:27 - 2016-05-12 18:47 - 000001945 _____ C:\Windows\epplauncher.mif
2018-01-18 14:04 - 2009-07-14 06:08 - 000032620 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2018-01-15 11:23 - 2017-12-10 15:05 - 000001302 _____ C:\Users\Public\Desktop\Skype.lnk
2018-01-15 11:23 - 2017-12-10 15:05 - 000000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2018-01-12 17:49 - 2009-07-14 04:20 - 000000000 ____D C:\Windows\rescache
2018-01-11 16:30 - 2017-12-30 15:22 - 000000000 ____D C:\Program Files\Recuva
2018-01-11 14:15 - 2011-04-12 09:28 - 000000000 ___RD C:\Users\Public\Recorded TV
2018-01-11 02:00 - 2015-11-01 12:47 - 000000000 ____D C:\Windows\system32\MRT
2018-01-11 01:56 - 2017-10-12 02:06 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT-KB890830.exe
2018-01-11 01:56 - 2015-11-01 12:47 - 129365736 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe

==================== Files in the root of some directories =======

2016-03-04 22:10 - 2016-06-19 15:31 - 000000080 _____ () C:\Users\juergen2\AppData\Roaming\mBot.ini
2016-11-24 22:46 - 2017-10-30 10:35 - 000000600 _____ () C:\Users\juergen2\AppData\Roaming\winscp.rnd
2015-11-14 12:57 - 2018-02-03 16:54 - 000075264 _____ () C:\Users\juergen2\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2016-10-31 15:54 - 2017-09-12 19:13 - 000000600 _____ () C:\Users\juergen2\AppData\Local\PUTTY.RND
2016-09-04 11:50 - 2016-09-04 11:50 - 000001192 _____ () C:\Users\juergen2\AppData\Local\recently-used.xbel
2018-02-02 14:52 - 2018-02-02 14:52 - 000000017 _____ () C:\Users\juergen2\AppData\Local\resmon.resmoncfg

Some files in TEMP:
====================
2018-02-06 18:39 - 2018-02-06 18:40 - 116708576 _____ () C:\Users\Administrator\AppData\Local\Temp\playstv_patch.exe
2018-02-06 18:37 - 2018-02-06 18:38 - 059432328 _____ () C:\Users\Administrator\AppData\Local\Temp\raptrpatch.exe
2018-02-06 18:37 - 2018-02-06 18:37 - 000221632 _____ () C:\Users\Administrator\AppData\Local\Temp\raptr_stub.exe

==================== Bamital & volsnap ======================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\dnsapi.dll => File is digitally signed
C:\Windows\SysWOW64\dnsapi.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2018-02-07 12:31

==================== End of FRST.txt ============================
--- --- ---

--- --- ---

juergen007 09.02.2018 12:37
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08.02.2018
Ran by juergen2 (09-02-2018 12:23:19)
Running from D:\backupMaxtor80gb\data\FRSTData
Windows 7 Professional Service Pack 1 (X64) (2015-10-31 21:00:58)
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-963683855-2343051469-89585254-500 - Administrator - Enabled) => C:\Users\Administrator
Guest (S-1-5-21-963683855-2343051469-89585254-501 - Limited - Disabled)
juergen2 (S-1-5-21-963683855-2343051469-89585254-1000 - Administrator - Enabled) => C:\Users\juergen2

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {71A27EC9-3DA6-45FC-60A7-004F623C6189}
AS: Microsoft Security Essentials (Enabled - Up to date) {CAC39F2D-1B9C-4A72-5A17-3B3D19BB2B34}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 28 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 28.0.0.137 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (HKLM\...\{F15287C6-10E3-1676-AF50-CB0355A302F1}) (Version: 2.00.0002 - Advanced Micro Devices, Inc.)
AMD APP SDK Runtime (HKLM\...\{503F672D-6C84-448A-8F8F-4BC35AC83441}) (Version: 10.0.873.1 - Advanced Micro Devices Inc.)
AMD Catalyst Install Manager (HKLM\...\{7E5DC2C5-115A-322B-976C-219237FAED66}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (HKLM\...\{CF84CD21-FC52-857E-AF41-9DEE9C76D245}) (Version: 2.00.0000 - Advanced Micro Devices, Inc.)
AMD Fuel (HKLM\...\{AA20E9E6-96D0-C201-E44D-F7D921F595FD}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
AMD Quick Stream (HKLM\...\{E9EED4AE-682B-4501-9574-D09A21717599}_is1) (Version: 4.0.0.0 - AppEx Networks)
AMD USB 3.0 Device Detector (HKLM\...\{F5733897-B788-4AB1-B399-166A9FBB47A8}) (Version: 2.1.30.0 - Advanced Micro Devices, Inc.)
AMD Wireless Display v3.0 (HKLM\...\{630E5EF7-72F8-9E5D-BEF5-ED85B698E160}) (Version: 1.0.0.15 - Advanced Micro Devices, Inc.)
Arasan 20.2 (HKLM-x32\...\Arasan_is1) (Version:  - )
Backup and Sync from Google (HKLM-x32\...\{AC62F3F2-61A2-4357-93EC-C308E3FEDF4E}) (Version: 3.39.8370.7843 - Google, Inc.)
BCWipe 6.0 (HKLM-x32\...\BCWipe) (Version: 6.08.3 - Jetico Inc.)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - Canon Inc.)
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.3.0 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - Canon Inc.)
Canon Inkjet Printer Driver Add-On Module (HKLM\...\CANONIJINBOXADDON100) (Version:  - )
Canon MG5500 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5500_series) (Version: 1.02 - Canon Inc.)
Catalyst Control Center Graphics Previews Common (HKLM-x32\...\{9114BDDB-A6A6-152D-060A-E99307057AD1}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Catalyst Control Center Localization All (HKLM-x32\...\{315D9E6B-98B1-1E2B-9E93-B36A0B104224}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Standard (HKLM-x32\...\{703F229F-573E-10E7-3B44-341DB59AD86B}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Chinese Traditional (HKLM-x32\...\{489E5436-B101-CAD9-5571-14746675ECE3}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Czech (HKLM-x32\...\{BBA1614E-6470-7841-8A42-ABD5BA7B3FFE}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Danish (HKLM-x32\...\{AA0E1433-8F16-AA01-E8E9-E6408579D0D8}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Dutch (HKLM-x32\...\{504819D1-3C0A-2695-0007-BBDFA5936D68}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help English (HKLM-x32\...\{6C495748-5F03-0B97-568B-76D0368FB460}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Finnish (HKLM-x32\...\{D9CBA021-DB41-9736-923F-52E3E426912D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help French (HKLM-x32\...\{B03A580A-5D67-DAC5-59A1-7AD7C513381C}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help German (HKLM-x32\...\{69DF4822-9B16-CE04-7587-22E09FB5FD1D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Greek (HKLM-x32\...\{968C0E92-6DA9-5784-9A0B-1061D0CB2C14}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Hungarian (HKLM-x32\...\{11BC8F83-7260-65EB-3E0A-FA7AC894B42D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Italian (HKLM-x32\...\{FE4DC915-D724-E72C-EF86-DC5B89961ACF}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Japanese (HKLM-x32\...\{C9353DBC-A47C-2C9B-AF32-5E2C8B4E3D3A}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Korean (HKLM-x32\...\{37DBC990-C514-3821-D6FB-12E0745AA990}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Norwegian (HKLM-x32\...\{79E3071B-8A0C-C105-6442-CF611732601E}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Polish (HKLM-x32\...\{A12E8E1A-A77D-94E5-72F8-E83D6256AF11}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Portuguese (HKLM-x32\...\{AD5E3969-F0C0-ECBF-45E5-C36B84904281}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Russian (HKLM-x32\...\{CFA2067C-AE90-3BF9-06AF-E7E65E679B3D}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Spanish (HKLM-x32\...\{110E4EE7-85A9-B76B-B943-C0C1CF0C2F74}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Swedish (HKLM-x32\...\{42A97797-A255-49F9-4250-D58A9CEA2904}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Thai (HKLM-x32\...\{31BC0B51-0676-A531-3940-1818B609EEA7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
CCC Help Turkish (HKLM-x32\...\{9DB45EC2-90E7-642D-7CF9-5AC2FBDC14F7}) (Version: 2015.0804.0020.41908 - Advanced Micro Devices, Inc.)
ccc-utility64 (HKLM\...\{C3463F9A-E635-02E0-C351-41D16074E202}) (Version: 2015.0804.21.41908 - Advanced Micro Devices, Inc.)
Convert XLS (HKLM-x32\...\Convert XLS_is1) (Version:  - Softinterface, Inc.)
CrystalDiskInfo 7.5.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 7.5.1 - Crystal Dew World)
Dr. Hardware 2015 15.5d (HKLM-x32\...\Dr. Hardware 2015_is1) (Version:  - Peter A. Gebhard)
Electrum (HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Electrum) (Version: 2.8.2 - Electrum Technologies GmbH)
Free Pascal 3.0.0 (HKLM-x32\...\FreePascal_is1) (Version:  - Free Pascal Team)
GeoGebra 5 (HKLM-x32\...\GeoGebra 5) (Version: 5.0.195.0 - International GeoGebra Institute)
Google Earth Pro (HKLM-x32\...\{FA1BBF34-E994-4310-95D7-BE93092B8E61}) (Version: 7.3.1.4507 - Google)
Google Update Helper (HKLM-x32\...\{60EC980A-BDA2-4CB6-A427-B07A5498B4CA}) (Version: 1.3.33.7 - Google Inc.) Hidden
Gpg4win (2.3.3) (HKLM-x32\...\GPG4Win) (Version: 2.3.3 - The Gpg4win Project)
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.09) (Version: 9.09 - Artifex Software Inc.)
GUI Turbo Assembler Ver 3.0.1 (HKLM-x32\...\{F522C947-52FA-4C01-B933-16292944E000}) (Version: 3.0.1 - Lakhya's Innovation Inc.)
Intel Security True Key (HKLM\...\TrueKey) (Version: 4.4.135.1 - Intel Security)
IrfanView 64 (remove only) (HKLM\...\IrfanView) (Version: 4.40 - Irfan Skiljan)
Lazarus 1.6.2 (HKLM\...\lazarus_is1) (Version: 1.6.2 - Lazarus Team)
MailWasherPro (HKLM-x32\...\{D16B61A0-A55E-47A9-BA73-8A5E92C26DB2}) (Version: 7.11.05 - Firetrust)
ManyCam 5.3.0 (HKLM-x32\...\ManyCam) (Version: 5.3.0 - Visicom Media Inc.)
Microsoft .NET Framework 4.7 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.7.02053 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.10.209.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50907.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24215 (HKLM-x32\...\{e2803110-78b3-4664-a479-3611a381656a}) (Version: 14.0.24215.1 - Microsoft Corporation)
Mozilla Firefox 58.0.1 (x64 de) (HKLM\...\Mozilla Firefox 58.0.1 (x64 de)) (Version: 58.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 53.0.3 - Mozilla)
Mozilla Thunderbird 52.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 52.6.0 (x86 de)) (Version: 52.6.0 - Mozilla)
Notepad++ (32-bit x86) (HKLM-x32\...\Notepad++) (Version: 7.5.4 - Notepad++ Team)
Opera Stable 50.0.2762.67 (HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\Opera 50.0.2762.67) (Version: 50.0.2762.67 - Opera Software)
Pari-2-7-6 (remove only) (HKLM-x32\...\Pari-2-7-6) (Version:  - )
PC Inspector File Recovery (HKLM-x32\...\{0DD140D3-9563-481E-AA75-BA457CBDAEF2}) (Version: 4.0 - )
PilotEdit Lite 10.7.0 (HKLM-x32\...\PilotEdit Lite_is1) (Version:  - )
PlaysTV (HKLM-x32\...\PlaysTV) (Version: 1.27.5-r125535-release - Plays.tv, LLC)
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Raptr (HKLM-x32\...\Raptr) (Version: 5.2.10-r123135-release - Raptr, Inc)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.92.115.2015 - Realtek)
Recuva (HKLM\...\Recuva) (Version: 1.53 - Piriform)
Revo Uninstaller 2.0.4 (HKLM\...\{A28DBDA2-3CC7-4ADC-8BFE-66D7743C6C97}_is1) (Version: 2.0.4 - VS Revo Group, Ltd.)
Scid vs PC 4.16 (HKLM-x32\...\Scid vs PC_is1) (Version: 4.16 - Steven Atkinson)
SharpKeys (HKLM\...\{F6908C45-459A-4332-A3F2-03DAAB64939D}) (Version: 3.6.0000 - RandyRants.com)
Shotcut (HKLM-x32\...\Shotcut) (Version:  - )
Skype version 8.13 (HKLM-x32\...\Skype_is1) (Version: 8.13 - Skype Technologies S.A.)
TeamViewer 12 (HKLM-x32\...\TeamViewer) (Version: 12.0.83369 - TeamViewer)
Total Commander 64-bit (Remove or Repair) (HKLM-x32\...\Totalcmd64) (Version: 9.0a - Ghisler Software GmbH)
VeraCrypt (HKLM-x32\...\VeraCrypt) (Version: 1.16 - IDRIX)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.6 - VideoLAN)
Web Companion (HKLM-x32\...\{37c882f6-40f7-46a4-9ccb-8e2808e1a79e}) (Version: 2.4.1558.3001 - Lavasoft)
WinRAR 5.40 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.40.0 - win.rar GmbH)
Wolfram Mathematica 11.2 (M-WIN-L 11.2.0 5822651) (HKLM\...\M-WIN-L 11.2.0 5822651_is1) (Version: 11.2.0 - Wolfram Research, Inc.)
Wondershare Data Recovery(Build 6.5.1.5) (HKLM-x32\...\{FEA3976F-D621-45F3-AFBD-E812A1F2F00D}_is1) (Version: 6.5.1.5 - Wondershare Software Co.,Ltd.)
Wondershare Helper Compact 2.5.2 (HKLM-x32\...\{5363CE84-5F09-48A1-8B6C-6BB590FFEDF2}_is1) (Version: 2.5.2 - Wondershare)
Xaldon WebSpider2 (HKLM-x32\...\WebSpider2) (Version:  - )
Xilinx Design Tools Vivado HL WebPACK 2016.3 (C:\Xilinx) (HKLM\...\Xilinx_Vivado HL WebPACK_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx DocNav (C:\Xilinx) (HKLM\...\Xilinx_DocNav_2016.3#0) (Version: 2016.3 - Xilinx Inc.)
Xilinx Information Center (C:\Xilinx) (HKLM\...\Xilinx_Xilinx Information Center_2016.3#0) (Version: 2016.3 - Xilinx Inc.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2018-01-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2018-01-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2018-01-29] (Google)
ShellIconOverlayIdentifiers: [00asw] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  -> No File
ContextMenuHandlers1: [ANotepad++64] -> {B298D29A-A6ED-11DE-BA8C-A68E55D89593} => C:\Program Files (x86)\Notepad++\NppShell_06.dll [2018-01-01] ()
ContextMenuHandlers1: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers1: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers1: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2018-01-29] (Google)
ContextMenuHandlers1: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers1: [PilotEdit] -> {277B9550-37E2-47DE-B533-89A1EBD82DB9} => C:\Program Files (x86)\PilotEdit Lite\EShell_x64.dll [2013-01-01] (PilotEdit)
ContextMenuHandlers1: [SDECon32] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [SDECon64] -> {44176360-2BBF-4EC1-93CE-384B8681A0BC} =>  -> No File
ContextMenuHandlers1: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers1-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers2: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers2: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [EPP] -> {09A47860-11B0-4DA5-AFA5-26D86198A780} => C:\Program Files\Microsoft Security Client\shellext.dll [2016-11-14] (Microsoft Corporation)
ContextMenuHandlers4: [GDContextMenu] -> {BB02B294-8425-42E5-983F-41A1FA970CD6} => C:\Program Files (x86)\Google\Drive\contextmenu64.dll [2018-01-29] (Google)
ContextMenuHandlers4: [GpgEX] -> {CCD955E4-5C16-4A33-AFDA-A8947A94946B} => C:\Program Files (x86)\GNU\GnuPG\bin\gpgex.dll [2016-08-18] (g10 Code GmbH)
ContextMenuHandlers4: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers5: [ACE] -> {5E2121EE-0300-11D4-8D3B-444553540000} => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\atiacm64.dll [2015-08-04] (Advanced Micro Devices, Inc.)
ContextMenuHandlers6: [BCShellMenu] -> {7850a720-705f-11d0-a9eb-0080488625e5} => C:\Program Files (x86)\Jetico\Shared64\BCShExt.dll [2015-12-01] (Jetico, Inc.)
ContextMenuHandlers6: [RecuvaShellExt] -> {435E5DF5-2510-463C-B223-BDA47006D002} => C:\Program Files\Recuva\RecuvaShell64.dll [2016-06-06] (Piriform Ltd)
ContextMenuHandlers6: [WinRAR] -> {B41DB860-64E4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext.dll [2016-08-14] (Alexander Roshal)
ContextMenuHandlers6-x32: [WinRAR32] -> {B41DB860-8EE4-11D2-9906-E49FADC173CA} => C:\Program Files\WinRAR\rarext32.dll [2016-08-14] (Alexander Roshal)

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {1FB3732E-9592-444D-A701-81DF304F14A9} - System32\Tasks\Adobe Flash Player PPAPI Notifier => C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_28_0_0_137_pepper.exe
Task: {21022CE6-BFE7-40E7-AAFA-15A6CC72356B} - System32\Tasks\{E140102B-F244-4775-9758-5FA77AFD8886} => C:\Windows\system32\pcalua.exe -a "C:\Users\juergen2\Downloads\chromeinstall-8u77 (1).exe" -d C:\Users\juergen2\Downloads
Task: {213D38E2-E0E5-4EFB-88BC-AC61BF33552B} - System32\Tasks\{849B1E16-7952-40E5-887E-DAAD93154E62} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\putty.exe -d D:\backupMaxtor80gb\data
Task: {22DA9795-90BD-4731-AB6A-BD01A662D2F9} - System32\Tasks\{9C6CF1E7-9264-4314-BC30-F7778072B17B} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\wlsetup3528-all.exe -d d:\backupMaxtor80gb\data\
Task: {3B11371B-11AB-415E-8185-32A4F05C4B0F} - System32\Tasks\{471AF2D6-FC39-423E-8A09-1CE6E304D7BB} => C:\Windows\system32\pcalua.exe -a C:\camel\SilkroadOnlineGlobal_Official_v1_486.exe -d c:\camel\
Task: {4ADE3327-7150-4BB8-87C3-76601FC67879} - System32\Tasks\{FD09F9C6-B58A-406E-8536-F1B82AF22BBE} => C:\Windows\system32\pcalua.exe -a D:\backupMaxtor80gb\data\i2pinstall_0.9.30_windows.exe -d D:\backupMaxtor80gb\data
Task: {6ADA2DE3-F929-4442-BCBE-E1D403613F2F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)
Task: {70FC73DB-5C4F-4CB5-9833-76B9D3A491A6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2017-09-27] (Adobe Systems Incorporated)
Task: {A6D9A0B3-82A7-4937-910D-C86CC1F2F571} - System32\Tasks\{C61837B8-EABF-4B5E-B96E-3C6EC1BD2343} => C:\Windows\system32\pcalua.exe -a C:\datas\jxpiinstall(4).exe -d C:\datas
Task: {AD24AC21-72E8-4AFB-8BA6-BC0413019E02} - System32\Tasks\Opera scheduled Autoupdate 1498067933 => C:\Users\juergen2\AppData\Local\Programs\Opera\launcher.exe [2018-01-22] (Opera Software)
Task: {BE9E6706-8A73-4F34-8BC7-F4B899EDF1C0} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {C41DCF9D-52B1-4007-B77A-6A9EF1DECDFF} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\\MpCmdRun.exe [2016-11-14] (Microsoft Corporation)
Task: {DAC363AC-634F-4411-8C93-334B4E476B58} - System32\Tasks\McAfee Remediation (Prepare) => C:\Program Files\Common Files\AV\McAfee Anti-Virus And Anti-Spyware\upgrade.exe
Task: {E302C505-2A7A-4384-87A8-489CE462BC3D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {F4DDD129-C6FA-4772-AC2D-CE369BA97A92} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {F6F30DFE-BB87-4833-A1E0-CEE92CCDEE3C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-12-21] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)


==================== Shortcuts & WMI ========================

(The entries could be listed to be restored or removed.)


Shortcut: C:\Users\juergen2\Favorites\Downloadseite von NCH Software.lnk -> hxxp://www.nchsoftware.com/de/index.htm
Shortcut: C:\Users\juergen2\Desktop\apache_start - Shortcut.lnk -> C:\xampp\apache_start.bat ()
Shortcut: C:\Users\juergen2\Desktop\Vivado HLS 2016.3.lnk -> C:\Xilinx\Vivado_HLS\2016.3\bin\vivado_hls.bat ()
Shortcut: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado HLS\Vivado HLS 2016.3 Command Prompt.lnk -> C:\Xilinx\Vivado_HLS\2016.3\bin\vivado_hls_cmd.bat ()
Shortcut: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado HLS\Vivado HLS 2016.3.lnk -> C:\Xilinx\Vivado_HLS\2016.3\bin\vivado_hls.bat ()
Shortcut: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GAP 4.7.8\GAP 4.7.8.lnk -> C:\gap4r7\bin\gap.bat ()

ShortcutWithArgument: C:\Users\juergen2\Desktop\root@www.hzgb.org.lnk -> D:\WinSCP-5.9.2-Portable\WinSCP.exe (Martin Prikryl) -> "root%40www.hzgb.org" /Desktop /UploadIfAny
ShortcutWithArgument: C:\Users\juergen2\Desktop\Vivado 2016.3.lnk -> C:\Xilinx\Vivado\2016.3\bin\unwrapped\win64.o\vvgl.exe () -> C:\Xilinx\Vivado\2016.3\bin\vivado.bat
ShortcutWithArgument: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Manage Xilinx Licenses.lnk -> C:\Xilinx\Vivado\2016.3\bin\unwrapped\win64.o\vvgl.exe () -> C:\Xilinx\Vivado\2016.3\bin\vlm.bat
ShortcutWithArgument: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado 2016.3 Tcl Shell.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) -> /k C:\Xilinx\Vivado\2016.3\bin\vivado.bat -mode tcl
ShortcutWithArgument: C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Xilinx Design Tools\Vivado 2016.3\Vivado 2016.3.lnk -> C:\Xilinx\Vivado\2016.3\bin\unwrapped\win64.o\vvgl.exe () -> C:\Xilinx\Vivado\2016.3\bin\vivado.bat

==================== Loaded Modules (Whitelisted) ==============

2015-08-04 00:25 - 2015-08-04 00:25 - 000214528 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Container.PerformanceTuning.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 000817152 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Device.dll
2014-02-11 07:08 - 2014-02-11 07:08 - 003650560 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Platform.dll
2016-08-18 09:27 - 2016-08-18 09:27 - 000216576 _____ () C:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2015-08-04 00:25 - 2015-08-04 00:25 - 000102400 _____ () C:\Program Files\AMD\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2018-01-30 20:47 - 2018-01-30 20:47 - 027796992 _____ () C:\Windows\system32\Macromed\Flash\NPSWF64_28_0_0_137.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000222720 _____ () C:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2016-08-18 09:09 - 2016-08-18 09:09 - 000103424 _____ () C:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2016-08-18 09:03 - 2016-08-18 09:03 - 000050176 _____ () C:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2016-08-18 09:14 - 2016-08-18 09:14 - 000073728 _____ () C:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2016-08-18 09:17 - 2016-08-18 09:17 - 000751104 _____ () C:\Program Files (x86)\GNU\GnuPG\libgcrypt-20.dll
2017-12-12 21:22 - 2017-12-12 21:22 - 000033280 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\cx_Logging.cp35-win32.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 000103424 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\win32api.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 000111616 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\pywintypes35.dll
2017-12-12 21:22 - 2017-12-12 21:22 - 000041984 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\win32process.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 000405504 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\pythoncom35.dll
2017-12-12 21:22 - 2017-12-12 21:22 - 000173568 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\win32gui.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 001934336 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\PyQt5.QtGui.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 000077824 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\sip.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 001780736 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\PyQt5.QtCore.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 000505856 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\PyQt5.QtNetwork.pyd
2017-12-12 21:22 - 2017-12-12 21:22 - 003812864 _____ () C:\Program Files (x86)\Raptr Inc\PlaysTV\PyQt5.QtWidgets.pyd
2018-01-01 02:07 - 2018-01-01 02:07 - 000021680 _____ () C:\Program Files (x86)\Notepad++\plugins\NppExport.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)

IE trusted site: HKU\.DEFAULT\...\localhost -> localhost
IE trusted site: HKU\S-1-5-21-963683855-2343051469-89585254-1000\...\localhost -> localhost

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2017-11-30 16:41 - 000002026 _____ C:\Windows\system32\Drivers\etc\hosts

0.0.0.0 0.0.0.0 # fix for traceroute and netstat display anomaly
0.0.0.0 tracking.opencandy.com.s3.amazonaws.com
0.0.0.0 media.opencandy.com
0.0.0.0 cdn.opencandy.com
0.0.0.0 tracking.opencandy.com
0.0.0.0 api.opencandy.com
0.0.0.0 api.recommendedsw.com
0.0.0.0 installer.betterinstaller.com
0.0.0.0 installer.filebulldog.com
0.0.0.0 d3oxtn1x3b8d7i.cloudfront.net
0.0.0.0 inno.bisrv.com
0.0.0.0 nsis.bisrv.com
0.0.0.0 cdn.file2desktop.com
0.0.0.0 cdn.goateastcach.us
0.0.0.0 cdn.guttastatdk.us
0.0.0.0 cdn.inskinmedia.com
0.0.0.0 cdn.insta.oibundles2.com
0.0.0.0 cdn.insta.playbryte.com
0.0.0.0 cdn.llogetfastcach.us
0.0.0.0 cdn.montiera.com
0.0.0.0 cdn.msdwnld.com
0.0.0.0 cdn.mypcbackup.com
0.0.0.0 cdn.ppdownload.com
0.0.0.0 cdn.riceateastcach.us
0.0.0.0 cdn.shyapotato.us
0.0.0.0 cdn.solimba.com
0.0.0.0 cdn.tuto4pc.com
0.0.0.0 cdn.appround.biz
0.0.0.0 cdn.bigspeedpro.com
0.0.0.0 cdn.bispd.com

==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-963683855-2343051469-89585254-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\juergen2\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall is enabled.

==================== MSCONFIG/TASK MANAGER disabled items ==

MSCONFIG\Services: BCWipeSvc => 2
MSCONFIG\Services: LavasoftAdAwareService11 => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: vssbrigde64 => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^juergen2^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MailWasherPro.lnk => C:\Windows\pss\MailWasherPro.lnk.Startup
MSCONFIG\startupreg: AvgUi => "C:\Program Files (x86)\AVG\Framework\Common\avguirnx.exe" /lps=fmw
MSCONFIG\startupreg: PlaysTV => "C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv_launcher.exe" --startup
MSCONFIG\startupreg: Raptr => C:\PROGRA~2\Raptr Inc\Raptr\raptrstub.exe --startup

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{E08E8243-C2A1-4221-90A7-14736621DBE5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9EA08C55-5310-4A9E-8ABB-32F4A49FF91B}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{97587CB0-9EAA-4B76-AE0F-849E608FE32D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{81373308-C4D3-45DA-ABFB-9FF3613C6D5D}] => (Allow) C:\Program Files (x86)\Raptr\raptr.exe
FirewallRules: [{27E94056-EE89-40C2-88F9-FCDD1B8E5D43}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{D80E4AD5-8012-4DE4-B0FE-3695EFEBEAED}] => (Allow) C:\Program Files (x86)\Raptr\raptr_im.exe
FirewallRules: [{E4AFD96A-B990-4558-B5EE-3F16F3B150B1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{4EFF6531-5BDD-4CC8-BCE4-8C1B36A92B77}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{1144CB11-19E6-41BF-BAFF-C3CBF53D788E}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{D076BE44-8E6B-4596-BDAA-38B73655C620}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{BA663251-09BF-4823-8DE3-357013B1B8CE}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [UDP Query User{E5E54FE6-C09E-4ABB-90E3-E86CBF75A6F2}C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe] => (Allow) C:\users\juergen2\appdata\local\temp\_tc0\bot\mbot_vsro110.exe
FirewallRules: [TCP Query User{3562059C-09AD-49C5-B7A8-F01122A24FF9}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [UDP Query User{F0D6FC0B-D3F6-4346-A980-F46D4C9D1B96}C:\xampp\apache\bin\httpd.exe] => (Allow) C:\xampp\apache\bin\httpd.exe
FirewallRules: [TCP Query User{98C9BD54-7195-421F-8622-82F19A588534}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [UDP Query User{823BFEF5-2144-437C-A54B-BCCA12451298}C:\eclipse\eclipse\eclipse.exe] => (Allow) C:\eclipse\eclipse\eclipse.exe
FirewallRules: [TCP Query User{43DE325D-FD61-460D-842E-290A5202FB7F}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{DFCF343D-2298-479B-820C-A9D87E56AFF7}C:\users\juergen2\desktop\totalcmd\totalcmd.exe] => (Allow) C:\users\juergen2\desktop\totalcmd\totalcmd.exe
FirewallRules: [TCP Query User{A1496639-68D5-46B4-967E-A505FB7D9C89}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [UDP Query User{D2661694-9DE9-4B85-AA71-E76B9FE67E92}C:\datas\psro_m_manualpatch_client_downloader_v3.exe] => (Allow) C:\datas\psro_m_manualpatch_client_downloader_v3.exe
FirewallRules: [TCP Query User{DA6A1C4E-6658-4536-B8A6-C2F9FD65FD61}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [UDP Query User{4C306084-351A-440E-86A7-02F33064F80E}C:\datas\psro_full_client_downloader_v3.exe] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [TCP Query User{82621B54-D4E3-4191-A32E-7FB2E966AFE0}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{FA455FFB-BB85-4880-8324-9ED51129A541}I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) I:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [TCP Query User{AFDB542D-C34E-4DBA-A5E8-13FD772F4676}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [UDP Query User{821974AD-1244-4300-8892-42C965D1C906}C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe] => (Allow) C:\mbot\mbot_puresro_pure-sro-com\mbot_vsro110.exe
FirewallRules: [{776A7697-A9FA-4D00-AE02-02733E032793}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [{179DB254-E4A7-44FD-8180-A252E383B707}] => (Allow) C:\Program Files (x86)\AVG\Av\avgmfapx.exe
FirewallRules: [TCP Query User{5881A1B3-618E-4628-AF81-07C027281C34}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [UDP Query User{B1095A5C-EA19-4532-BE33-41EF9C86B1D8}C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe] => (Allow) C:\datas\bitcoin-0.12.1-win64\bitcoin-0.12.1\bin\bitcoin-qt.exe
FirewallRules: [TCP Query User{B12981FF-B265-4AD8-90CC-1CAA78AFF9D3}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{17966661-BA79-4C90-BC0D-63434C7A2A9F}C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe] => (Allow) C:\users\juergen2\appdata\local\temp\7zipsfx.000\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{359222EA-9F94-4EDA-A978-E08B0C015F21}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{DCC70F92-DA66-4518-B65F-551E06FAED96}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{0C48E5AD-B230-4661-BAFF-D286C90BF7ED}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [UDP Query User{5E82995E-38F3-476B-98A0-E4055D9530E6}C:\xilinx\xic\tps\win64\jre\bin\java.exe] => (Allow) C:\xilinx\xic\tps\win64\jre\bin\java.exe
FirewallRules: [TCP Query User{FF3B1697-47E7-4E15-A46F-14DAD9A34297}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [UDP Query User{91BF5810-5F2B-4B0B-89A6-13C7BD7AF7E0}C:\totalcmd\totalcmd.exe] => (Allow) C:\totalcmd\totalcmd.exe
FirewallRules: [{A15FD59F-4DEB-48C5-B0AB-C560507A5BD9}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{7B27A2F1-A1C2-40B1-856F-69E72A5FDD68}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{109B94D2-FB0C-44F2-A49B-C1ABC4AE84C2}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{0E26162C-0928-4A55-BFA2-D3D7A388B22E}] => (Allow) C:\Users\juergen2\Desktop\Tor Browser\Browser\firefox.exe
FirewallRules: [{8BAD0C4F-C654-432F-8A46-8CBC4BFF20AF}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{81FA3FFE-6DEF-4F3D-871E-6120D650F375}] => (Allow) C:\datas\psro_full_client_downloader_v3.exe
FirewallRules: [{E12FBEE4-11A9-4252-B72E-9DA5B9A82CDB}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{7DA09561-F33A-4F74-AE93-BE232605E318}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{C619FF61-7405-4E6D-B469-F5ED7A4CEBEE}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{5D49AA65-E9EC-4E40-AF85-819A887C58C3}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{97B5B131-9D32-4BAD-8E9A-E1780ABF9A4D}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{054F0F09-AE56-4599-9BA5-F86C9D31FFB5}] => (Allow) C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
FirewallRules: [{A5989984-670A-4953-A4B2-97E2981C1C4E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.58\opera.exe
FirewallRules: [{51A58F52-6A7A-4F9F-A9D3-54673771201E}] => (Allow) C:\Users\juergen2\AppData\Local\Programs\Opera\50.0.2762.67\opera.exe
FirewallRules: [{858D641F-B90B-4B90-9641-DFF96825B635}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{36275EA3-11DB-4932-AC9B-19B7D18F4C95}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\Mathematica.exe
FirewallRules: [{A9C5985A-EEDC-40A3-BBEC-1E2E964F227C}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{A6DED921-ACDB-4F33-8FF6-E322906C2092}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\MathKernel.exe
FirewallRules: [{9D3AC6F5-DD80-4C6C-AC12-2DE855E84AE0}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe
FirewallRules: [{719EF127-CBDB-42E9-AA42-01703EB925AD}] => (Allow) C:\Program Files\Wolfram Research\Mathematica\11.2\math.exe
FirewallRules: [{0017C32F-8CD4-4267-86D0-93A7056AC3F7}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe
FirewallRules: [{21FE1D3A-C8E4-4FBA-A5D9-09D4039F5108}] => (Allow) C:\Program Files (x86)\Raptr Inc\PlaysTV\playstv.exe
FirewallRules: [{8A616D52-4726-4DAA-B13D-3AECDF8E1BF0}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
FirewallRules: [{C5DF63D8-C393-4201-87DC-974405E1ACE2}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr.exe
FirewallRules: [{713E93FE-97C7-4D2B-97D7-78D78D86CFEB}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe
FirewallRules: [{0F40B081-88E5-48FA-A93B-F155F4F0FD0D}] => (Allow) C:\Program Files (x86)\Raptr Inc\Raptr\raptr_im.exe

==================== Restore Points =========================

06-02-2018 10:45:05 Revo Uninstaller's restore point - MSXML 4.0 SP3 Parser (KB2758694)
06-02-2018 10:59:34 Revo Uninstaller's restore point - Adobe Acrobat Reader DC - Deutsch
06-02-2018 11:03:18 Revo Uninstaller's restore point - Avira
06-02-2018 11:04:42 Revo Uninstaller's restore point - Avira Antivirus
06-02-2018 11:13:09 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 102 (64-bit)
06-02-2018 11:13:34 Removed Java SE Development Kit 8 Update 102 (64-bit)
06-02-2018 11:16:26 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 91
06-02-2018 11:16:53 Removed Java SE Development Kit 8 Update 91
06-02-2018 11:19:30 Revo Uninstaller's restore point - Java SE Development Kit 8 Update 91 (64-bit)
06-02-2018 11:19:55 Removed Java SE Development Kit 8 Update 91 (64-bit)
06-02-2018 11:23:47 Revo Uninstaller's restore point - McAfee Security Scan Plus
06-02-2018 11:26:06 Revo Uninstaller's restore point - OpenOffice 4.1.3
06-02-2018 11:28:56 Revo Uninstaller's restore point - TrueCrypt
06-02-2018 11:29:21 TrueCrypt uninstallation
06-02-2018 11:32:47 Revo Uninstaller's restore point - Silkroad
06-02-2018 11:44:48 Revo Uninstaller's restore point - Avira
06-02-2018 11:48:25 Revo Uninstaller's restore point - MBOT_PureSRO_2016 version Final
06-02-2018 11:49:56 Revo Uninstaller's restore point - TDM-GCC
06-02-2018 13:30:26 Malwarebytes Anti-Rootkit Restore Point
06-02-2018 18:33:50 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727
06-02-2018 18:34:36 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727

==================== Faulty Device Manager Devices =============

Name: ZAM Guard Driver
Description: ZAM Guard Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM_Guard
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: AODDriver4.1
Description: AODDriver4.1
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: AODDriver4.1
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Microsoft PS/2 Mouse
Description: Microsoft PS/2 Mouse
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.

Name: ZAM Helper Driver
Description: ZAM Helper Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: ZAM
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/09/2018 12:00:59 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/08/2018 06:26:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/08/2018 10:57:41 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/08/2018 12:30:29 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/07/2018 12:58:35 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/07/2018 12:52:31 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/07/2018 06:32:19 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/07/2018 05:34:30 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 10:01:34 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (02/06/2018 08:05:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (02/09/2018 12:02:33 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/09/2018 12:01:07 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/09/2018 12:01:07 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/09/2018 11:59:35 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/08/2018 06:27:08 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY)
Description: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
 and APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
 to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.

Error: (02/08/2018 06:26:37 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: The following boot-start or system-start driver(s) failed to load:
bcbus

Error: (02/08/2018 06:26:36 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: The Intel(R) Biometric and Context Agent Service service hung on starting.

Error: (02/08/2018 06:25:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The AODDriver4.1 service failed to start due to the following error:
The system cannot find the path specified.

Error: (02/08/2018 06:23:20 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.

Error: (02/08/2018 06:23:20 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)
Description: The following fatal alert was received: 70.


CodeIntegrity:
===================================
  Date: 2015-11-05 07:09:53.063
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.061
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 15.0.2\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.029
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

  Date: 2015-11-05 07:09:53.027
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Processor: AMD A6-3650 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 87%
Total physical RAM: 7665.37 MB
Available physical RAM: 952.18 MB
Total Virtual: 11759.54 MB
Available Virtual: 3327.96 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:488.18 GB) (Free:165.54 GB) NTFS
Drive d: (neueMaxTor) (Fixed) (Total:443.23 GB) (Free:153.05 GB) NTFS
Drive f: (System-reserviert) (Fixed) (Total:0.1 GB) (Free:0.06 GB) NTFS ==>[system with boot components (obtained from drive)]
Drive g: (Dritte Externe Teil 1) (Fixed) (Total:351.38 GB) (Free:50.38 GB) NTFS
Drive h: (Poops) (Fixed) (Total:347.16 GB) (Free:24.97 GB) NTFS
Drive i: (PalleMalle) (Fixed) (Total:931.51 GB) (Free:64.04 GB) NTFS
Drive j: (TOSHIBA EXT) (Fixed) (Total:931.41 GB) (Free:32.18 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 9A083BDB)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=488.2 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=443.2 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 7191D59B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=351.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=347.2 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 931.5 GB) (Disk ID: 002EFF55)
Partition 1: (Not Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 3 (Size: 931.5 GB) (Disk ID: AAE66568)
Partition 1: (Active) - (Size=931.4 GB) - (Type=07 NTFS)

==================== End of Addition.txt ============================

cosinus 09.02.2018 13:08
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
hosts:
emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


juergen007 10.02.2018 07:58
aber gern

Code:
Fix result of Farbar Recovery Scan Tool (x64) Version: 08.02.2018
Ran by Administrator (10-02-2018 07:57:30) Run:1
Running from C:\Users\Administrator\Desktop
Loaded Profiles: Administrator (Available Profiles: juergen2 & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
hosts:
emptytemp

*****************

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.
emptytemp => Error: No automatic fix found for this entry.

==== End of Fixlog 07:57:30 ====

cosinus 10.02.2018 13:26
Den Fix bitte richtig machen. Du hast nicht alles aus dem Text in der codebox 1:1 kopiert.

juergen007 10.02.2018 15:23
Pardon, aber in Deinem Beitrag von gestern 13:08 steht nur

Code:
hosts:
emptytemp:
Auch wenn ich aufklappen anklicke...

cosinus 10.02.2018 16:19
Jap. Und nun schau mal was du kopiert hast -> Doppelpunkt vergessen :p

juergen007 10.02.2018 18:52
Autsch:stirn:
Code:
Fix result of Farbar Recovery Scan Tool (x64) Version: 10.02.2018 02
Ran by Administrator (10-02-2018 18:45:19) Run:2
Running from C:\Users\Administrator\Desktop
Loaded Profiles: Administrator (Available Profiles: juergen2 & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
hosts:
emptytemp:
*****************

C:\Windows\System32\Drivers\etc\hosts => moved successfully
Hosts restored successfully.

=========== EmptyTemp: ==========

BITS transfer queue => 8388608 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 5743694 B
Java, Flash, Steam htmlcache => 1066 B
Windows/system/drivers => 65878617 B
Edge => 0 B
Chrome => 0 B
Firefox => 387099704 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 128 B
systemprofile32 => 128 B
LocalService => 0 B
NetworkService => 16469918 B
juergen2 => 120734974 B
Administrator => 227038558 B

RecycleBin => 0 B
EmptyTemp: => 792.8 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 18:46:51 ====

cosinus 10.02.2018 19:03
Kontrollscans mit (1) MBAM, (2) ESET und (3) SecurityCheck bitte:


1. Schritt: Malwarebytes Version 3

Downloade Dir bitte Malwarebytes Anti-Malware 3
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scan, wähle den Bedrohungs-Scan aus und klicke auf Scan starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Ausgewählte Elemente in die Quarantäne verschieben.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM nach dem Neustart, klicke auf Berichte.
  • Wähle den neuesten Scan-Bericht aus, klicke auf Bericht anzeigen und dann auf Export.
  • Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



2. Schritt: ESET

Downloade Dir bitte ESET Online Scanner (Bebilderte Anleitung)
  • Starte die Installationsdatei.
  • Akzeptiere die Nutzungsbedingungen.
  • Wähle Erkennung evtl. unerwünschter Anwendungen aktivieren aus und klicke auf Scannen.
  • Zuerst werden die notwendigen Signaturen heruntergeladen, anschließend startet ESET automatisch den Suchlauf.
  • Am Ende des Suchlaufs werden gegebenenfalls die gefundenen Elemente aufgelistet.
  • Schließe den ESET Online Scanner rechts oben [ X ] und klicke anschließend auf Schließen.
  • Drücke bitte die Tastenkombination WIN+R zum Ausführen und kopiere folgenden Text in die Zeile und drücke im Anschluss auf OK:
    Code:
    notepad "%tmp%\log.txt"
  • Kopiere den gesamten Text mittels STRG+A und STRG+C hier in deine Antwort in CODE-Tags



3. Schritt: SecurityCheck

Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

juergen007 12.02.2018 03:21
Namt,
so das sind die 3 logfiles.

Code:
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/10/18
Scan Time: 9:02 PM
Log File: 64b8f976-0e9d-11e8-9c7a-8c89a53586cf.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3913
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: juergen2-PC\Administrator

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 353896
Threats Detected: 12
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 35 min, 10 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
PUP.Optional.WebBar, HKLM\SOFTWARE\MICROSOFT\TRACING\winwb_RASAPI32, No Action By User, [3420], [262291],1.0.3913
PUP.Optional.WebBar, HKLM\SOFTWARE\MICROSOFT\TRACING\winwb_RASMANCS, No Action By User, [3420], [262291],1.0.3913
PUP.Optional.MediaPlayAir, HKU\S-1-5-21-963683855-2343051469-89585254-1000\SOFTWARE\UNDEFINED, No Action By User, [1055], [334354],1.0.3913

Registry Value: 1
PUP.Optional.MediaPlayAir, HKU\S-1-5-21-963683855-2343051469-89585254-1000\SOFTWARE\UNDEFINED|FLASHPLAYERPRO.EXE, No Action By User, [1055], [334354],1.0.3913

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.WebBar, C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\WEBBAR, No Action By User, [3420], [254551],1.0.3913
PUP.Optional.MindSpark.Generic, C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IV2HA52P.DEFAULT-1508386149418\BROWSER-EXTENSION-DATA\_f7Members_@download.smsfrombrowser.com, No Action By User, [1389], [468075],1.0.3913
PUP.Optional.MindSpark.Generic, C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IV2HA52P.DEFAULT-1508386149418\BROWSER-EXTENSION-DATA\_j5Members_@ext.ask.com, No Action By User, [1389], [468075],1.0.3913

File: 5
PUP.Optional.StartPage24, C:\USERS\JUERGEN2\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXIDV9QV.DEFAULT-1475719002037\EXTENSIONS\FFEXT_BASICVIDEOEXT@STARTPAGE24.XPI, No Action By User, [11359], [186354],1.0.3913
PUP.Optional.WebBar, C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\WEBBAR\WB.LOG, No Action By User, [3420], [254551],1.0.3913
PUP.Optional.MindSpark.Generic, C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\_f7Members_@download.smsfrombrowser.com\storage.js, No Action By User, [1389], [468075],1.0.3913
PUP.Optional.MindSpark.Generic, C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\_j5Members_@ext.ask.com\storage.js, No Action By User, [1389], [468075],1.0.3913
PUP.Optional.TweakBit, C:\USERS\JUERGEN2\DOWNLOADS\ASUS-DRIVER-UPDATER.EXE, No Action By User, [1109], [427277],1.0.3913

Physical Sector: 0
(No malicious items detected)


(end)
Nach Eset lauf nicht alle säubern?

Code:
21:58:54 # product=EOS
# version=8
# flags=0
# esetonlinescanner_deu.exe=2.0.19.0
# EOSSerial=fe88f06444b38c4f9ba0dd1c8411570b
# end=init
# utc_time=2018-02-10 20:58:53
# local_time=2018-02-10 21:58:53 (+0100, W. Europe Standard Time)
# country="Austria"
# osver=6.1.7601 NT Service Pack 1
21:59:20 Updating
21:59:20 Update Init
21:59:23 Update Download
22:12:13 esets_scanner_update returned -1 esets_gle=12
22:12:13 Update Finalize
22:12:13 Call m_esets_charon_send
22:12:13 Call m_esets_charon_destroy
22:12:13 Retrying Update
22:12:13 Updating
22:12:13 Update Init
22:12:22 Update Download
22:22:54 esets_scanner_reload returned 0
22:22:54 g_uiModuleBuild: 36359
22:22:54 Update Finalize
22:22:54 Call m_esets_charon_send
22:22:54 Call m_esets_charon_destroy
22:22:54 Updated modules version: 36359
22:23:06 Call m_esets_charon_setup_create
22:23:06 Call m_esets_charon_create
22:23:06 m_esets_charon_create OK
22:23:06 Call m_esets_charon_start_send_thread
22:23:06 Call m_esets_charon_setup_set
22:23:06 m_esets_charon_setup_set OK
22:23:06 Scanner engine: 36359
00:21:24 # product=EOS
# version=8
# flags=0
# esetonlinescanner_deu.exe=2.0.19.0
# EOSSerial=fe88f06444b38c4f9ba0dd1c8411570b
# end=init
# utc_time=2018-02-10 23:21:24
# local_time=2018-02-11 00:21:24 (+0100, W. Europe Standard Time)
# country="Austria"
# osver=6.1.7601 NT Service Pack 1
00:21:48 Call m_esets_charon_setup_create
00:21:48 Call m_esets_charon_create
00:21:48 m_esets_charon_create OK
00:21:48 Call m_esets_charon_start_send_thread
00:21:48 Call m_esets_charon_setup_set
00:21:48 m_esets_charon_setup_set OK
00:22:03 Updating
00:22:03 Update Init
00:22:15 Call m_esets_charon_setup_create
00:22:15 Call m_esets_charon_create
00:22:15 m_esets_charon_setup_set ERROR
00:22:15 Update Download
00:22:45 esets_scanner_reload returned 0
00:22:45 g_uiModuleBuild: 36361
00:22:45 Update Finalize
00:22:45 Call m_esets_charon_send
00:22:45 Call m_esets_charon_destroy
00:22:45 Updated modules version: 36361
00:22:57 Call m_esets_charon_setup_create
00:22:57 Call m_esets_charon_create
00:22:57 m_esets_charon_setup_set ERROR
00:22:57 Scanner engine: 36361
00:23:11 # product=EOS
# version=8
# flags=0
# esetonlinescanner_deu.exe=2.0.19.0
# EOSSerial=fe88f06444b38c4f9ba0dd1c8411570b
# end=init
# utc_time=2018-02-10 23:23:10
# local_time=2018-02-11 00:23:10 (+0100, W. Europe Standard Time)
# country="Austria"
# osver=6.1.7601 NT Service Pack 1
14:37:39 # product=EOS
# version=8
# flags=0
# esetonlinescanner_deu.exe=2.0.19.0
# EOSSerial=fe88f06444b38c4f9ba0dd1c8411570b
# engine=36361
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# sfx_checked=true
# utc_time=2018-02-11 13:37:39
# local_time=2018-02-11 14:37:39 (+0100, W. Europe Standard Time)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 2077801 57100673 0 0
# scanned=2
# found=19
# cleaned=0
# scan_time=51292
sh=BCF5D848ACC5FAAC74302A58198BF23043A4D988 ft=1 fh=0000000000000000 vn="Variante von MSIL/WebBar.C eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\cqzjswczuapwoyeuzvyibkudzgvnrnln\5.5.6347.24995\winwb.exe"
sh=0B45DF4F398972E1D47263399E2298AE7D5FA83E ft=1 fh=0000000000000000 vn="Variante von MSIL/ByteFence.A eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\dbgsxusyjhwhcmswwnoazjmlthsmcgtg\ByteFence.exe"
sh=B88960DFA4A3D5C6BAEADB75FB444B8792E3A7E5 ft=1 fh=0000000000000000 vn="Variante von MSIL/ByteFence.A eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\dbgsxusyjhwhcmswwnoazjmlthsmcgtg\rsEngine.dll"
sh=4B5EBE6B210950F1BA9DE6BF162BD471FDCCBF2D ft=1 fh=0000000000000000 vn="Variante von MSIL/WebCompanion.D eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\dbhshyssdbjjczbuahwwwegacvmpfjwj\Application\Lavasoft.Utils.dll"
sh=5B448F160FD649D12ECD460481097A84BA7B6D47 ft=1 fh=0000000000000000 vn="Variante von MSIL/WebCompanion.D eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\dbhshyssdbjjczbuahwwwegacvmpfjwj\Application\Lavasoft.WCAssistant.WinService.exe"
sh=C1E35F3A64EE4EB0729AA4BA5A123771DEBC680D ft=1 fh=0000000000000000 vn="Variante von MSIL/WebCompanion.D eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\dbhshyssdbjjczbuahwwwegacvmpfjwj\Application\WebCompanion.exe"
sh=3CC699DBC82C024AF463A9DA76DE42C8C56E4D47 ft=1 fh=0000000000000000 vn="Variante von MSIL/WebCompanion.C eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\dbhshyssdbjjczbuahwwwegacvmpfjwj\Application\WebCompanionInstaller.exe"
sh=2706C0FE08AE19CC659D69A89D06A2BB4FAF2527 ft=0 fh=0000000000000000 vn="JS/Mindspark.B eventuell unerwünschte Anwendung,JS/Mindspark.D eventuell unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\quarantine\files\xqmnbqdrovoyxfvvvxdddzxaenawkxim\chrome\ffxtbr.jar"
sh=D1844E06611DF2F24F1DECAE4D2FE5644A968FCE ft=1 fh=0000000000000000 vn="Variante von Win32/Visicom.B eventuell unerwünschte Anwendung" ac=I fn="C:\datas\ManyCamWebInstaller_5.3.0.exe"
sh=881F02D49C5A24B46BDBB28AACE0F89A80E2AE08 ft=1 fh=0000000000000000 vn="Variante von Win32/Auslogics.A eventuell unerwünschte Anwendung" ac=I fn="C:\Users\juergen2\Downloads\ASUS-driver-updater.exe"
sh=F57799CC65C669293300AB75F78DB0E3AACFBED3 ft=1 fh=0000000000000000 vn="Variante von Win32/DownloadSponsor.A eventuell unerwünschte Anwendung" ac=I fn="H:\dateien\XAMPP - CHIP-Downloader.exe"
sh=2EB1300E6FEDA1163A6D29C3A60A19C9285BE48A ft=1 fh=0000000000000000 vn="Win32/Toolbar.Montiera.I eventuell unerwünschte Anwendung,Variante von Win32/Toolbar.Escort.A eventuell unerwünschte Anwendung,Variante von Win32/Toolbar.Montiera.A eventuell unerwünschte Anwendung,Variante von Win32/Toolbar.Montiera.F eventuell unerwünschte Anwendung" ac=I fn="H:\olduser\juergi\Desktop\softonic_ggl_1.5.11.5.exe"
sh=9138D8BA1A4445001ECBD145EE8083EB74B03BC8 ft=0 fh=0000000000000000 vn="LNK/Agent.CH Trojaner" ac=I fn="H:\torrent\www.blockbusters.cc...Dornenvögel-2\Firstload.de - Dein Gratis UseNext Account.URL"
sh=9138D8BA1A4445001ECBD145EE8083EB74B03BC8 ft=0 fh=0000000000000000 vn="LNK/Agent.CH Trojaner" ac=I fn="H:\torrent\www.blockbusters.cc...Dornenvögel-3\Firstload.de - Dein Gratis UseNext Account.URL"
sh=78139C63DFC40F5C4ED2247782BB44EF827A13E1 ft=0 fh=0000000000000000 vn="Java/TrojanDownloader.Agent.NBB Trojaner" ac=I fn="I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161113.tgz"
sh=2795B32AFB95ADAFFABB1DF36D4419E9E6E0E410 ft=0 fh=0000000000000000 vn="Java/TrojanDownloader.Agent.NBB Trojaner" ac=I fn="I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161125.tgz"
sh=D25113CF5A89275F1F54FF8173D457FDD468A82E ft=0 fh=0000000000000000 vn="Variante von Win32/SmartTweak.A eventuell unerwünschte Anwendung,ist OK" ac=I fn="I:\div\install\msql.dll.zip"
sh=FCAC8027E9F7E15672C679A2ED05D55C2365B93E ft=0 fh=0000000000000000 vn="Variante von Win32/Auslogics.A eventuell unerwünschte Anwendung,ist OK" ac=I fn="I:\JUERGEN2-PC\Backup Set 2016-10-25 212418\Backup Files 2016-11-06 190005\Backup files 6.zip"
sh=4EEA2FEF6DF29F2115B2C595361A6E9C4A7FAF28 ft=0 fh=0000000000000000 vn="Variante von Win32/Auslogics.A eventuell unerwünschte Anwendung" ac=I fn="I:\JUERGEN2-PC\Backup Set 2016-12-11 190004\Backup Files 2016-12-11 190004\Backup files 23.zip"
Code:
Results of screen317's Security Check version 1.009 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled! 
Microsoft Security Essentials 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Adobe Flash Player 28.0.0.137 
 Mozilla Thunderbird (52.6.0)
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Malwarebytes Anti-Malware mbamservice.exe 
 data esetonlinescanner_deu.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````
Es hat sich malwarebytes von selber gemeldet und ich habe alle quarantined und deleted.
hoffe das ist ok..
Code:
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/12/18
Scan Time: 2:18 AM
Log File: ac27620c-0f92-11e8-a05d-8c89a53586cf.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3920
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: System

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 353995
Threats Detected: 11
Threats Quarantined: 11
Time Elapsed: 55 min, 25 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 3
PUP.Optional.MediaPlayAir, HKU\S-1-5-21-963683855-2343051469-89585254-1000\SOFTWARE\UNDEFINED, Quarantined, [1056], [334354],1.0.3920
PUP.Optional.WebBar, HKLM\SOFTWARE\MICROSOFT\TRACING\winwb_RASAPI32, Quarantined, [3421], [262291],1.0.3920
PUP.Optional.WebBar, HKLM\SOFTWARE\MICROSOFT\TRACING\winwb_RASMANCS, Quarantined, [3421], [262291],1.0.3920

Registry Value: 1
PUP.Optional.MediaPlayAir, HKU\S-1-5-21-963683855-2343051469-89585254-1000\SOFTWARE\UNDEFINED|FLASHPLAYERPRO.EXE, Quarantined, [1056], [334354],1.0.3920

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 3
PUP.Optional.MindSpark.Generic, C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IV2HA52P.DEFAULT-1508386149418\BROWSER-EXTENSION-DATA\_f7Members_@download.smsfrombrowser.com, Quarantined, [1390], [468075],1.0.3920
PUP.Optional.MindSpark.Generic, C:\USERS\ADMINISTRATOR\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IV2HA52P.DEFAULT-1508386149418\BROWSER-EXTENSION-DATA\_j5Members_@ext.ask.com, Quarantined, [1390], [468075],1.0.3920
PUP.Optional.WebBar, C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\WEBBAR, Quarantined, [3421], [254551],1.0.3920

File: 4
PUP.Optional.StartPage24, C:\USERS\JUERGEN2\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\PXIDV9QV.DEFAULT-1475719002037\EXTENSIONS\FFEXT_BASICVIDEOEXT@STARTPAGE24.XPI, Quarantined, [11366], [186354],1.0.3920
PUP.Optional.MindSpark.Generic, C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\_f7Members_@download.smsfrombrowser.com\storage.js, Quarantined, [1390], [468075],1.0.3920
PUP.Optional.MindSpark.Generic, C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\iv2ha52p.default-1508386149418\browser-extension-data\_j5Members_@ext.ask.com\storage.js, Quarantined, [1390], [468075],1.0.3920
PUP.Optional.WebBar, C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\WEBBAR\WB.LOG, Quarantined, [3421], [254551],1.0.3920

Physical Sector: 0
(No malicious items detected)


(end)

cosinus 12.02.2018 09:24
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
C:\datas\ManyCamWebInstaller_5.3.0.exe
C:\Users\juergen2\Downloads\ASUS-driver-updater.exe
H:\dateien\*CHIP-Downloader.exe
H:\olduser\juergi\Desktop\softonic_ggl_1.5.11.5.exe
H:\torrent
I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161113.tgz
I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161125.tgz
I:\div\install\msql.dll.zip
emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


juergen007 12.02.2018 10:41
Code:
Fix result of Farbar Recovery Scan Tool (x64) Version: 10.02.2018 02
Ran by Administrator (12-02-2018 10:31:23) Run:3
Running from C:\Users\Administrator\Desktop
Loaded Profiles: Administrator (Available Profiles: juergen2 & Administrator)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\datas\ManyCamWebInstaller_5.3.0.exe
C:\Users\juergen2\Downloads\ASUS-driver-updater.exe
H:\dateien\*CHIP-Downloader.exe
H:\olduser\juergi\Desktop\softonic_ggl_1.5.11.5.exe
H:\torrent
I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161113.tgz
I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161125.tgz
I:\div\install\msql.dll.zip
emptytemp:
*****************

"C:\datas\ManyCamWebInstaller_5.3.0.exe" => not found
"C:\Users\juergen2\Downloads\ASUS-driver-updater.exe" => not found

=========== "H:\dateien\*CHIP-Downloader.exe" ==========

not found

========= End -> "H:\dateien\*CHIP-Downloader.exe" ========

"H:\olduser\juergi\Desktop\softonic_ggl_1.5.11.5.exe" => not found
H:\torrent => moved successfully
"I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161113.tgz" => not found
"I:\BackupSucama\httpdocs\mirror\mirror\backup\_SUCAMAFORUM_20161125.tgz" => not found
"I:\div\install\msql.dll.zip" => not found

=========== EmptyTemp: ==========

BITS transfer queue => 0 B
DOMStore, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 14682320 B
Java, Flash, Steam htmlcache => 0 B
Windows/system/drivers => 15934 B
Edge => 0 B
Chrome => 0 B
Firefox => 388232801 B
Opera => 0 B

Temp, IE cache, history, cookies, recent:
Users => 0 B
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 0 B
systemprofile32 => 0 B
LocalService => 0 B
NetworkService => 5990 B
juergen2 => 328601 B
Administrator => 4541845 B

RecycleBin => 0 B
EmptyTemp: => 388.9 MB temporary data Removed.

================================


The system needed a reboot.

==== End of Fixlog 10:36:06 ====

cosinus 12.02.2018 10:50
Dann jetzt nochmal Malwarebytes. Und Anleitung richtig lesen, alle etwaigen Funde mit malwarebytes sollen auch entfernt werden!

juergen007 12.02.2018 15:53
Code:
Malwarebytes
www.malwarebytes.com

-Log Details-
Scan Date: 2/12/18
Scan Time: 3:19 PM
Log File: b598603a-0fff-11e8-b0b5-8c89a53586cf.json
Administrator: Yes

-Software Information-
Version: 3.3.1.2183
Components Version: 1.0.262
Update Package Version: 1.0.3924
License: Trial

-System Information-
OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: juergen2-PC\Administrator

-Scan Summary-
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 354064
Threats Detected: 0
(No malicious items detected)
Threats Quarantined: 0
(No malicious items detected)
Time Elapsed: 25 min, 0 sec

-Scan Options-
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Detect
PUM: Detect

-Scan Details-
Process: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registry Key: 0
(No malicious items detected)

Registry Value: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Data Stream: 0
(No malicious items detected)

Folder: 0
(No malicious items detected)

File: 0
(No malicious items detected)

Physical Sector: 0
(No malicious items detected)


(end)

cosinus 13.02.2018 09:08
Dann wären wir durch! :daumenhoc

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:

Abschließend müssen wir noch ein paar Schritte unternehmen, um dein System aufzuräumen (cleanup mit DelFix) und abzusichern; ich poste dir dazu mal meine Lesestoffe. Wichtiger als irgendein AV ist ein vernünftiger Umgang, also gewisse Verhaltensregeln am Gerät mit Internetzugang, und ein paar grundsätzliche Absicherungen. Deswegen kommen die zuerst. Gliederung:

  1. Cleanup mit DelFix

  2. Grundsätzliches

  3. Absicherung

  4. Virenscanner + Firewall

  5. Backup- und Imaging-Tools



Lesestoff:
Cleanup
Alle Logs gepostet? Dann lade Dir bitte http://filepony.de/icon/tiny/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.




Lesestoff:
Grundsätzliches

Lesestoff:
Google Chrome

Von der Verwendung dieses Browsers muss man aus Datenschutzgründen dringend abraten.

Falls installiert: deinstalliere Google Chrome und verwende stattdessen Mozilla Firefox.


Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups deiner wichtigen Dateien oder des Systems (genaueres dazu im Lesestoff zu Backups)

Finger weg von Registry-Cleanern, Optimizern usw!!! - die Performancesteigerung ist umstritten bis ganz klar nicht belegbar, dafür hast du ein großes Risiko dein System zu zerstören v.a. bei Registry-Operationen. Das Beste ist, die windowseigene Datenträgerbereinigung zu verwenden - und die Registry in Ruhe zu lassen!


Softwareinstallationen und Aktualisierungen

Für Windows gibt es seit einiger Zeit einen brauchbaren Paketmanager, der mit einfachen Befehlen es erlaubt, automatisiert Software herunterzuladen und zu installieren. Das erspart eine Menge Arbeit, denn ohne einen Paketmanager muss man jedes Programm selbst prüfen und separat manuell updaten, vorher manuell noch runterladen etc. pp. - siehe auch --> http://www.trojaner-board.de/186035-...r-windows.html


Ich empfehle daher, alle Programme, sofern verfügbar, über chocolatey zu installieren. Falls du schon mit Linux zu tun hattest, wird dir die Syntax sehr vertraut sein. Die FAQs zu choco findest du da --> Chocolatey: Häufig gestellte Fragen (englisch)


Für den seltenen Fall, dass du das benötigte Programm NICHT im repository von chocolatey findest: Lade diese Software immer von einem sauberen Portal wie http://filepony.de/images/microbanner.gif. Finger weg von chip.de oder softonic!
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner.




Lesestoff:
Absicherung

Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch sicherheitsrelevante Software sollte immer in aktueller Version vorliegen - sofern benötigt, wenn nicht benötigt natürlich sinnigerweise deinstallieren oder Alternativen verwenden (und diese aktuell halten).

Das zeitnahe Einspielen von Updates ist erforderlich, damit Sicherheitslücken geschlossen werden; Sicherheitslücken werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren. Besonders aufpassen bzgl. der Aktualität musst du bei folgender Software:
  • Browser (Internet Explorer, Edge, Firefox, Chrome, ...)

  • Flash Player: Was Adobe mit seinem Flash Player veranstaltet, ist irgendwo zwischen Frechheit und Inkompetenz einzustufen; in dem Teil werden ständig neue dicke Sicherheitslücken gefunden - für YT reicht meistens HTML5 aus, das ist der Standardplayer wenn der Flash Player inaktiv oder nicht installiert ist; für spezielle Browsergames kann es aber sein, dass du den Flash Player brauchst. Nutze Flash so sparsam wie möglich und wenn dann immer aktuell halten!!

  • Java: Spielt kaum noch eine Rolle. Fast nirgendwo werden mehr Java-Applets eingesetzt. Wird noch für spezielles Zeugs in OpenOffice genutzt, IIRC brauchen auch manche Games Java. Aber wirklich sehr selten.

  • PDF-Reader: NICHT den AdobeReader benutzen, sondern besser sowas wie PDF-XChange; der interne PDF-Betrachter vom Firefox reicht meist auch aus. Vermeide Adobe unbedingt, das ist eine Firma mit miserabler Sicherheitspolitik!


Empfohlene Firefox-Addons (Erweiterungen):

https://addons.cdn.mozilla.net/user-...ied=1510319591uBlock Origin ist ein einfacher und zuverlässiger Ad- und Trackerblocker.

https://addons.cdn.mozilla.net/user-...ied=1511295622 HTTPS Everywhere Sorgt dafür, dass der Firefox immer, wenn möglich, verschlüsselte Verbindungen (HTTPS) verwendet statt HTTP. Wahlweise kann man darüber durch Setzen eines Häkchens auch alle unverschlüsselten Verbindungen blockieren, Firefox nutzt dann nur noch HTTPS und lädt nichts mehr über üverschlüsselte Verbindungen.




Lesestoff:
Virenscanner + Firewall

Vorab sei erwähnt, dass man niemals die Schutzwirkung eines Virenscanners überbewerten darf!

Die Dinger sind mittlerweile auch unter Windows stark umstritten und können Probleme bereiten, die man so ohne AV einfach nicht haben wird. Zudem werden sie auch niemals jeden Schädling finden können. Aussagen der Anbieter dieser Software entpuppen sich regelmäßig als Marketinggeblubber. Lies dazu => Aus aktuellem Anlass: Antivirus-Schlangenöl | Elias Schwerdtfeger und => http://www.golem.de/news/antivirenso...12-125148.html

Verwende also MAXIMAL ein einziges der folgenden AVs mit Echtzeitscanner und stets aktueller Signaturendatenbank; verwende immer nur reine Virenscanner (keine Produkte mit Suite oder Internet Security in Namen, denn diese bringen kontraproduktive Firewalls mit - die Windows-Firewall ist alles was benötigt wird!)



Microsoft Security Essentials (MSE) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE entschieden hast, brauchst du nicht extra MSE zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür.

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und/oder mit dem ESET Online Scanner scannen.






Lesestoff:
Backup-/Image-Tools

IMHO sind Wiederherstellungspunkte nix weiter als eine Notlösung, wer sich auf was Funktionierendes verlassen will und muss, kommt um echte Backup/Imaging Software nicht herum. Ich nehme unter Windows immer Drive Snapshot - Disk Image Backup for Windows NT/2000/XP/2003/X64

Damit man sinnvolle Backups hat muss man regelmäßig zB wöchentlich ein Image auf eine separate externe Festplatte erstellen. Diese externe Festplatte wird nur dann angeschlossen, wenn man das Backup erstellen will (oder etwas wiederherstellen muss), sonsten bleibt sie aus Sicherheitsgründen sicher im Schrank verwahrt - allein schon aus dem Grund, die Backups vor Krypto-Trojaner zu schützen.



Option 1: Drivesnapshot

Offizielle TB-Anleitung --> http://www.trojaner-board.de/186299-...esnapshot.html


http://cosinus.trojaner-board.de/ima...napshot002.png


Drive Snapshot - Disk Image Backup for Windows NT/2000/XP/2003/X64
Download (32-Bit) => http://www.drivesnapshot.de/download/snapshot.exe
Download (64-Bit) => http://www.drivesnapshot.de/download/snapshot64.exe


Es gibt da auch leicht abgespeckte Versionen von Acronis TrueImage gratis wenn man Platten von Seagate und/oder Western Digital hat. Vllt sagen diese Programme dir mehr zu. Mein Favorit aber ist das kleine o.g. Drivesnapshot.



Option 2: Seagate DiscWizard
Download => Seagate DiscWizard - Download - Filepony


Screenshots:
http://filepony.de/screenshot/seagate_discwizard5.jpg
http://filepony.de/screenshot/seagate_discwizard4.png
http://filepony.de/screenshot/seagate_discwizard3.jpg



Option 3: Acronis TrueImage WD Edition
Download => Acronis True Image WD Edition - Download - Filepony


Screenshots:
http://filepony.de/screenshot/acroni...d_edition1.jpg
http://filepony.de/screenshot/acroni...d_edition2.jpg


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:14 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19