Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   yeabests.cc als neue Startseite -> ändert sich immer wieder zurück (https://www.trojaner-board.de/181477-yeabests-cc-neue-startseite-aendert-immer-zurueck.html)

KiwiLink 30.08.2016 12:39
yeabests.cc als neue Startseite -> ändert sich immer wieder zurück
 
Guten Tag,
ich habe mir "leider" ein Programm von einer nicht vertrauenswürdigen Seite heruntergeladen. Daraufhin hatte ich mehr als 10 Programme auf meinem PC die nur genervt haben, Prozessorleistung gezogen haben und im Browser neue Startseiten, Suchmaschinen und Leisten erstellt haben. Nun habe ich alle Programme über Revo Uninstaller deinstalliert. Auch zwei anti Malware Programme habe ich scannen lassen und die Resulatete gelöscht. Nur immer wenn ich Firefox starte öffnet Firefox die Startseite yeabests.cc. Das liegt daran das in der Verknüpfung es eingetragen wurde, siehe Screenshot: hxxp://prntscr.com/cc1kdb Nur wenn ich das ändere ändert es sich nach spätestens 30 Minuten oder nach einem Systemneustart zurück. Auch in Programmen wie Steam kommt einfach Werbung. Screenshot: hxxp://prntscr.com/cc22t3

Bitte um Hilfe

Liebe Grüße, Deniz P.

cosinus 30.08.2016 13:11
Zitat:
ich habe mir "leider" ein Programm von einer nicht vertrauenswürdigen Seite heruntergeladen.
Was bitte hast du dir genau von wo runtergeladen?

KiwiLink 30.08.2016 13:19
Zitat:
Zitat von cosinus (Beitrag 1607549)
Was bitte hast du dir genau von wo runtergeladen?
Einen Crack von Microsoft Office von Pirate Bay. War dumm ich weiß -_-

cosinus 30.08.2016 13:48
Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

KiwiLink 30.08.2016 15:18
Okey, hier die FRST.txt:
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 29-08-2016
durchgeführt von Kiwi☺ (Administrator) auf KIWINATOR (30-08-2016 16:11:52)
Gestartet von C:\Users\Kiwi\Downloads
Geladene Profile: Kiwi☺ (Verfügbare Profile: Kiwi☺)
Platform: Windows 10 Pro Version 1511 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Windows\System32\PnkBstrA.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(MSI) C:\Windows\SysWOW64\muachost.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\OSD\x64\MsiGamingOSD_x64.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\OSD\x86\MsiGamingOSD_x86.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe
(Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.4.0.1\Lightshot.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(TeamSpeak Systems GmbH) C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.10586.486_none_7640e086266ea227\TiWorker.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1767944 2016-08-30] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-05-26] (Adobe Systems Incorporated)
HKLM\...\Run: [emsisoft anti-malware] => c:\program files\emsisoft anti-malware\a2guard.exe [7241200 2016-07-26] (Emsisoft Ltd)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2016-07-07] (Razer Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2016-07-11] ()
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-23] (Valve Corporation)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23375200 2016-07-29] (Google)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [Spotify Web Helper] => C:\Users\Kiwi\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1523312 2016-08-25] (Spotify Ltd)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [Spotify] => C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe [6930544 2016-08-25] (Spotify Ltd)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8894680 2016-08-05] (Piriform Ltd)
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX64.dll [2016-06-30] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX64.dll [2016-06-30] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX64.dll [2016-06-30] ()
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} =>  Keine Datei
ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX32.dll [2016-06-30] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX32.dll [2016-06-30] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX32.dll [2016-06-30] ()
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
Startup: C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2016-08-27]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Kiwi\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{dba48a61-3617-451c-bd4d-748e1ed4b7b6}: [NameServer] 188.120.239.115,8.8.8.8
Tcpip\..\Interfaces\{dba48a61-3617-451c-bd4d-748e1ed4b7b6}: [DhcpNameServer] 192.168.178.1
ManualProxies:

Internet Explorer:
==================
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-08-08] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-08] (Oracle Corporation)
Handler: WSWSVCUchrome - Kein CLSID Wert

FireFox:
========
FF ProfilePath: C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-08] (Oracle Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-07-11] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-07-11] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Extension: (MEGA) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\firefox@mega.co.nz.xpi [2016-08-25]
FF Extension: (uBlock Origin) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\uBlock0@raymondhill.net.xpi [2016-08-07]
FF Extension: (ColorfulTabs) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2016-08-26]
FF Extension: (WOT) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-08-08]
FF Extension: (Amazon Assistant for Firefox) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\abb@amazon.com.xpi [2016-08-26]
FF Extension: (MEGA) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\firefox@mega.co.nz.xpi [2016-08-25]
FF Extension: (uBlock Origin) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\uBlock0@raymondhill.net.xpi [2016-08-30]
FF Extension: (ColorfulTabs) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2016-08-30]
FF Extension: (WOT) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-08-27]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9331168 2016-07-26] (Emsisoft Ltd)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1392648 2016-07-27] ()
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [227104 2016-07-28] (EasyAntiCheat Ltd)
R2 GamingApp_Service; C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe [39888 2016-05-19] (Micro-Star Int'l Co., Ltd.)
R2 GamingHotkey_Service; C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe [2019792 2016-05-16] (Micro-Star INT'L CO., LTD.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 MSI_ActiveX_Service; C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe [54200 2016-06-01] (Micro-Star INT'L CO., LTD.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2016-07-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2016-08-02] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2016-08-02] ()
R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [69760 2016-06-20] (Razer Inc.)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [188072 2015-11-05] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7183632 2016-07-18] (TeamViewer GmbH)
S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2015-10-30] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-07-01] (Microsoft Corporation)
S2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.2.4.1\WsAppService.exe [417792 2016-07-12] (Wondershare) [Datei ist nicht signiert]
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [730304 2016-01-11] (Wacom Technology, Corp.)
S2 KuaizipUpdateChecker; C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll [X]
S2 NmdReportsnqg.exe; "C:\Program Files (x86)\Clsuyvertoph\NmdReportsnqg.exe" {C25DA384-2010-45A4-A1ED-BFA540D4789B} {9DC74CD5-24EA-4ADE-9C42-608A8CE17116} [X]
S2 ziphost; c:\program files\ziptool\ziphost.dll [X] <==== ACHTUNG

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [130688 2016-07-22] (Samsung Electronics Co., Ltd.)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [115832 2016-07-21] (Emsisoft Ltd)
R3 I2cHkBurn; C:\Windows\system32\drivers\I2cHkBurn.sys [41760 2015-07-27] (FINTEK Corp.)
R3 KillerEth; C:\Windows\System32\drivers\e22w10x64.sys [156744 2016-07-27] (Qualcomm Atheros, Inc.)
R2 KuaiZipDrive; C:\Windows\system32\drivers\KuaiZipDrive.sys [92872 2016-08-27] (WinMount International Inc)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-08-30] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
R3 rzendpt; C:\Windows\System32\drivers\rzendpt.sys [51736 2016-06-23] (Razer Inc)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-09-22] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [130880 2015-12-14] (Razer, Inc.)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [164992 2016-07-22] (Samsung Electronics Co., Ltd.)
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-23] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ACHTUNG
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

NETSVCx32: HpSvc -> kein Dateipfad.

==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-08-30 16:11 - 2016-08-30 16:11 - 02397696 _____ (Farbar) C:\Users\Kiwi\Downloads\FRST64.exe
2016-08-30 16:11 - 2016-08-30 16:11 - 00019874 _____ C:\Users\Kiwi\Downloads\FRST.txt
2016-08-30 16:11 - 2016-08-30 16:11 - 00000000 ____D C:\FRST
2016-08-30 14:20 - 2016-08-30 14:20 - 00001171 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2016-08-30 14:02 - 2016-08-30 14:03 - 00000000 ____D C:\AdwCleaner
2016-08-30 14:02 - 2016-08-30 14:02 - 03826240 _____ C:\Users\Kiwi\Downloads\AdwCleaner_6.010.exe
2016-08-30 13:50 - 2016-08-30 13:50 - 00000000 ____D C:\Users\Kiwi\Desktop\Games icons
2016-08-30 13:47 - 2016-08-30 13:49 - 43836245 _____ C:\Users\Kiwi\Downloads\Games icons.rar
2016-08-30 13:13 - 2016-08-30 13:13 - 01767944 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2016-08-30 12:46 - 2016-08-30 12:46 - 00000000 ___HD C:\$SysReset
2016-08-30 01:17 - 2016-08-30 13:11 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JAP
2016-08-30 01:17 - 2016-08-30 01:17 - 00347664 _____ (JAP-Team) C:\Users\Kiwi\Downloads\japsetup.exe
2016-08-30 01:17 - 2016-08-30 01:17 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\JonDo
2016-08-29 23:40 - 2016-08-29 23:40 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\.mono
2016-08-29 23:40 - 2016-08-29 23:40 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Colossal Order
2016-08-29 23:40 - 2016-08-29 23:40 - 00000000 ____D C:\ProgramData\.mono
2016-08-29 22:53 - 2016-08-29 22:54 - 133940295 _____ C:\Users\Kiwi\Downloads\KiWiFX Motion Pack.rar
2016-08-29 22:19 - 2016-08-29 22:19 - 16132140 _____ C:\Users\Kiwi\Desktop\Community Server.mp4
2016-08-29 21:12 - 2016-08-29 21:12 - 00000000 ____D C:\Users\Kiwi\.thumbnails
2016-08-29 21:09 - 2016-08-29 21:09 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Blender
2016-08-29 21:09 - 2016-08-29 21:09 - 00000000 ____D C:\Program Files\Blender Foundation
2016-08-29 21:06 - 2016-08-29 21:07 - 83722580 _____ C:\Users\Kiwi\Downloads\blender-2.77a-windows64.msi
2016-08-29 15:45 - 2016-08-29 15:46 - 00000000 ____D C:\Users\Kiwi\Downloads\PokeBuddy
2016-08-29 15:37 - 2016-08-29 15:37 - 00000000 ____D C:\Users\Kiwi\AppData\Local\GMap.NET
2016-08-29 15:36 - 2016-08-30 01:00 - 00000000 ____D C:\Users\Kiwi\Desktop\PokeBuddy
2016-08-29 15:35 - 2016-08-29 15:36 - 28593836 _____ C:\Users\Kiwi\Desktop\PokeBuddy.rar
2016-08-29 14:23 - 2016-08-29 14:23 - 00000458 _____ C:\Users\Kiwi\Downloads\autoconfig
2016-08-29 14:19 - 2016-08-30 01:36 - 00002937 _____ C:\Users\Kiwi\Desktop\bewerbung.txt
2016-08-29 13:11 - 2016-08-29 13:11 - 00000222 _____ C:\Users\Kiwi\Desktop\Cities Skylines.url
2016-08-29 11:18 - 2016-08-29 11:18 - 00003917 _____ C:\Users\Kiwi\Desktop\M.I.K.E.bat
2016-08-28 17:18 - 2016-08-28 17:18 - 00000000 ____D C:\Users\Kiwi\Documents\MAGIX Downloads
2016-08-28 17:17 - 2016-08-28 17:19 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\MAGIX
2016-08-28 17:17 - 2016-08-28 17:19 - 00000000 ____D C:\ProgramData\MAGIX
2016-08-28 17:17 - 2016-08-28 17:18 - 00000000 ___RD C:\Users\Kiwi\Documents\MAGIX
2016-08-28 17:17 - 2016-08-28 17:17 - 00001306 _____ C:\Users\Public\Desktop\MAGIX Music Maker Premium.lnk
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Users\Public\Documents\MAGIX
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Users\Kiwi\Documents\MAGIX_MusicEditor
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Xara
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Program Files (x86)\MAGIX
2016-08-28 17:16 - 2016-08-28 17:16 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2016-08-28 16:17 - 2016-08-28 16:17 - 00002858 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-08-28 16:17 - 2016-08-28 16:17 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-08-28 16:17 - 2016-08-28 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-08-28 16:17 - 2016-08-28 16:17 - 00000000 ____D C:\Program Files\CCleaner
2016-08-28 16:16 - 2016-08-28 16:16 - 08228024 _____ (Piriform Ltd) C:\Users\Kiwi\Downloads\ccsetup521pro.exe
2016-08-28 16:13 - 2016-08-28 16:53 - 699071640 _____ (MAGIX Software GmbH) C:\Users\Kiwi\Downloads\music_maker_2017_premium_dlv_computerbild_de_20160801_09-36.exe
2016-08-28 13:36 - 2016-08-30 14:18 - 00000408 _____ C:\Windows\Tasks\update-sys.job
2016-08-28 13:36 - 2016-08-30 13:18 - 00000408 _____ C:\Windows\Tasks\update-S-1-5-21-2015112042-96394298-4154293379-1001.job
2016-08-28 13:36 - 2016-08-28 13:36 - 00003394 _____ C:\Windows\System32\Tasks\update-S-1-5-21-2015112042-96394298-4154293379-1001
2016-08-28 13:36 - 2016-08-28 13:36 - 00003334 _____ C:\Windows\System32\Tasks\update-sys
2016-08-28 13:36 - 2016-08-28 13:36 - 00000424 _____ C:\Users\Kiwi\AppData\Local\UserProducts.xml
2016-08-28 13:36 - 2016-08-28 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightshot
2016-08-28 13:36 - 2016-08-28 13:36 - 00000000 ____D C:\Program Files (x86)\Skillbrains
2016-08-28 13:35 - 2016-08-28 13:35 - 02575272 _____ (Skillbrains ) C:\Users\Kiwi\Downloads\setup-lightshot.exe
2016-08-28 13:29 - 2016-08-28 13:29 - 00403626 _____ C:\Users\Kiwi\Downloads\gobold.zip
2016-08-28 13:28 - 2016-08-28 13:28 - 00026118 _____ C:\Users\Kiwi\Downloads\code.zip
2016-08-28 13:10 - 2016-08-28 13:14 - 194514997 _____ C:\Users\Kiwi\Downloads\HeartFX mini sync pack.rar
2016-08-28 04:07 - 2016-08-28 04:07 - 17404104 _____ C:\Users\Kiwi\Downloads\SypeFX_Lights.rar
2016-08-28 04:07 - 2016-08-28 04:07 - 00937967 _____ C:\Users\Kiwi\Downloads\CC Pack Josh S. .zip
2016-08-28 03:49 - 2016-08-28 03:50 - 16762145 _____ C:\Users\Kiwi\Downloads\Sync Pack - PabloDesigns.zip
2016-08-28 03:32 - 2016-08-28 03:33 - 14811592 _____ C:\Users\Kiwi\Downloads\Free Shockwave Pack (DonatFX).zip
2016-08-28 03:15 - 2016-08-28 04:08 - 134365397 _____ C:\Users\Kiwi\Downloads\24 Epic Animation For Title - GW7.zip
2016-08-28 02:59 - 2016-08-28 02:59 - 00000000 ____D C:\ProgramData\Emsisoft
2016-08-28 02:57 - 2016-08-30 15:55 - 00000000 ____D C:\Program Files\Emsisoft Anti-Malware
2016-08-28 02:57 - 2016-08-28 02:57 - 00000937 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2016-08-28 02:57 - 2016-08-28 02:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2016-08-28 02:50 - 2016-08-28 02:55 - 277246696 _____ (Emsisoft Ltd. ) C:\Users\Kiwi\Downloads\EmsisoftAntiMalwareSetup.exe
2016-08-27 14:13 - 2016-08-29 16:01 - 00001135 _____ C:\Users\Kiwi\Desktop\nativelog.txt
2016-08-27 04:23 - 2016-08-27 12:24 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Ludashi
2016-08-27 04:08 - 2016-08-28 03:24 - 00000000 ____D C:\Program Files (x86)\LdsLite
2016-08-27 04:08 - 2016-08-27 04:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\鲁大师游戏库
2016-08-27 03:49 - 2016-08-27 03:49 - 11374528 _____ (VS Revo Group ) C:\Users\Kiwi\Downloads\RevoUninProSetup-316.exe
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\Users\Kiwi\AppData\Local\VS Revo Group
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\ProgramData\VS Revo Group
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\Program Files\VS Revo Group
2016-08-27 03:49 - 2009-12-30 11:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys
2016-08-27 03:44 - 2016-08-27 03:44 - 00003252 _____ C:\Windows\System32\Tasks\{6B0496CA-37FE-4410-999F-9949EE20FA96}
2016-08-27 03:35 - 2016-08-30 16:03 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-27 03:33 - 2016-08-27 12:29 - 00001165 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-08-27 03:33 - 2016-08-27 03:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-08-27 03:33 - 2016-08-27 03:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-08-27 03:33 - 2016-08-27 03:33 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-08-27 03:33 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-08-27 03:33 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-08-27 03:33 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-08-27 03:32 - 2016-08-27 03:33 - 22851472 _____ (Malwarebytes ) C:\Users\Kiwi\Downloads\mbam-setup-2.2.1.1043.exe
2016-08-27 03:30 - 2016-08-27 03:30 - 00003278 _____ C:\Windows\System32\Tasks\{8E5FF780-BF2D-4671-871B-39F4F48FA20A}
2016-08-27 03:29 - 2016-08-27 03:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\净广大师
2016-08-27 03:26 - 2016-08-28 03:24 - 00000000 ____D C:\Program Files\¿ìѹ
2016-08-27 03:26 - 2016-08-27 12:29 - 00000926 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\¿ìѹ.lnk
2016-08-27 03:26 - 2016-08-27 03:48 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Kuaizip
2016-08-27 03:26 - 2016-08-27 03:26 - 00092872 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys
2016-08-27 03:26 - 2016-08-27 03:26 - 00001595 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2016-08-27 03:26 - 2016-08-27 03:26 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Softlink
2016-08-27 03:26 - 2016-08-23 09:45 - 00081792 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\Windows\system32\Drivers\ucguard.sys
2016-08-27 03:25 - 2016-08-27 03:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Compress
2016-08-27 03:24 - 2016-08-27 03:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-08-27 03:24 - 2016-08-27 03:24 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-08-27 03:23 - 2016-08-28 02:47 - 00187904 _____ C:\Windows\rsrcs.dll
2016-08-27 03:23 - 2016-08-27 04:09 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Apps\2.0
2016-08-27 03:21 - 2016-08-27 03:20 - 00001550 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-08-27 02:33 - 2016-08-27 02:33 - 00000000 ____D C:\Users\Kiwi\Documents\Camtasia Studio
2016-08-27 02:33 - 2016-08-27 02:33 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\TechSmith
2016-08-27 02:33 - 2016-08-27 02:33 - 00000000 ____D C:\Users\Kiwi\AppData\Local\TechSmith
2016-08-27 02:32 - 2016-08-27 12:29 - 00001235 _____ C:\Users\Public\Desktop\Camtasia Studio 8.lnk
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\ProgramData\TechSmith
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\ProgramData\regid.1995-08.com.techsmith
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\Program Files (x86)\TechSmith
2016-08-27 02:28 - 2016-08-27 02:30 - 258696506 _____ C:\Users\Kiwi\Downloads\Camtasia Studio 8.rar
2016-08-27 02:23 - 2016-08-27 02:23 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\SmartSteamEmu
2016-08-27 02:23 - 2016-08-27 02:23 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Dry Cactus
2016-08-27 02:21 - 2016-08-27 02:22 - 130445508 _____ C:\Users\Kiwi\Downloads\Poly Bridge.rar
2016-08-27 01:52 - 2016-08-27 01:52 - 00001135 _____ C:\Users\Kiwi\Downloads\nativelog.txt
2016-08-27 01:14 - 2016-08-27 01:14 - 00000000 ____D C:\Users\Kiwi\AppData\Local\LooksBuilder
2016-08-27 00:59 - 2016-08-27 01:01 - 50359510 _____ C:\Users\Kiwi\Downloads\500 SUB EDITING PACK(2).rar
2016-08-27 00:55 - 2016-08-27 01:02 - 419430400 _____ C:\Users\Kiwi\Downloads\EDITINGPACK.part1.rar
2016-08-27 00:26 - 2016-08-30 00:38 - 00000000 ____D C:\Users\Kiwi\Desktop\KiwiLink
2016-08-27 00:06 - 2016-08-27 00:07 - 46853365 _____ C:\Users\Kiwi\Downloads\Banner 7 By Nelson Designs.zip
2016-08-26 20:57 - 2016-08-26 22:38 - 665443937 _____ C:\Users\Kiwi\Downloads\NetworkRPGMod.rar
2016-08-26 02:04 - 2016-08-27 12:29 - 00001161 _____ C:\Users\Kiwi\Desktop\MEGAsync.lnk
2016-08-26 02:04 - 2016-08-26 02:04 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MEGAsync
2016-08-26 02:04 - 2016-08-26 02:04 - 00000000 ____D C:\Users\Kiwi\AppData\Local\MEGAsync
2016-08-26 02:04 - 2016-08-26 02:04 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Mega Limited
2016-08-26 01:56 - 2016-08-26 01:56 - 12903336 _____ (MEGA Limited) C:\Users\Kiwi\Downloads\MEGAsyncSetup.exe
2016-08-26 01:50 - 2016-08-26 12:35 - 508035072 _____ C:\Users\Kiwi\Downloads\Far Cry 4.zip
2016-08-25 23:38 - 2016-08-26 01:15 - 04718592 _____ C:\Users\Kiwi\Downloads\Planet Coaster.rar
2016-08-25 17:10 - 2016-08-25 17:10 - 05536082 _____ C:\Users\Kiwi\Downloads\RAGEPluginHook_0_45_1000_9441_ALPHA.zip
2016-08-25 16:37 - 2016-08-25 16:37 - 00000000 ____D C:\Users\Kiwi\Downloads\2014_DODGE_CHARGER_LSSD%20_%20V1.2L
2016-08-25 12:41 - 2016-08-25 12:42 - 36080281 _____ C:\Users\Kiwi\Downloads\2014_DODGE_CHARGER_LSSD%20_%20V1.2L.zip
2016-08-25 05:08 - 2016-08-03 13:14 - 01505984 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-08-25 05:08 - 2016-08-03 13:14 - 00092352 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-08-25 05:08 - 2016-08-03 13:14 - 00050368 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-08-25 05:08 - 2016-08-03 12:36 - 07469408 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-08-25 05:08 - 2016-08-03 12:36 - 00099680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2016-08-25 05:08 - 2016-08-03 12:36 - 00037744 _____ (Microsoft Corporation) C:\Windows\system32\wldp.dll
2016-08-25 05:08 - 2016-08-03 12:30 - 00026408 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-08-25 05:08 - 2016-08-03 12:23 - 00693600 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupEngine.dll
2016-08-25 05:08 - 2016-08-03 12:23 - 00115040 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupApi.dll
2016-08-25 05:08 - 2016-08-03 12:22 - 00808288 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
2016-08-25 05:08 - 2016-08-03 12:22 - 00465248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-08-25 05:08 - 2016-08-03 12:22 - 00331616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2016-08-25 05:08 - 2016-08-03 12:21 - 03675512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-08-25 05:08 - 2016-08-03 12:21 - 00566112 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2016-08-25 05:08 - 2016-08-03 12:21 - 00303216 _____ (Microsoft Corporation) C:\Windows\system32\LockAppHost.exe
2016-08-25 05:08 - 2016-08-03 12:20 - 01540224 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2016-08-25 05:08 - 2016-08-03 12:20 - 00692136 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2016-08-25 05:08 - 2016-08-03 12:19 - 00604928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-08-25 05:08 - 2016-08-03 12:19 - 00161632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-08-25 05:08 - 2016-08-03 12:13 - 01988448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-08-25 05:08 - 2016-08-03 12:13 - 00576864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-08-25 05:08 - 2016-08-03 12:13 - 00393056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-08-25 05:08 - 2016-08-03 11:51 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\tdlrecover.exe
2016-08-25 05:08 - 2016-08-03 11:51 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2016-08-25 05:08 - 2016-08-03 11:46 - 22384128 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-08-25 05:08 - 2016-08-03 11:44 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
2016-08-25 05:08 - 2016-08-03 11:44 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2016-08-25 05:08 - 2016-08-03 11:44 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\musdialoghandlers.dll
2016-08-25 05:08 - 2016-08-03 11:43 - 16985088 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2016-08-25 05:08 - 2016-08-03 11:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryClient.dll
2016-08-25 05:08 - 2016-08-03 11:41 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryBroker.dll
2016-08-25 05:08 - 2016-08-03 11:40 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\VEDataLayerHelpers.dll
2016-08-25 05:08 - 2016-08-03 11:40 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\MusNotificationUx.exe
2016-08-25 05:08 - 2016-08-03 11:40 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2016-08-25 05:08 - 2016-08-03 11:39 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-08-25 05:08 - 2016-08-03 11:39 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\BluetoothApis.dll
2016-08-25 05:08 - 2016-08-03 11:38 - 00379392 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2016-08-25 05:08 - 2016-08-03 11:37 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\IdCtrls.dll
2016-08-25 05:08 - 2016-08-03 11:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupSvc.dll
2016-08-25 05:08 - 2016-08-03 11:36 - 00198144 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-08-25 05:08 - 2016-08-03 11:35 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-08-25 05:08 - 2016-08-03 11:35 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2016-08-25 05:08 - 2016-08-03 11:33 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\VEEventDispatcher.dll
2016-08-25 05:08 - 2016-08-03 11:31 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\tileobjserver.dll
2016-08-25 05:08 - 2016-08-03 11:31 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\wevtutil.exe
2016-08-25 05:08 - 2016-08-03 11:30 - 00515072 _____ (Microsoft Corporation) C:\Windows\system32\OneDriveSettingSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 11:29 - 14252544 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-08-25 05:08 - 2016-08-03 11:29 - 02127360 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-08-25 05:08 - 2016-08-03 11:29 - 01500160 _____ (Microsoft Corporation) C:\Windows\system32\RecoveryDrive.exe
2016-08-25 05:08 - 2016-08-03 11:29 - 01387520 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2016-08-25 05:08 - 2016-08-03 11:29 - 00784384 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-08-25 05:08 - 2016-08-03 11:28 - 01213440 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2016-08-25 05:08 - 2016-08-03 11:28 - 00848896 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-08-25 05:08 - 2016-08-03 11:27 - 07536640 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2016-08-25 05:08 - 2016-08-03 11:27 - 01717760 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2016-08-25 05:08 - 2016-08-03 11:27 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2016-08-25 05:08 - 2016-08-03 11:20 - 13390336 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-08-25 05:08 - 2016-08-03 11:18 - 06974464 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-08-25 05:08 - 2016-08-03 11:18 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2016-08-25 05:08 - 2016-08-03 11:18 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-08-25 05:08 - 2016-08-03 11:17 - 02175488 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-08-25 05:08 - 2016-08-03 11:16 - 05123072 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2016-08-25 05:08 - 2016-08-03 11:16 - 03589120 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-08-25 05:08 - 2016-08-03 11:16 - 02635776 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2016-08-25 05:08 - 2016-08-03 11:16 - 01732096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-08-25 05:08 - 2016-08-03 11:15 - 07833088 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-08-25 05:08 - 2016-08-03 11:14 - 04895232 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-08-25 05:08 - 2016-08-03 11:14 - 01997824 _____ (Microsoft Corporation) C:\Windows\system32\ActiveSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 11:13 - 03025920 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-08-25 05:08 - 2016-08-03 11:13 - 02280960 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-08-25 05:08 - 2016-08-03 11:12 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepository.dll
2016-08-25 05:08 - 2016-08-03 11:11 - 04171264 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-08-25 05:08 - 2016-08-03 07:52 - 00034088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wldp.dll
2016-08-25 05:08 - 2016-08-03 07:34 - 00501592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupEngine.dll
2016-08-25 05:08 - 2016-08-03 07:34 - 00084832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupApi.dll
2016-08-25 05:08 - 2016-08-03 07:33 - 00051128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsNativeApi.dll
2016-08-25 05:08 - 2016-08-03 07:31 - 02921368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-08-25 05:08 - 2016-08-03 07:31 - 00957608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-08-25 05:08 - 2016-08-03 07:31 - 00703840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
2016-08-25 05:08 - 2016-08-03 07:30 - 21123320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-08-25 05:08 - 2016-08-03 07:30 - 00465760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2016-08-25 05:08 - 2016-08-03 07:30 - 00255168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LockAppHost.exe
2016-08-25 05:08 - 2016-08-03 06:57 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdlrecover.exe
2016-08-25 05:08 - 2016-08-03 06:48 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll
2016-08-25 05:08 - 2016-08-03 06:47 - 13018112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2016-08-25 05:08 - 2016-08-03 06:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepositoryClient.dll
2016-08-25 05:08 - 2016-08-03 06:44 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepositoryBroker.dll
2016-08-25 05:08 - 2016-08-03 06:42 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BluetoothApis.dll
2016-08-25 05:08 - 2016-08-03 06:40 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IdCtrls.dll
2016-08-25 05:08 - 2016-08-03 06:39 - 19351040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-08-25 05:08 - 2016-08-03 06:37 - 00219136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll
2016-08-25 05:08 - 2016-08-03 06:35 - 00178688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wevtutil.exe
2016-08-25 05:08 - 2016-08-03 06:34 - 00792064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-08-25 05:08 - 2016-08-03 06:34 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OneDriveSettingSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 06:33 - 18677760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-08-25 05:08 - 2016-08-03 06:33 - 02050048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-08-25 05:08 - 2016-08-03 06:33 - 00687616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-08-25 05:08 - 2016-08-03 06:32 - 12585984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2016-08-25 05:08 - 2016-08-03 06:32 - 01467392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2016-08-25 05:08 - 2016-08-03 06:32 - 00434688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2016-08-25 05:08 - 2016-08-03 06:31 - 06743040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2016-08-25 05:08 - 2016-08-03 06:31 - 00705536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-08-25 05:08 - 2016-08-03 06:29 - 12133376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-08-25 05:08 - 2016-08-03 06:28 - 03663360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-08-25 05:08 - 2016-08-03 06:25 - 05323776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-08-25 05:08 - 2016-08-03 06:25 - 04078080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2016-08-25 05:08 - 2016-08-03 06:23 - 05660672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-08-25 05:08 - 2016-08-03 06:23 - 01799680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2016-08-25 05:08 - 2016-08-03 06:22 - 02501120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-08-25 05:08 - 2016-08-03 06:22 - 01502208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-08-25 05:08 - 2016-08-03 06:21 - 01708032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActiveSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 06:19 - 02180096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepository.dll
2016-08-25 05:07 - 2016-08-03 12:22 - 01322760 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-08-25 05:07 - 2016-08-03 12:22 - 00058408 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.dll
2016-08-25 05:07 - 2016-08-03 12:21 - 22561256 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-08-25 05:07 - 2016-08-03 12:11 - 00422744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2016-08-25 05:07 - 2016-08-03 11:40 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\bthserv.dll
2016-08-25 05:07 - 2016-08-03 11:38 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\MusUpdateHandlers.dll
2016-08-25 05:07 - 2016-08-03 11:36 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-08-25 05:07 - 2016-08-03 11:34 - 00383488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-08-25 05:07 - 2016-08-03 11:33 - 00339968 _____ (Microsoft Corporation) C:\Windows\system32\SensorService.dll
2016-08-25 05:07 - 2016-08-03 11:31 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\SensorsApi.dll
2016-08-25 05:07 - 2016-08-03 11:30 - 24613888 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-08-25 05:07 - 2016-08-03 11:30 - 00970752 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-08-25 05:07 - 2016-08-03 11:28 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2016-08-25 05:07 - 2016-08-03 11:27 - 01752576 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-08-25 05:07 - 2016-08-03 06:37 - 00335872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-08-25 05:07 - 2016-08-03 06:35 - 00286208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsApi.dll
2016-08-25 05:07 - 2016-08-03 06:32 - 01526272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-08-25 04:20 - 2016-08-27 03:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-08-25 04:05 - 2016-08-25 04:05 - 00000219 _____ C:\Users\Kiwi\Desktop\Portal 2.url
2016-08-25 03:40 - 2016-08-25 03:40 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2016-08-25 03:40 - 2016-08-25 03:40 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2016-08-25 03:36 - 2016-08-25 03:32 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMHVE.DLL
2016-08-25 03:36 - 2016-08-25 03:32 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BHVE.DLL
2016-08-25 03:36 - 2016-08-25 03:32 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2016-08-25 03:35 - 2016-08-27 12:29 - 00000997 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2016-08-25 03:35 - 2016-08-25 03:35 - 00000000 ____D C:\Program Files (x86)\epson
2016-08-25 03:35 - 2012-07-24 00:00 - 00466432 _____ (Seiko Epson Corporation) C:\Windows\system32\esxw2ud.dll
2016-08-25 03:35 - 2009-10-16 00:00 - 00132560 _____ (Seiko Epson Corporation) C:\Windows\system32\esdevapp.exe
2016-08-25 03:35 - 2009-10-16 00:00 - 00013824 _____ (Seiko Epson Corporation) C:\Windows\system32\esxcdev.dll
2016-08-08 15:41 - 2016-08-08 15:41 - 00000000 ____D C:\Users\Kiwi\Downloads\Telegram Desktop
2016-08-08 12:33 - 2016-08-29 21:07 - 00000000 ____D C:\Users\Kiwi\.junique
2016-08-08 12:33 - 2016-08-29 21:07 - 00000000 ____D C:\Program Files (x86)\ArmA3Sync
2016-08-08 12:33 - 2016-08-27 12:29 - 00001082 _____ C:\Users\Public\Desktop\ArmA3Sync.lnk
2016-08-08 12:33 - 2016-08-08 12:33 - 03591433 _____ C:\Users\Kiwi\Downloads\ArmA3Sync-launcher-and-addons-synchronization-version-1.5.80.7z
2016-08-08 12:33 - 2016-08-08 12:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArmA3Sync
2016-08-08 02:13 - 2016-08-08 02:13 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\WTablet
2016-08-08 02:13 - 2016-08-08 02:13 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Wacom
2016-08-08 02:13 - 2016-08-08 02:13 - 00000000 ____D C:\Users\Kiwi\.android
2016-08-08 01:40 - 2016-08-27 03:31 - 00000000 ____D C:\Users\Kiwi\Downloads\Microsoft Office 2016 Professional Plus X64-CYGiSO
2016-08-08 01:34 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Eclipse
2016-08-08 01:34 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\.tooling
2016-08-08 01:33 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\java_workspace
2016-08-08 01:31 - 2016-08-27 12:29 - 00001113 _____ C:\Users\Kiwi\Desktop\Eclipse Java Neon.lnk
2016-08-08 01:31 - 2016-08-08 01:31 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eclipse
2016-08-08 01:30 - 2016-08-08 01:30 - 00000000 ____D C:\Users\Kiwi\eclipse
2016-08-08 01:29 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\.p2
2016-08-08 01:29 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\.eclipse
2016-08-08 01:28 - 2016-08-08 01:29 - 00000000 ____D C:\Users\Kiwi\.oracle_jre_usage
2016-08-08 01:28 - 2016-08-08 01:28 - 00110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Sun
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Sun
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\ProgramData\Oracle
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-08-08 01:27 - 2016-08-08 01:28 - 00000000 ____D C:\Program Files\Java
2016-08-08 01:27 - 2016-08-08 01:27 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Oracle
2016-08-08 01:25 - 2016-08-08 01:27 - 203084344 _____ (Oracle Corporation) C:\Users\Kiwi\Downloads\jdk-8u101-windows-x64.exe
2016-08-08 01:23 - 2016-08-08 01:24 - 46954408 _____ C:\Users\Kiwi\Downloads\eclipse-inst-win64.exe
2016-08-07 23:51 - 2016-08-27 12:29 - 00001771 _____ C:\Users\Public\Desktop\Prison Architect.lnk
2016-08-07 23:51 - 2016-08-07 23:52 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Introversion
2016-08-07 23:51 - 2016-08-07 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prison Architect [GOG.com]
2016-08-07 23:51 - 2016-08-07 23:51 - 00000000 ____D C:\GOG Games
2016-08-07 23:47 - 2016-08-07 23:51 - 343771056 _____ (GOG.com ) C:\Users\Kiwi\Downloads\setup_prison_architect_2.6.0.9.exe
2016-08-07 23:39 - 2016-08-07 23:39 - 00646152 _____ (Amazon Web Services, Inc.) C:\Users\Kiwi\Downloads\LumberyardInstaller1.3.0.1.exe
2016-08-07 18:20 - 2016-08-07 18:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom Tablett
2016-08-07 18:20 - 2016-08-07 18:20 - 00000000 ____D C:\Program Files\TabletPlugins
2016-08-07 18:20 - 2016-08-07 18:20 - 00000000 ____D C:\Program Files (x86)\TabletPlugins
2016-08-07 18:19 - 2016-08-07 18:20 - 00000000 ____D C:\Program Files\Tablet
2016-08-07 18:19 - 2016-01-11 19:30 - 02103488 _____ (Wacom Technology, Corp.) C:\Windows\system32\WacomMT.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 02077888 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 02071232 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Touch_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01966272 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wintab32.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01683648 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\WacomMT.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01681600 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01674432 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Touch_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01571520 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wintab32.dll
2016-08-07 18:19 - 2015-11-30 19:34 - 00103616 _____ (Wacom Technology) C:\Windows\system32\Drivers\wachidrouter.sys
2016-08-07 18:19 - 2015-11-30 19:34 - 00015040 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys
2016-08-07 18:19 - 2015-11-30 19:34 - 00014016 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys
2016-08-07 18:19 - 2012-12-12 00:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\wdfcoinstaller01009.dll
2016-08-07 18:19 - 2012-12-12 00:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wdfcoinstaller01009.dll
2016-08-07 18:03 - 2016-08-07 23:09 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\.minecraft
2016-08-07 18:03 - 2016-08-07 18:03 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\java
2016-08-07 18:02 - 2016-08-27 12:29 - 00001024 _____ C:\Users\Public\Desktop\Minecraft.lnk
2016-08-07 18:02 - 2016-08-07 18:03 - 00000000 ____D C:\Program Files (x86)\Minecraft
2016-08-07 18:02 - 2016-08-07 18:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2016-08-07 16:02 - 2016-08-07 16:02 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\vibranceGUI
2016-08-06 21:18 - 2016-08-08 01:40 - 00000000 ____D C:\Users\Kiwi\Desktop\OpenHardwareMonitor
2016-08-06 21:17 - 2016-08-06 21:17 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\MSI
2016-08-06 20:25 - 2016-08-06 20:25 - 00151552 _____ C:\Windows\SysWOW64\nvRegDev.dll
2016-08-06 20:25 - 2016-08-06 20:25 - 00061440 _____ C:\Windows\SysWOW64\nvPhotoshopUtil.dll
2016-08-06 20:25 - 2016-08-06 20:25 - 00040960 _____ C:\Windows\SysWOW64\nvISWOW64.dll
2016-08-06 20:20 - 2016-08-06 20:20 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Adobe
2016-08-06 20:09 - 2016-08-27 12:29 - 00001129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2015.lnk
2016-08-06 19:43 - 2016-08-27 12:29 - 00001082 _____ C:\Users\Public\Desktop\Notepad++.lnk
2016-08-06 19:43 - 2016-08-06 19:44 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Notepad++
2016-08-06 19:43 - 2016-08-06 19:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2016-08-06 19:43 - 2016-08-06 19:43 - 00000000 ____D C:\Program Files (x86)\Notepad++
2016-08-06 18:28 - 2016-08-30 15:55 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Spotify
2016-08-06 18:28 - 2016-08-27 12:29 - 00001884 _____ C:\Users\Kiwi\Desktop\Spotify.lnk
2016-08-06 18:28 - 2016-08-27 12:29 - 00001870 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2016-08-06 18:27 - 2016-08-30 16:09 - 00000863 _____ C:\Users\Kiwi\Desktop\Tor Browser.lnk
2016-08-06 18:27 - 2016-08-30 16:09 - 00000863 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2016-08-06 18:27 - 2016-08-30 16:00 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Spotify
2016-08-04 01:27 - 2016-08-04 01:27 - 00000218 _____ C:\Users\Kiwi\Desktop\Team Fortress Classic.url
2016-08-04 01:12 - 2016-08-04 01:12 - 00000220 _____ C:\Users\Kiwi\Desktop\Garry's Mod.url
2016-08-04 01:04 - 2016-08-04 01:49 - 00000000 ____D C:\Users\Kiwi\Documents\TrinusVR
2016-08-04 01:04 - 2016-08-04 01:04 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Odd_Sheep_Ltd
2016-08-04 00:32 - 2016-08-04 00:32 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-08-04 00:32 - 2016-08-04 00:32 - 00000000 ____D C:\ProgramData\Samsung
2016-08-04 00:31 - 2016-08-27 12:29 - 00002036 _____ C:\Users\Public\Desktop\Samsung Kies 3.lnk
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Users\Kiwi\Documents\samsung
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Samsung
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Program Files (x86)\Samsung
2016-08-04 00:31 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2016-08-03 19:51 - 2016-08-27 12:29 - 00001875 _____ C:\Users\Public\Desktop\Dragon Eye.lnk
2016-08-03 19:51 - 2016-08-27 12:29 - 00001188 _____ C:\Users\Public\Desktop\MSI Gaming APP.lnk
2016-08-03 19:51 - 2016-08-03 19:51 - 00003132 _____ C:\Windows\System32\Tasks\MSIOSDx86_Host
2016-08-03 19:51 - 2016-08-03 19:51 - 00003132 _____ C:\Windows\System32\Tasks\MSIOSDx64_Host
2016-08-03 19:51 - 2016-08-03 19:51 - 00003058 _____ C:\Windows\System32\Tasks\MSISW_Host
2016-08-03 19:51 - 2016-08-03 19:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI
2016-08-03 19:51 - 2016-08-03 19:51 - 00000000 ____D C:\Program Files\MSI
2016-08-03 19:51 - 2016-08-03 19:51 - 00000000 ____D C:\Program Files (x86)\Intel
2016-08-03 19:51 - 2015-08-18 09:51 - 01692840 _____ (MSI) C:\Windows\SysWOW64\muachost.exe
2016-08-03 19:50 - 2016-08-29 14:47 - 00000000 ____D C:\MSI
2016-08-03 19:50 - 2016-08-03 19:51 - 00000000 ____D C:\Program Files (x86)\MSI
2016-08-03 19:50 - 2015-07-27 01:37 - 00041760 _____ (FINTEK Corp.) C:\Windows\system32\Drivers\I2cHkBurn.sys
2016-08-03 19:50 - 2015-07-27 01:37 - 00031520 _____ (TODO: <公司名稱>) C:\Windows\system32\FintekIcon1.dll
2016-08-03 17:54 - 2016-08-27 12:29 - 00001282 _____ C:\Users\Kiwi\Desktop\MM Server Picker.lnk
2016-08-03 17:54 - 2016-08-03 17:54 - 00000000 ____D C:\Program Files (x86)\Matchmaking Server Picker
2016-08-03 13:24 - 2016-08-30 12:49 - 00000000 ____D C:\Users\Kiwi\Documents\Assassin's Creed Unity
2016-08-03 05:12 - 2016-08-27 02:52 - 00000000 ____D C:\Users\Kiwi\Desktop\Icons
2016-08-03 05:06 - 2016-08-03 05:06 - 00000233 _____ C:\Users\Kiwi\Desktop\Assassin’s Creed Unity.url
2016-08-03 05:04 - 2016-08-29 11:03 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Ubisoft Game Launcher
2016-08-03 05:04 - 2016-08-27 12:29 - 00001274 _____ C:\Users\Kiwi\Desktop\Uplay.lnk
2016-08-03 05:04 - 2016-08-03 05:04 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2016-08-03 05:04 - 2016-08-03 05:04 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2016-08-03 00:50 - 2016-08-03 00:54 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\NVIDIA
2016-08-03 00:50 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Sony
2016-08-03 00:50 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Publish Providers
2016-08-03 00:50 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Apple Computer
2016-08-03 00:48 - 2016-08-27 12:29 - 00001105 _____ C:\Users\Public\Desktop\Vegas Pro 13.0 (64-bit).lnk
2016-08-03 00:48 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\ProgramData\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\Program Files\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\Program Files (x86)\Sony
2016-08-03 00:25 - 2016-08-29 21:26 - 00053248 ___SH C:\Users\Kiwi\Downloads\Thumbs.db
2016-08-02 23:58 - 2016-08-27 12:41 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Audacity
2016-08-02 23:58 - 2016-08-27 12:29 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-08-02 23:58 - 2016-08-27 12:29 - 00001070 _____ C:\Users\Public\Desktop\Audacity.lnk
2016-08-02 23:58 - 2016-08-02 23:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Audacity
2016-08-02 23:57 - 2016-08-02 23:58 - 00000000 ____D C:\Program Files (x86)\Audacity
2016-08-02 20:10 - 2016-08-02 20:11 - 00000000 ____D C:\Users\Kiwi\Documents\RCT3
2016-08-02 20:10 - 2016-08-02 20:10 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Atari
2016-08-02 17:07 - 2016-08-02 17:07 - 00076152 _____ C:\Windows\system32\PnkBstrA.exe
2016-08-02 16:57 - 2016-08-02 16:57 - 00000000 ____D C:\Users\Kiwi\AppData\Local\PunkBuster
2016-08-02 13:22 - 2015-10-19 19:13 - 03894632 _____ C:\Windows\SysWOW64\pbsvc.exe
2016-08-02 13:12 - 2016-08-02 13:13 - 00000000 ____D C:\Users\Kiwi\Documents\Battlefield 4
2016-08-02 08:18 - 2016-08-27 12:29 - 00001303 _____ C:\Users\Public\Desktop\Battlefield 4.lnk
2016-08-02 08:18 - 2016-08-03 05:21 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2016-08-02 08:18 - 2016-08-02 08:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 4
2016-08-02 06:12 - 2016-08-27 17:47 - 00226168 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2016-08-02 06:12 - 2016-08-27 17:47 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2016-08-02 06:12 - 2016-08-02 16:52 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2016-08-01 02:03 - 2016-08-27 12:29 - 00001886 _____ C:\Users\Kiwi\Desktop\Google Drive.lnk
2016-08-01 02:03 - 2016-08-27 02:52 - 00000000 ___RD C:\Users\Kiwi\Google Drive
2016-08-01 02:02 - 2016-08-27 12:29 - 00002109 _____ C:\Users\Public\Desktop\Google Slides.lnk
2016-08-01 02:02 - 2016-08-27 12:29 - 00002107 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2016-08-01 02:02 - 2016-08-27 12:29 - 00002097 _____ C:\Users\Public\Desktop\Google Docs.lnk
2016-08-01 02:02 - 2016-08-25 03:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-08-01 02:01 - 2016-08-28 16:17 - 00000000 ____D C:\Program Files (x86)\Google
2016-08-01 02:01 - 2016-08-01 02:02 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Google
2016-08-01 01:54 - 2016-08-29 13:05 - 00124416 ___SH C:\Users\Kiwi\Desktop\Thumbs.db
2016-08-01 00:06 - 2016-08-30 14:20 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Telegram Desktop
2016-08-01 00:06 - 2016-08-27 12:29 - 00001165 _____ C:\Users\Kiwi\Desktop\Telegram.lnk
2016-08-01 00:06 - 2016-08-01 00:06 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop
2016-07-31 23:58 - 2016-07-31 23:58 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Thunderbird
2016-07-31 23:58 - 2016-07-31 23:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Thunderbird
2016-07-31 23:57 - 2016-08-27 12:29 - 00001278 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-07-31 23:57 - 2016-08-27 12:29 - 00001260 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2016-07-31 23:57 - 2016-07-31 23:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-07-31 23:38 - 2016-08-29 21:54 - 00000000 ____D C:\ProgramData\boost_interprocess
2016-07-31 23:23 - 2016-07-31 23:23 - 00003634 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-UBKH50B-Kiwi☺
2016-07-31 23:08 - 2016-08-27 12:29 - 00001207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CC 2015.lnk
2016-07-31 21:47 - 2016-08-28 16:21 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-07-31 21:47 - 2016-08-27 12:29 - 00001112 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-07-31 21:47 - 2016-08-27 12:29 - 00001094 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-07-31 21:47 - 2016-07-31 21:47 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\TeamViewer
2016-07-31 21:46 - 2016-07-31 21:46 - 09798984 _____ (TeamViewer GmbH) C:\TeamViewer_Setup_de.exe
2016-07-31 20:02 - 2016-07-31 20:02 - 10001388 _____ (Michael Friese) C:\sinusbot-win-0.9.8.6.exe
2016-07-31 19:45 - 2016-08-03 05:19 - 00000000 ____D C:\ProgramData\Wondershare
2016-07-31 19:45 - 2016-08-03 05:19 - 00000000 ____D C:\Program Files (x86)\Wondershare
2016-07-31 19:45 - 2016-07-31 19:47 - 00000000 ____D C:\ProgramData\Wondershare Video Converter Ultimate
2016-07-31 19:45 - 2016-07-31 19:45 - 00000000 ____D C:\Users\Kiwi\Documents\Wondershare Video Converter Ultimate
2016-07-31 19:45 - 2016-07-31 19:45 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Wondershare Video Converter Ultimate
2016-07-31 19:45 - 2016-05-27 09:41 - 00000232 _____ C:\Windows\SysWOW64\dllhost.exe.config
2016-07-31 19:45 - 2015-02-27 14:38 - 00721263 _____ () C:\Windows\SysWOW64\WSCM64.dll
2016-07-31 19:44 - 2016-07-31 19:44 - 00000000 ____D C:\Users\Public\Documents\Wondershare
2016-07-31 13:58 - 2016-07-31 13:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Apple Computer
2016-07-31 13:25 - 2016-07-31 17:47 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Apple Computer
2016-07-31 13:21 - 2016-07-31 13:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReelSmart Motion Blur 4, After Effects-compatible plugin set
2016-07-31 13:21 - 2008-01-30 18:36 - 00090112 _____ (MindVision Software) C:\Windows\unvise32.exe
2016-07-31 13:20 - 2016-07-31 13:20 - 00000000 ____D C:\Program Files\RSMB4AEManual
2016-07-31 13:19 - 2016-07-31 13:19 - 00000000 ____D C:\Program Files (x86)\REVisionEffects
2016-07-31 13:15 - 2016-08-06 20:26 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-07-31 13:01 - 2016-07-31 13:01 - 00000000 ____D C:\Program Files (x86)\Red Giant Link
2016-07-31 13:01 - 2016-07-31 13:01 - 00000000 ____D C:\Program Files (x86)\LooksBuilder
2016-07-31 13:01 - 2014-07-28 14:10 - 19939328 _____ (Red Giant LLC) C:\Windows\system32\MBLooksUI_x64.dll
2016-07-31 12:55 - 2016-07-31 12:55 - 00000000 ____D C:\ProgramData\Reprise
2016-07-31 12:54 - 2016-07-31 13:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Giant
2016-07-31 12:54 - 2016-07-31 13:01 - 00000000 ____D C:\Program Files (x86)\Red Giant
2016-07-31 12:54 - 2016-07-31 12:54 - 00000000 ____D C:\ProgramData\RedGiant
2016-07-31 12:54 - 2016-07-31 12:54 - 00000000 ____D C:\ProgramData\Red Giant
2016-07-31 12:50 - 2016-07-31 13:21 - 00000000 ____D C:\ProgramData\GenArts
2016-07-31 12:50 - 2016-07-31 12:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GenArts Sapphire AE
2016-07-31 12:50 - 2016-07-31 12:50 - 00000000 ____D C:\Program Files\GenArts
2016-07-31 12:50 - 2013-06-30 22:28 - 00000000 _____ C:\Windows\MSUTIL.INI
2016-07-31 12:33 - 2016-07-31 12:33 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Launchpad
2016-07-31 12:24 - 2016-08-27 12:29 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Apple
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\ProgramData\Apple Computer
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\ProgramData\Apple
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\Program Files (x86)\QuickTime
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2016-07-31 12:20 - 2016-08-06 20:09 - 00000000 ____D C:\Users\Kiwi\Documents\Adobe
2016-07-31 12:18 - 2016-07-31 12:18 - 00000000 ____D C:\Users\Public\Documents\AdobeInstalledCodecs
2016-07-31 12:15 - 2016-08-27 12:29 - 00001315 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CC 2015.lnk
2016-07-31 12:15 - 2016-08-06 20:09 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-07-31 12:14 - 2016-08-27 12:29 - 00001421 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Character Animator (Preview).lnk
2016-07-31 12:14 - 2016-08-06 20:08 - 00000000 ____D C:\Program Files\Adobe
2016-07-31 12:14 - 2016-07-31 23:08 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-07-31 12:13 - 2016-08-27 12:29 - 00001615 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk
2016-07-31 12:13 - 2016-08-27 12:29 - 00001597 _____ C:\Users\Public\Desktop\Adobe Application Manager.lnk
2016-07-31 12:13 - 2016-08-01 02:00 - 00000000 ____D C:\ProgramData\Adobe
2016-07-31 12:13 - 2016-07-31 12:13 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Macromedia
2016-07-31 12:12 - 2016-08-30 12:46 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Adobe
2016-07-31 02:36 - 2016-08-28 16:28 - 00000000 ____D C:\Users\Kiwi\Desktop\Intros
2016-07-31 01:53 - 2016-07-31 14:15 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\MAXON
2016-07-31 01:53 - 2016-07-31 01:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cinema 4D R12
2016-07-31 01:52 - 2016-07-31 01:53 - 00000000 ____D C:\Program Files (x86)\Cinema 4D R12
2016-07-31 01:01 - 2016-08-27 03:30 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\qBittorrent
2016-07-31 01:01 - 2016-07-31 01:01 - 00000000 ____D C:\Users\Kiwi\AppData\Local\qBittorrent
2016-07-31 01:00 - 2016-08-27 12:29 - 00001106 _____ C:\Users\Public\Desktop\qBittorrent.lnk
2016-07-31 01:00 - 2016-07-31 01:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qBittorrent
2016-07-31 01:00 - 2016-07-31 01:00 - 00000000 ____D C:\Program Files (x86)\qBittorrent

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-08-30 16:09 - 2016-07-27 12:34 - 00002144 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-08-30 16:09 - 2016-07-27 12:34 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-08-30 16:00 - 2016-07-27 11:56 - 01799166 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-30 16:00 - 2016-04-27 07:13 - 00775524 _____ C:\Windows\system32\perfh007.dat
2016-08-30 16:00 - 2016-04-27 07:13 - 00155338 _____ C:\Windows\system32\perfc007.dat
2016-08-30 16:00 - 2015-10-30 09:21 - 00000000 ____D C:\Windows\INF
2016-08-30 15:58 - 2016-07-27 22:25 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\TS3Client
2016-08-30 15:55 - 2016-07-27 12:35 - 00000000 ____D C:\Program Files (x86)\Steam
2016-08-30 15:54 - 2016-07-27 12:10 - 00000000 ____D C:\ProgramData\NVIDIA
2016-08-30 15:54 - 2016-04-27 07:48 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-30 13:47 - 2016-07-27 21:41 - 00000000 ____D C:\ProgramData\Origin
2016-08-30 12:45 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi
2016-08-29 14:28 - 2016-07-27 12:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Arma 3
2016-08-29 13:11 - 2016-07-27 21:58 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-08-29 11:19 - 2015-10-30 08:28 - 00524288 ___SH C:\Windows\system32\config\BBI
2016-08-29 10:36 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\AppReadiness
2016-08-28 23:47 - 2016-07-28 21:46 - 00403192 _____ C:\Windows\system32\Drivers\EasyAntiCheat.sys
2016-08-28 20:19 - 2016-04-26 22:44 - 04962520 _____ C:\Windows\system32\FNTCACHE.DAT
2016-08-28 17:17 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\Help
2016-08-28 16:24 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Packages
2016-08-28 16:24 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-28 16:20 - 2016-07-27 12:50 - 00000000 ____D C:\Windows\Panther
2016-08-28 16:20 - 2016-07-27 12:13 - 00000000 ____D C:\Users\Kiwi\AppData\Local\CrashDumps
2016-08-28 03:24 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\PurchaseDialog
2016-08-27 12:29 - 2016-07-30 21:16 - 00001340 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\OpenIV.lnk
2016-08-27 12:29 - 2016-07-30 21:16 - 00001338 _____ C:\Users\Kiwi\Desktop\OpenIV.lnk
2016-08-27 12:29 - 2016-07-27 22:25 - 00001046 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2016-08-27 12:29 - 2016-07-27 22:25 - 00001014 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2016-08-27 12:29 - 2016-07-27 21:41 - 00001042 _____ C:\Users\Public\Desktop\Origin.lnk
2016-08-27 12:29 - 2016-07-27 14:02 - 00001444 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2016-08-27 12:29 - 2016-07-27 12:35 - 00001026 _____ C:\Users\Public\Desktop\Steam.lnk
2016-08-27 12:29 - 2016-07-27 11:55 - 00002516 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-08-27 11:24 - 2015-10-30 09:11 - 00000000 ____D C:\Windows\CbsTemp
2016-08-27 04:09 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\LiveKernelReports
2016-08-27 03:42 - 2016-07-27 13:59 - 00000000 ____D C:\Windows\AutoKMS
2016-08-27 03:26 - 2016-07-27 12:09 - 00000000 ____D C:\ProgramData\Package Cache
2016-08-27 02:52 - 2016-07-27 12:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-08-27 02:49 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\NDF
2016-08-26 02:47 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\rescache
2016-08-25 17:33 - 2016-04-27 07:55 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-08-25 17:26 - 2016-04-27 07:34 - 00000000 ____D C:\Program Files\Windows Journal
2016-08-25 17:26 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2016-08-25 17:26 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\appraiser
2016-08-25 09:36 - 2016-07-27 22:09 - 00000000 ____D C:\Windows\system32\MRT
2016-08-25 09:36 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2016-08-25 09:32 - 2016-07-27 22:09 - 147640136 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-08-25 03:36 - 2016-07-27 12:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2016-08-25 03:35 - 2016-07-27 12:36 - 00000000 ____D C:\ProgramData\EPSON
2016-08-25 03:27 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\FxsTmp
2016-08-08 18:03 - 2016-07-27 12:58 - 00000000 ____D C:\Users\Kiwi\Documents\Arma 3
2016-08-07 22:52 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\VirtualStore
2016-08-06 20:26 - 2016-07-27 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2016-08-06 20:26 - 2016-07-27 12:09 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-08-06 20:10 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Adobe
2016-08-06 17:31 - 2016-07-28 01:57 - 00000213 _____ C:\Users\Kiwi\Desktop\RollerCoaster Tycoon 3 Platinum!.url
2016-08-06 17:31 - 2016-07-27 21:58 - 00000219 _____ C:\Users\Kiwi\Desktop\Grand Theft Auto V.url
2016-08-02 16:49 - 2016-07-27 14:03 - 00000000 ____D C:\Users\Kiwi\AppData\Local\NVIDIA Corporation
2016-08-02 14:07 - 2016-07-27 12:10 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-08-02 13:12 - 2016-07-27 21:41 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-08-02 01:42 - 2016-07-27 21:57 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Origin
2016-08-01 17:49 - 2016-07-27 13:43 - 00000000 ____D C:\Users\Kiwi\Documents\Arma 3 - Other Profiles
2016-08-01 17:41 - 2016-07-28 00:28 - 00000000 ____D C:\Users\Kiwi\Documents\TS Server Icons
2016-08-01 16:07 - 2016-07-27 13:58 - 00000000 ____D C:\ProgramData\Microsoft Toolkit
2016-07-31 04:55 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\appcompat

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-08-28 13:36 - 2016-08-28 13:36 - 0000003 _____ () C:\Users\Kiwi\AppData\Local\updater.log
2016-08-28 13:36 - 2016-08-28 13:36 - 0000424 _____ () C:\Users\Kiwi\AppData\Local\UserProducts.xml

Einige Dateien in TEMP:
====================
C:\Users\Kiwi\AppData\Local\Temp\libeay32.dll
C:\Users\Kiwi\AppData\Local\Temp\msvcr120.dll
C:\Users\Kiwi\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-08-28 20:58

==================== Ende von FRST.txt ============================

KiwiLink 30.08.2016 15:19
Und hier die Addition.txt:
Code:
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 29-08-2016
durchgeführt von Kiwi☺ (30-08-2016 16:12:13)
Gestartet von C:\Users\Kiwi\Downloads
Windows 10 Pro Version 1511 (X64) (2016-07-27 09:52:43)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-2015112042-96394298-4154293379-500 - Administrator - Disabled)
DefaultAccount (S-1-5-21-2015112042-96394298-4154293379-503 - Limited - Disabled)
Gast (S-1-5-21-2015112042-96394298-4154293379-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2015112042-96394298-4154293379-1003 - Limited - Enabled)
Kiwi☺ (S-1-5-21-2015112042-96394298-4154293379-1001 - Administrator - Enabled) => C:\Users\Kiwi

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Emsisoft Anti-Malware (Enabled - Up to date) {D1196F3E-3487-585D-3681-0661BD157EC3}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {6A788EDA-12BD-57D3-0C31-3D13C692347E}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

7-Zip 16.02 (x64) (HKLM\...\7-Zip) (Version: 16.02 - Igor Pavlov)
Adobe After Effects CC 2015 (HKLM-x32\...\{147EC100-14BE-45EF-AB42-35BAEE7D02F0}) (Version: 13.7.1 - Adobe Systems Incorporated)
Adobe Media Encoder CC 2015 (HKLM-x32\...\{0FAC7130-BEC5-47A5-8813-1D339B8326ED}) (Version: 9.0.0 - Adobe Systems Incorporated)
Adobe Photoshop CC 2015 (HKLM-x32\...\{793C2BF7-A4FE-4608-91C9-9282C5801C21}) (Version: 16.0 - Adobe Systems Incorporated)
Ansel (Version: 368.81 - NVIDIA Corporation) Hidden
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArmA3Sync 1.5.80 (HKLM-x32\...\{F097E7D7-D093-4394-9EED-43AFCCD12B7A}_is1) (Version: 1.5.80 - The [S.o.E] team)
Assassin's Creed Unity (HKLM-x32\...\Uplay Install 720) (Version:  - Ubisoft)
Audacity 2.1.2 (HKLM-x32\...\Audacity®_is1) (Version: 2.1.2 - Audacity Team)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.7.2.45672 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.0 - EA Digital Illusions CE AB)
Blender (HKLM\...\{47A0EA10-D506-4473-AE99-5E07DD1062DE}) (Version: 2.77.1 - Blender Foundation)
Camtasia Studio 8 (HKLM-x32\...\{E7AFA156-D5CB-4B8C-843D-E7CA58D36B0A}) (Version: 8.6.0.2054 - TechSmith Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 5.21 - Piriform)
Cinema 4D version R12 (HKLM-x32\...\{7D9D8134-9FA3-4FFF-ADA1-BF609F29997A}_is1) (Version: R12 - Salat Production)
Cities: Skylines (HKLM\...\Steam App 255710) (Version:  - Colossal Order Ltd.)
Code 3 Callouts (HKLM\...\{6E173224-465C-485C-8859-F16280739A21}) (Version: 1.2.1.0 - Stealth22)
Color Suite v11.1.4 (HKLM-x32\...\{99487911-8011-42BC-B594-8B02BFD32B1D}_is1) (Version: 11.1.4 - Red Giant, LLC)
Druckerdeinstallation für EPSON BX635FWD Series (HKLM\...\EPSON BX635FWD Series) (Version:  - SEIKO EPSON Corporation)
Emsisoft Anti-Malware (HKLM\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 11.10 - Emsisoft Ltd.)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
Garry's Mod (HKLM\...\Steam App 4000) (Version:  - Facepunch Studios)
Google Drive (HKLM-x32\...\{459CE109-4E46-4340-92BC-054642BC3BC2}) (Version: 1.31.2873.2758 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.31.5 - Google Inc.) Hidden
Grand Theft Auto V (HKLM\...\Steam App 271590) (Version:  - Rockstar North)
Java 8 Update 101 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F64180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
Java SE Development Kit 8 Update 101 (64-bit) (HKLM\...\{64A3A4F4-B792-11D6-A78A-00B0D0180101}) (Version: 8.0.1010.13 - Oracle Corporation)
Lightshot-5.4.0.1 (HKLM-x32\...\{30A5B3C9-2084-4063-A32A-628A98DE512B}_is1) (Version: 5.4.0.1 - Skillbrains)
LSPD First Response (HKLM-x32\...\LSPD First Response) (Version: 0.3.1 - G17 Media)
MAGIX Content und Soundpools (HKLM-x32\...\MAGIX_GlobalContent) (Version: 1.0.0.0 - MAGIX Software GmbH)
MAGIX Music Maker Premium (HKLM-x32\...\MX.{7C0E97DB-B7FF-4248-BA47-4718D1D104A6}) (Version: 24.0.1.34 - MAGIX Software GmbH)
MAGIX Music Maker Premium (Version: 24.0.1.34 - MAGIX Software GmbH) Hidden
MAGIX Music Maker Trial Live Pads (Version: 24.0.0.0 - MAGIX Software GmbH) Hidden
MAGIX Music Maker Trial Soundpools (Version: 24.0.0.0 - MAGIX Software GmbH) Hidden
MAGIX Speed burnR (HKLM-x32\...\MX.{53182829-FB43-486B-80AA-FFBF87F707B6}) (Version: 7.0.2.6 - MAGIX Software GmbH)
MAGIX Speed burnR (Version: 7.0.2.6 - MAGIX Software GmbH) Hidden
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
MEGAsync (HKLM-x32\...\MEGAsync) (Version:  - Mega Limited)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (HKLM-x32\...\{050d4fc8-5d48-4b8f-8972-47c82c46020f}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x64) - 14.0.23918 (HKLM-x32\...\{dab68466-3a7d-41a8-a5cf-415e3ff8ef71}) (Version: 14.0.23918.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.23918 (HKLM-x32\...\{2e085fd2-a3e4-4b39-8e10-6b8d35f55244}) (Version: 14.0.23918.0 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 48.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 48.0.2 (x86 de)) (Version: 48.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 48.0.2.6079 - Mozilla)
Mozilla Thunderbird 45.2.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 45.2.0 (x86 de)) (Version: 45.2.0 - Mozilla)
MSI DragonEye (HKLM\...\{7116875E-F251-4C33-AB3F-37DE05B15595}_is1) (Version: 0.0.2.3 - MSI)
MSI Gaming APP (HKLM-x32\...\{E0229316-E73B-484B-B9E0-45098AB38D8C}}_is1) (Version: 6.0.0.13 - MSI)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.9.2 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 364.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 364.44 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 368.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 368.81 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.11.4.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.11.4.0 - NVIDIA Corporation)
NVIDIA Grafiktreiber 368.81 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 368.81 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.15 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.15 - NVIDIA Corporation)
NVIDIA Photoshop Plug-ins 64 bit (HKLM-x32\...\{5E386C5B-CDE7-435A-B5C9-EC73A1B0553A}) (Version: 8.50 - )
NVIDIA PhysX-Systemsoftware 9.16.0318 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.16.0318 - NVIDIA Corporation)
OpenIV (HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\OpenIV) (Version: 2.8.703 - .black/OpenIV Team)
Origin (HKLM-x32\...\Origin) (Version: 9.12.2.60376 - Electronic Arts, Inc.)
Portal 2 (HKLM\...\Steam App 620) (Version:  - Valve)
Prison Architect (HKLM-x32\...\1441974651_is1) (Version: 2.6.0.9 - GOG.com)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
qBittorrent 3.3.6 (HKLM-x32\...\qBittorrent) (Version: 3.3.6 - The qBittorrent project)
QuickTime 7 (HKLM-x32\...\{FF59BD75-466A-4D5A-AD23-AAD87C5FD44C}) (Version: 7.79.80.95 - Apple Inc.)
Razer Chroma SDK Core Components (HKLM-x32\...\Razer Chroma SDK) (Version: 1.7.8 - Razer Inc.)
Razer Synapse (HKLM-x32\...\{0D78BEE2-F8FF-4498-AF1A-3FF81CED8AC6}) (Version: 2.20.15.707 - Razer Inc.)
Red Giant Link (HKLM-x32\...\{10F82E5B-B611-4C65-8F29-666A9EC5680A}_is1) (Version: 1.8.100.5 - Red Giant, LLC)
ReelSmart Motion Blur 4, After Effects-compatible plugin set (HKLM-x32\...\ReelSmart Motion Blur 4, After Effects-compatible plugin set) (Version:  - )
Revo Uninstaller Pro 3.1.6 (HKLM\...\{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1) (Version: 3.1.6 - VS Revo Group, Ltd.)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.9.6 - Rockstar Games)
RollerCoaster Tycoon 3: Platinum! (HKLM\...\Steam App 2700) (Version:  - Frontier)
Rust (HKLM\...\Steam App 252490) (Version:  - Facepunch Studios)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.16044.2 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.16044.2 - Samsung Electronics Co., Ltd.) Hidden
SHIELD Streaming (Version: 7.1.0280 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.11.4.0 - NVIDIA Corporation) Hidden
Spotify (HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Spotify) (Version: 1.0.36.124.g1cba1920 - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Team Fortress Classic (HKLM\...\Steam App 20) (Version:  - Valve)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.19 - TeamSpeak Systems GmbH)
TeamViewer 11 (HKLM-x32\...\TeamViewer) (Version: 11.0.63017 - TeamViewer)
Telegram Desktop version 0.10.1 (HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1) (Version: 0.10.1 - Telegram Messenger LLP)
Text-To-Speech-Runtime (HKLM-x32\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
Trapcode Suite 64-bit (HKLM-x32\...\InstallShield_{5210717F-CAFD-4F21-8DF7-6ED3862725C4}) (Version: 12.1.0 - Red Giant Software)
Trapcode Suite 64-bit (Version: 12.1.0 - Red Giant Software) Hidden
Uplay (HKLM-x32\...\Uplay) (Version: 21.1 - Ubisoft)
Vegas Pro 13.0 (64-bit) (HKLM\...\{3814DB30-091D-11E4-BDE0-F04DA23A5C58}) (Version: 13.0.373 - Sony)
Wacom Tablett (HKLM\...\Wacom Tablet Driver) (Version: 6.3.15-3 - Wacom Technology Corp.)
WebTablet FB Plugin 32 bit (HKLM-x32\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)
WebTablet FB Plugin 64 bit (HKLM\...\Wacom WebTabletPlugin for Internet Explorer and Netscape) (Version: 2.1.0.7 - Wacom Technology Corp.)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {1D87F34F-470E-4718-980C-91CC3FBFAAB4} - System32\Tasks\{8E5FF780-BF2D-4671-871B-39F4F48FA20A} => pcalua.exe -a "C:\Program Files (x86)\MPC Cleaner\Uninstall.exe" -c /xuninstall
Task: {714224EE-3DFD-4366-9306-C6B877C78B91} - System32\Tasks\update-S-1-5-21-2015112042-96394298-4154293379-1001 => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2016-07-11] ()
Task: {8310E450-8186-43CB-A729-1CA22864C854} - System32\Tasks\update-sys => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe [2016-07-11] ()
Task: {C4D7F326-04F3-4AF0-8DD4-771B5C086564} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-08-05] (Piriform Ltd)
Task: {C8903AC3-F827-4BA1-9C0F-FC027C5B2429} - System32\Tasks\MSISW_Host => C:\Windows\SysWOW64\muachost.exe [2015-08-18] (MSI)
Task: {C97923E9-F834-416C-817F-81B6592E4AD5} - System32\Tasks\MSIOSDx64_Host => C:\Program Files (x86)\MSI\Gaming APP\OSD\x64\MsiGamingOSD_x64.exe [2016-06-30] (Micro-Star INT'L CO., LTD.)
Task: {D143CDFB-6961-4A94-A654-BF6A5D925B42} - System32\Tasks\MSIOSDx86_Host => C:\Program Files (x86)\MSI\Gaming APP\OSD\x86\MsiGamingOSD_x86.exe [2016-06-30] (Micro-Star INT'L CO., LTD.)
Task: {D7FD0212-D95C-4894-88B7-4766999E6ADF} - System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-UBKH50B-Kiwi☺ => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2015-05-26] (Adobe Systems Incorporated)
Task: {FAE641A2-A77F-4482-8F9D-C2895E7B422E} - System32\Tasks\{6B0496CA-37FE-4410-999F-9949EE20FA96} => pcalua.exe -a "C:\Program Files (x86)\WeatherChickn\uninstall.exe"

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\update-S-1-5-21-2015112042-96394298-4154293379-1001.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

WMI_ActiveScriptEventConsumer_ASEC: <===== ACHTUNG

ShortcutWithArgument: C:\Users\Kiwi\Desktop\Tor Browser.lnk -> D:\Programme\Tor Browser\Browser\firefox.exe (Mozilla Corporation) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk -> D:\Programme\Tor Browser\Browser\firefox.exe (Mozilla Corporation) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Internet Explorer.lnk -> C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) -> hxxp://www%2dsearching.com/?prd=set_epc&s=g8rzftpbl0cshmobu,494cb8c5-c868-4249-8d01-f434220750e5,
ShortcutWithArgument: C:\Users\Kiwi\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://yeabests.cc
ShortcutWithArgument: C:\Users\Public\Desktop\Mozilla Firefox.lnk -> C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) -> hxxp://yeabests.cc

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-10-30 09:18 - 2015-10-30 09:18 - 00185856 _____ () C:\Windows\SYSTEM32\ism32k.dll
2016-07-27 12:10 - 2016-07-11 00:58 - 00133056 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2016-08-02 17:07 - 2016-08-02 17:07 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe
2016-07-27 12:11 - 2016-06-14 22:03 - 00367552 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\MessageBus.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 00288192 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamBase.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 01147328 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\libprotobuf.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 03611584 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Poco.dll
2015-11-05 01:11 - 2015-11-05 01:12 - 00188072 _____ () C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
2016-07-27 12:11 - 2016-06-14 22:03 - 02665920 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvMdnsPlugin.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 01988544 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\NvPortForwardPlugin.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 01840576 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\Plugins\NSS\RtspPlugin.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 00207296 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\RtspServer.dll
2016-07-27 22:06 - 2016-07-01 06:48 - 02656408 _____ () C:\Windows\system32\CoreUIComponents.dll
2016-08-03 19:50 - 2016-06-14 16:35 - 00187392 _____ () C:\Program Files (x86)\MSI\Gaming APP\OSD\x64\D3D11FontDraw.dll
2016-07-27 12:54 - 2016-07-27 12:55 - 00144384 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
2016-07-27 22:06 - 2016-07-01 06:48 - 02656408 _____ () C:\Windows\System32\CoreUIComponents.dll
2016-06-30 10:23 - 2016-06-30 10:23 - 00592384 _____ () C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX64.dll
2016-04-27 07:17 - 2016-04-27 07:17 - 00093696 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\Windows.UI.Shell.SharedUtilities.dll
2016-07-27 22:08 - 2016-07-01 05:48 - 00472064 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll
2016-07-27 22:06 - 2016-07-01 05:27 - 07992832 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll
2016-07-27 22:06 - 2016-07-01 05:21 - 00591360 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll
2016-07-27 22:06 - 2016-07-01 05:22 - 02483200 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll
2016-07-27 22:06 - 2016-07-01 05:24 - 04089856 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01349824 _____ () C:\Program Files\Tablet\Wacom\libxml2.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 00034240 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_system-vc120-mt-1_58.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 00920000 _____ () C:\Program Files\NVIDIA Corporation\NvStreamSrv\boost_regex-vc120-mt-1_58.dll
2016-01-06 18:41 - 2016-01-06 18:41 - 00062168 _____ () C:\Program Files\CCleaner\branding.dll
2016-08-05 18:52 - 2016-08-05 18:52 - 00061440 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2016-07-27 14:02 - 2016-06-14 22:03 - 00165824 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\gamecaster64.dll
2016-07-27 14:02 - 2016-06-14 22:03 - 00861120 _____ () C:\Program Files\NVIDIA Corporation\ShadowPlay\twitchsdk64.dll
2016-06-23 13:02 - 2016-07-30 12:35 - 00174872 _____ () C:\Program Files\TeamSpeak 3 Client\quazip.dll
2016-06-23 13:02 - 2016-07-30 12:35 - 00103192 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\directsound_win64.dll
2016-06-23 13:02 - 2016-07-30 12:35 - 00107800 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win64.dll
2016-06-23 13:02 - 2016-07-30 12:35 - 00312088 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\clientquery_plugin.dll
2016-08-08 16:26 - 2016-08-08 16:26 - 04018176 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\task_force_radio_win64.dll
2016-06-23 13:02 - 2016-07-30 12:35 - 00485656 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll
2016-06-30 13:24 - 2016-06-30 13:24 - 00564224 _____ () C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX32.dll
2016-08-03 19:51 - 2016-06-14 16:35 - 00163328 _____ () C:\Program Files (x86)\MSI\Gaming APP\OSD\x86\D3D11FontDraw.dll
2016-07-27 12:54 - 2016-07-27 12:55 - 00141312 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeBackgroundTasks.dll
2016-07-27 12:54 - 2016-07-27 12:55 - 22284800 _____ () C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkyWrap.dll
2016-07-27 12:11 - 2016-06-14 22:03 - 00018880 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2016-07-27 12:37 - 2016-08-09 01:27 - 00785920 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2016-07-27 12:37 - 2015-07-02 00:06 - 04962816 _____ () C:\Program Files (x86)\Steam\v8.dll
2016-07-27 12:37 - 2016-08-23 21:33 - 02321184 _____ () C:\Program Files (x86)\Steam\video.dll
2016-07-27 12:37 - 2015-07-02 00:06 - 01556992 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2016-07-27 12:37 - 2015-07-02 00:06 - 01187840 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2016-07-27 12:37 - 2016-01-27 09:49 - 02549760 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2016-07-27 12:37 - 2016-01-27 09:49 - 00491008 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2016-07-27 12:37 - 2016-01-27 09:49 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2016-07-27 12:37 - 2016-01-27 09:49 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2016-07-27 12:37 - 2016-01-27 09:49 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2016-07-27 12:37 - 2016-08-23 21:33 - 00835360 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2016-07-27 12:37 - 2016-07-05 00:17 - 00266560 _____ () C:\Program Files (x86)\Steam\openvr_api.dll
2016-08-06 18:28 - 2016-08-25 17:33 - 51330160 _____ () C:\Users\Kiwi\AppData\Roaming\Spotify\libcef.dll
2016-07-27 12:37 - 2016-08-04 22:56 - 49825056 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2016-08-06 18:28 - 2016-08-25 17:33 - 01763952 _____ () C:\Users\Kiwi\AppData\Roaming\Spotify\libglesv2.dll
2016-08-06 18:28 - 2016-08-25 17:33 - 00088176 _____ () C:\Users\Kiwi\AppData\Roaming\Spotify\libegl.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ==========================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2016-07-31 23:20 - 2016-08-27 03:20 - 00001550 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1      down.baidu2016.com
127.0.0.1      123.sogou.com
127.0.0.1      www.czzsyzgm.com
127.0.0.1      www.czzsyzxl.com
127.0.0.1      union.baidu2019.com
127.0.0.1      down.baidu2016.com
127.0.0.1      123.sogou.com
127.0.0.1      www.czzsyzgm.com
127.0.0.1      www.czzsyzxl.com
127.0.0.1      union.baidu2019.com

==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-2015112042-96394298-4154293379-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Kiwi\Desktop\kwik0000.png
DNS Servers: 188.120.239.115 - 8.8.8.8
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKLM\...\StartupApproved\Run: => "WINCOMT65"
HKLM\...\StartupApproved\Run: => "gplyra"
HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "Wondershare Helper Compact.exe"
HKLM\...\StartupApproved\Run32: => "Razer Synapse"
HKLM\...\StartupApproved\Run32: => "chromebrowser"
HKLM\...\StartupApproved\Run32: => "DelaypluginInstall"
HKLM\...\StartupApproved\Run32: => "AdAnti"
HKLM\...\StartupApproved\Run32: => "EYAN"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\StartupFolder: => "MEGAsync.lnk"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\Run: => "GoogleDriveSync"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\Run: => "OneDrive"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\Run: => "PCSpeedUp"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\Run: => "msiql"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\Run: => "QGuan10in1"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\Run: => "Caster"
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\StartupApproved\Run: => "ComputerZ-Tray"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{86DEA2AC-6CCA-41B2-A6A6-7A57E8DB680E}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{EB8C5D6F-DFFD-4BE8-85B0-ED3E1C7D42D7}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{921CBA92-EA14-4680-A9E6-F9A4B6963A72}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{03209412-CDDC-4C43-BE65-9972ECB71941}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{4A03C766-FC2A-4DC5-B6FC-F92B7B6EB093}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{8AC56E8E-50F0-4610-AB11-D6EBE85C3582}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{6CF80178-0804-4DB7-8199-4A4EDDB57C88}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{65656BDF-17C8-4293-A131-9F38A7D1466C}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{A9635C88-CFCA-43FB-A894-038CB051C9C5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{9488D852-4A4A-4DFC-B005-51B42EC20A89}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{983A7A06-0A33-4BCE-8BD7-748A1A1489E3}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{109D8D1B-D04B-4600-8634-E2C8F8C9C57A}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{875DC9B0-7C8E-4A9A-B882-12F32B54BA50}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{1497C308-D602-47EC-8C53-87F7B5CCE21F}C:\program files (x86)\steam\steamapps\common\arma 3\arma3.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arma 3\arma3.exe
FirewallRules: [UDP Query User{2D165F74-C638-4D49-8515-1A88E34846D1}C:\program files (x86)\steam\steamapps\common\arma 3\arma3.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\arma 3\arma3.exe
FirewallRules: [{B0563F91-7F7A-4F30-A5F5-E8C85BB91894}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{DA96C0EC-B4AB-45EA-9DE2-66013CE32992}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{A3442EE0-82FB-41D5-8A05-F9ABBD381B56}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{165C0E88-5F22-4C07-B27C-FA4D2303FFBA}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\dota 2 beta\game\bin\win64\dota2.exe
FirewallRules: [{28A32930-AFE1-4EED-9DFB-5316B0329E28}] => (Allow) D:\SteamLibrary\steamapps\common\Rollercoaster Tycoon 3 Gold\RCT3plus.exe
FirewallRules: [{05E16018-9B59-46AA-9D01-E2D94CE7C42A}] => (Allow) D:\SteamLibrary\steamapps\common\Rollercoaster Tycoon 3 Gold\RCT3plus.exe
FirewallRules: [{DFB56026-0577-4609-A778-08EDA6E865D2}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [{A1FC9BE6-4372-4C95-B77D-C9A3B9598EC9}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\insurgency2\insurgency.exe
FirewallRules: [{DB391788-F44B-462D-AA32-8B1A1D59BD1A}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{5CE9EB6C-D54B-4900-B72E-D9E9A9CC9B64}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\rocketleague\Binaries\Win32\RocketLeague.exe
FirewallRules: [{869A79D9-59DC-4547-944E-F0C3A1AF519D}] => (Allow) D:\SteamLibrary\steamapps\common\Rust\Rust.exe
FirewallRules: [{80F5FDED-C3CF-43D5-9EF5-4BED6ADB5E66}] => (Allow) D:\SteamLibrary\steamapps\common\Rust\Rust.exe
FirewallRules: [{8E511EC1-E6B6-415A-9D24-CA9F9DE027B5}] => (Allow) D:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [{012E3419-33DE-475E-842F-788B37F04A0A}] => (Allow) D:\SteamLibrary\steamapps\common\Grand Theft Auto V\GTAVLauncher.exe
FirewallRules: [TCP Query User{64EF0278-F43F-4ABC-82BE-2144FAB7C66A}D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [UDP Query User{41FECA6C-CD51-4210-BC70-9C190EC3DB4B}D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe] => (Allow) D:\steamlibrary\steamapps\common\grand theft auto v\gta5.exe
FirewallRules: [{48DF99FF-29F1-47D8-B915-3FE99543B752}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{679D045F-4A87-4126-BBC4-B1E9C81DF9F6}] => (Allow) C:\Program Files (x86)\qBittorrent\qbittorrent.exe
FirewallRules: [{12E2C8B4-B6CD-438F-A038-98D673E4717F}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [TCP Query User{958E2630-F482-4E53-9314-0E23975E793B}C:\program files\adobe\adobe after effects cc 2015\support files\afterfx.exe] => (Allow) C:\program files\adobe\adobe after effects cc 2015\support files\afterfx.exe
FirewallRules: [UDP Query User{85DDF105-2589-4B3D-8E7C-393D505C1198}C:\program files\adobe\adobe after effects cc 2015\support files\afterfx.exe] => (Allow) C:\program files\adobe\adobe after effects cc 2015\support files\afterfx.exe
FirewallRules: [TCP Query User{AB2D5D7E-8447-4751-89BA-07E08C98E80D}D:\sinusbot\ts3bot.exe] => (Allow) D:\sinusbot\ts3bot.exe
FirewallRules: [UDP Query User{606C3EF0-1AA1-487A-B32C-AB70DE53C268}D:\sinusbot\ts3bot.exe] => (Allow) D:\sinusbot\ts3bot.exe
FirewallRules: [{8CEAB840-3115-4D77-B6D3-F98DEA84B4C4}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{3BB08450-413E-4266-B80A-AD32323837E0}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{70A8E6CF-63A8-46C2-85E5-FB3165E094A5}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{82B7FEF0-BD79-45D1-8085-CF5B9B000465}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [TCP Query User{D22BF5EE-4CA7-4722-BAFE-F5E0F9C77815}C:\program files\adobe\adobe media encoder cc 2015\adobe media encoder.exe] => (Block) C:\program files\adobe\adobe media encoder cc 2015\adobe media encoder.exe
FirewallRules: [UDP Query User{8F3B13EA-BADA-477D-BA75-945930A1A79B}C:\program files\adobe\adobe media encoder cc 2015\adobe media encoder.exe] => (Block) C:\program files\adobe\adobe media encoder cc 2015\adobe media encoder.exe
FirewallRules: [{95C03D73-D1D5-48A8-89FE-EBAE74C53622}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{31D42B92-7170-4848-8493-F36472A3B731}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Arma 3\arma3launcher.exe
FirewallRules: [{73E05A95-70D7-4D94-B7B8-C6BD70C426C6}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4WebHelper.exe
FirewallRules: [{925CF7D7-32DB-4D28-9483-4FCA57501C9D}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4WebHelper.exe
FirewallRules: [{42591C30-3CD4-41E8-84AE-1855002BFFCB}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4X86WebHelper.exe
FirewallRules: [{E9DF83E6-5C04-4C21-A054-391A3CD166C3}] => (Allow) C:\Program Files (x86)\Origin Games\Battlefield 4\BF4X86WebHelper.exe
FirewallRules: [TCP Query User{2479284E-EAD6-4C67-BA97-395FADA96C75}C:\program files (x86)\origin games\battlefield 4\bf4.exe] => (Allow) C:\program files (x86)\origin games\battlefield 4\bf4.exe
FirewallRules: [UDP Query User{108D7750-FEFD-49A5-86DD-F840382CFA85}C:\program files (x86)\origin games\battlefield 4\bf4.exe] => (Allow) C:\program files (x86)\origin games\battlefield 4\bf4.exe
FirewallRules: [{CA7CD2F2-9D60-4FBD-90F3-00ECFDA0B966}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{ED14B14D-4855-48CB-BE1A-F5D42D5957A0}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{C23FAEBC-B1DB-472B-AA9A-D58EEA06A4EB}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{9FB221D8-5A6B-4C1F-BA08-4F68AD039C9F}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{268C08D8-98AD-40D0-A0F3-72306B7FA747}] => (Allow) D:\UbisoftLibary\Assassin's Creed Unity\ACU.exe
FirewallRules: [{5F3E1999-C6DD-4C61-9F8C-7DDF30EBFB24}] => (Allow) D:\UbisoftLibary\Assassin's Creed Unity\ACU.exe
FirewallRules: [TCP Query User{18C7D8A5-7D74-42CE-B9B7-46BAA56602FA}C:\users\kiwi\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\kiwi\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{2C9D3DD1-4253-4DE8-841A-594A071A90DB}C:\users\kiwi\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\kiwi\appdata\roaming\spotify\spotify.exe
FirewallRules: [{87E7A914-CF2F-4327-8A6A-F85829639816}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life\hl.exe
FirewallRules: [{908B40BB-1F35-4012-BA5E-BB39A9E6A17B}] => (Allow) D:\SteamLibrary\steamapps\common\Half-Life\hl.exe
FirewallRules: [TCP Query User{0F40E249-38E3-4992-8DB5-7F1AB8C34ABD}C:\users\kiwi\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\kiwi\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{D355FA62-5930-4647-94B4-F28CA611001C}C:\users\kiwi\appdata\roaming\spotify\spotify.exe] => (Block) C:\users\kiwi\appdata\roaming\spotify\spotify.exe
FirewallRules: [{A903E93B-CA70-4393-844F-5D2BFFC4FC00}] => (Allow) D:\SteamLibrary\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [{1EDFF8F4-FFC4-4A41-85D4-386973F86A8C}] => (Allow) D:\SteamLibrary\steamapps\common\GarrysMod\hl2.exe
FirewallRules: [TCP Query User{969765E8-FEBB-4BF3-AEBE-5A26C08BABA6}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{3E2BF3D4-D827-46FD-9EF4-E9C84857FCB8}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{659A90AE-3CCB-423C-9E0B-99676E3666CE}] => (Allow) LPort=8317
FirewallRules: [{230B6EA5-AF48-4DFE-BBC7-050E3B87F7AF}] => (Allow) D:\SteamLibrary\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{A7BAAE06-7FBA-459D-AFEB-20C073654491}] => (Allow) D:\SteamLibrary\steamapps\common\Portal 2\portal2.exe
FirewallRules: [{2425A8E7-96A3-4281-9FB1-B0F525F37A00}] => (Allow) C:\Program Files (x86)\MAGIX\Music Maker Premium\2017\MusicMaker.exe
FirewallRules: [{76324A58-17D2-4F38-9A20-7FE24F570E25}] => (Allow) LPort=26789
FirewallRules: [{B994BF9D-4563-4275-9D63-6C6807525D45}] => (Allow) D:\SteamLibrary\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{8D0577B8-B951-4278-ABAB-40219C01C7CF}] => (Allow) D:\SteamLibrary\steamapps\common\Cities_Skylines\Cities.exe

==================== Wiederherstellungspunkte =========================

08-08-2016 01:27:51 Installed Java SE Development Kit 8 Update 101 (64-bit)
25-08-2016 09:31:33 Windows Update
27-08-2016 02:32:03 Camtasia Studio 8 wird installiert
29-08-2016 21:08:59 Installed Blender

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/30/2016 03:54:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WsAppService.exe, Version: 2.2.4.1, Zeitstempel: 0x5784a857
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.10586.494, Zeitstempel: 0x5775e4c5
Ausnahmecode: 0xe053534f
Fehleroffset: 0x0000000000071f28
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xWsAppService.exe0
Pfad der fehlerhaften Anwendung: WsAppService.exe1
Pfad des fehlerhaften Moduls: WsAppService.exe2
Berichtskennung: WsAppService.exe3
Vollständiger Name des fehlerhaften Pakets: WsAppService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: WsAppService.exe5

Error: (08/30/2016 01:36:23 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.10586.0, Zeitstempel: 0x5632d756
Name des fehlerhaften Moduls: combase.dll, Version: 10.0.10586.103, Zeitstempel: 0x56a849ab
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000067e3c
ID des fehlerhaften Prozesses: 0x50
Startzeit der fehlerhaften Anwendung: 0x01d201e5217ebc88
Pfad der fehlerhaften Anwendung: C:\Windows\system32\dwm.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\combase.dll
Berichtskennung: 3ac5d1f8-aba2-4197-b441-2443502fdf22
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (08/30/2016 01:32:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: dwm.exe, Version: 10.0.10586.0, Zeitstempel: 0x5632d756
Name des fehlerhaften Moduls: combase.dll, Version: 10.0.10586.103, Zeitstempel: 0x56a849ab
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000067e3c
ID des fehlerhaften Prozesses: 0x1bd8
Startzeit der fehlerhaften Anwendung: 0x01d2024da007cbda
Pfad der fehlerhaften Anwendung: C:\Windows\System32\dwm.exe
Pfad des fehlerhaften Moduls: C:\Windows\system32\combase.dll
Berichtskennung: 583ff064-6485-4997-9d6a-153b1a6996b0
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

Error: (08/30/2016 01:18:16 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Cinema 4D R12\resource\modules\python\res\Python.win64.framework\Lib\distutils\command\wininst-8_d.exe".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/30/2016 01:18:16 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files (x86)\Cinema 4D R12\resource\modules\python\res\Python.win32.framework\Lib\distutils\command\wininst-8_d.exe".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/30/2016 01:18:12 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Adobe\Adobe After Effects CC 2015\Support Files\Plug-ins\MAXON CINEWARE AE\(CINEWARE Support)\lite\resource\modules\python\Python.win64.framework\Lib\distutils\command\wininst-8_d.exe".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/30/2016 01:18:12 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Adobe\Adobe After Effects CC 2015\Support Files\Plug-ins\MAXON CINEWARE AE\(CINEWARE Support)\lite\resource\modules\python\Python.win32.framework\Lib\distutils\command\wininst-8_d.exe".
Die abhängige Assemblierung "Microsoft.VC80.DebugCRT,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (08/29/2016 09:09:00 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".

Details:
AddLegacyDriverFiles: Unable to back up image of binary Microsoft-Verbindungsschichterkennungsprotokoll.

System Error:
Zugriff verweigert
.

Error: (08/29/2016 01:04:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WsAppService.exe, Version: 2.2.4.1, Zeitstempel: 0x5784a857
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.10586.494, Zeitstempel: 0x5775e4c5
Ausnahmecode: 0xe053534f
Fehleroffset: 0x0000000000071f28
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xWsAppService.exe0
Pfad der fehlerhaften Anwendung: WsAppService.exe1
Pfad des fehlerhaften Moduls: WsAppService.exe2
Berichtskennung: WsAppService.exe3
Vollständiger Name des fehlerhaften Pakets: WsAppService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: WsAppService.exe5

Error: (08/29/2016 10:52:32 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WsAppService.exe, Version: 2.2.4.1, Zeitstempel: 0x5784a857
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.10586.494, Zeitstempel: 0x5775e4c5
Ausnahmecode: 0xe053534f
Fehleroffset: 0x0000000000071f28
ID des fehlerhaften Prozesses: 0x%9
Startzeit der fehlerhaften Anwendung: 0xWsAppService.exe0
Pfad der fehlerhaften Anwendung: WsAppService.exe1
Pfad des fehlerhaften Moduls: WsAppService.exe2
Berichtskennung: WsAppService.exe3
Vollständiger Name des fehlerhaften Pakets: WsAppService.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: WsAppService.exe5


Systemfehler:
=============
Error: (08/30/2016 03:56:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Namudomvinerght Reports" wurde aufgrund folgenden Fehlers nicht gestartet:
Das System kann die angegebene Datei nicht finden.

Error: (08/30/2016 03:54:57 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Wondershare Application Framework Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/30/2016 03:54:45 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "ziphost" wurde mit folgendem Fehler beendet:
Das angegebene Modul wurde nicht gefunden.

Error: (08/30/2016 03:54:45 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "KuaizipUpdateChecker" wurde mit folgendem Fehler beendet:
Das angegebene Modul wurde nicht gefunden.

Error: (08/30/2016 03:54:45 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "HomeGroupListener" wurde mit dem folgenden dienstspezifischen Fehler beendet:
%%2147944153 = In der Endpunktzuordnung sind keine weiteren Endpunkte verfügbar.

Error: (08/30/2016 03:54:41 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT-AUTORITÄT)
Description: Die Energieverwaltungsfeatures für den Leistungsmodus sind für den logischen Hyper-V-Prozessor "3" aufgrund eines Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (08/30/2016 03:54:41 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT-AUTORITÄT)
Description: Die Energieverwaltungsfeatures für den Leistungsmodus sind für den logischen Hyper-V-Prozessor "2" aufgrund eines Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (08/30/2016 03:54:41 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT-AUTORITÄT)
Description: Die Energieverwaltungsfeatures für den Leistungsmodus sind für den logischen Hyper-V-Prozessor "1" aufgrund eines Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (08/30/2016 03:54:41 PM) (Source: Microsoft-Windows-Kernel-Processor-Power) (EventID: 35) (User: NT-AUTORITÄT)
Description: Die Energieverwaltungsfeatures für den Leistungsmodus sind für den logischen Hyper-V-Prozessor "0" aufgrund eines Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.

Error: (08/30/2016 03:54:44 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎30.‎08.‎2016 um 14:51:13 unerwartet heruntergefahren.


CodeIntegrity:
===================================
  Date: 2016-08-30 16:05:27.579
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2016-08-30 16:05:27.217
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2016-08-30 16:05:26.918
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2016-08-30 16:05:26.595
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2016-08-30 16:05:26.256
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2016-08-29 13:04:42.541
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\NisSrv.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-08-29 10:52:29.118
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\NisSrv.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2016-08-29 10:45:01.941
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2016-08-29 10:45:01.725
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.

  Date: 2016-08-29 10:45:01.462
  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe) attempted to load \Device\HarddiskVolume5\Program Files\Emsisoft Anti-Malware\a2hooks64.dll that did not meet the Store signing level requirements.


==================== Speicherinformationen ===========================

Prozessor: Intel(R) Core(TM) i5-4690K CPU @ 3.50GHz
Prozentuale Nutzung des RAM: 24%
Installierter physikalischer RAM: 16332.79 MB
Verfügbarer physikalischer RAM: 12384.68 MB
Summe virtueller Speicher: 18764.79 MB
Verfügbarer virtueller Speicher: 14426.95 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:465.21 GB) (Free:136.23 GB) NTFS
Drive d: () (Fixed) (Total:931.51 GB) (Free:676.64 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 014785E8)

Partition: GPT.

========================================================
Disk: 1 (Size: 465.8 GB) (Disk ID: 00000000)

Partition: GPT.

==================== Ende von Addition.txt ============================

cosinus 30.08.2016 15:24
Zitat:
C:\Users\Kiwi\Downloads\Microsoft Office 2016 Professional Plus X64-CYGiSO
Lesestoff:
Illegale Software: Cracks, Keygens und Co

Bitte lesen => http://www.trojaner-board.de/95393-c...-software.html

Es geht weiter wenn du alles Illegale entfernt hast.

Bei wiederholten Crack/Keygen Verstößen behalte ich es mir vor, den Support einzustellen, d.h. Hilfe nur noch bei der Datensicherung und Neuinstallation des Betriebssystems.

KiwiLink 30.08.2016 15:28
Ok, habe ich entfernt.
Hier die neue FRST.txt:
Code:
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 29-08-2016
durchgeführt von Kiwi☺ (Administrator) auf KIWINATOR (30-08-2016 16:26:43)
Gestartet von C:\Users\Kiwi\Downloads
Geladene Profile: Kiwi☺ (Verfügbare Profile: Kiwi☺)
Platform: Windows 10 Pro Version 1511 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvscpapisvr.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2service.exe
(Micro-Star Int'l Co., Ltd.) C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Windows\System32\PnkBstrA.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe
(Razer Inc.) C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe
() C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\wbem\WmiPrvSE.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(Malwarebytes) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(MSI) C:\Windows\SysWOW64\muachost.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\OSD\x64\MsiGamingOSD_x64.exe
(Micro-Star INT'L CO., LTD.) C:\Program Files (x86)\MSI\Gaming APP\OSD\x86\MsiGamingOSD_x86.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Users\Kiwi\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\NvOAWrapperCache.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
(Wacom Technology) C:\Program Files\Tablet\Wacom\WacomHost.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2guard.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\ShadowPlay\nvspcaps64.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\SpotifyCrashService.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe
(Spotify Ltd) C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Skillbrains) C:\Program Files (x86)\Skillbrains\lightshot\5.4.0.1\Lightshot.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Valve Corporation) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
(TeamSpeak Systems GmbH) C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe
(Emsisoft Ltd) C:\Program Files\Emsisoft Anti-Malware\a2start.exe
() C:\Program Files\WindowsApps\Microsoft.Messaging_2.15.20002.0_x86__8wekyb3d8bbwe\SkypeHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2397120 2016-06-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1767944 2016-08-30] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500936 2015-05-26] (Adobe Systems Incorporated)
HKLM\...\Run: [emsisoft anti-malware] => c:\program files\emsisoft anti-malware\a2guard.exe [7241200 2016-07-26] (Emsisoft Ltd)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Razer Synapse] => C:\Program Files (x86)\Razer\Synapse\RzSynapse.exe [596640 2016-07-07] (Razer Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
HKLM-x32\...\Run: [Lightshot] => C:\Program Files (x86)\Skillbrains\lightshot\Lightshot.exe [225944 2016-07-11] ()
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\steam.exe [2857248 2016-08-23] (Valve Corporation)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23375200 2016-07-29] (Google)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [Spotify Web Helper] => C:\Users\Kiwi\AppData\Roaming\Spotify\SpotifyWebHelper.exe [1523312 2016-08-25] (Spotify Ltd)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [Spotify] => C:\Users\Kiwi\AppData\Roaming\Spotify\Spotify.exe [6930544 2016-08-25] (Spotify Ltd)
HKU\S-1-5-21-2015112042-96394298-4154293379-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8894680 2016-08-05] (Piriform Ltd)
ShellIconOverlayIdentifiers: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX64.dll [2016-06-30] ()
ShellIconOverlayIdentifiers: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX64.dll [2016-06-30] ()
ShellIconOverlayIdentifiers: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX64.dll [2016-06-30] ()
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-07-29] (Google)
ShellIconOverlayIdentifiers: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [JzShlobj] -> {7B286609-DA97-47E1-AC6B-33B8B4732C95} =>  Keine Datei
ShellIconOverlayIdentifiers: [KzShlobj] -> {AAA0C5B8-933F-4200-93AD-B143D7FFF9F2} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ MEGA (Pending)] -> {056D528D-CE28-4194-9BA3-BA2E9197FF8C} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX32.dll [2016-06-30] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Synced)] -> {05B38830-F4E9-4329-978B-1DD28605D202} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX32.dll [2016-06-30] ()
ShellIconOverlayIdentifiers-x32: [ MEGA (Syncing)] -> {0596C850-7BDD-4C9D-AFDF-873BE6890637} => C:\Users\Kiwi\AppData\Local\MEGAsync\ShellExtX32.dll [2016-06-30] ()
ShellIconOverlayIdentifiers-x32: [ OneDrive1] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive2] -> {5AB7172C-9C11-405C-8DD5-AF20F3606282} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive3] -> {A78ED123-AB77-406B-9962-2A5D9D2F7F30} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive4] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers-x32: [ OneDrive5] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
Startup: C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MEGAsync.lnk [2016-08-27]
ShortcutTarget: MEGAsync.lnk -> C:\Users\Kiwi\AppData\Local\MEGAsync\MEGAsync.exe (Mega Limited)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Hosts: Es ist mehr als ein Eintrag in der Hosts Datei zu finden. Siehe Hosts-Bereich in Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{dba48a61-3617-451c-bd4d-748e1ed4b7b6}: [NameServer] 188.120.239.115,8.8.8.8
Tcpip\..\Interfaces\{dba48a61-3617-451c-bd4d-748e1ed4b7b6}: [DhcpNameServer] 192.168.178.1
ManualProxies:

Internet Explorer:
==================
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-08-08] (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-08-08] (Oracle Corporation)
Handler: WSWSVCUchrome - Kein CLSID Wert

FireFox:
========
FF ProfilePath: C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-08-08] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-08-08] (Oracle Corporation)
FF Plugin: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2015-03-09] (Adobe Systems)
FF Plugin: wacom.com/WacomTabletPlugin -> C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: @esn/esnlaunch,version=2.3.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll [2013-09-16] (ESN Social Software AB)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2016-07-11] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2016-07-11] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.31.5\npGoogleUpdate3.dll [2016-08-01] (Google Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.1.0.7 -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2015-03-09] (Adobe Systems)
FF Plugin-x32: wacom.com/WacomTabletPlugin -> C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll [2014-03-25] (Wacom)
FF Extension: (MEGA) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\firefox@mega.co.nz.xpi [2016-08-25]
FF Extension: (uBlock Origin) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\uBlock0@raymondhill.net.xpi [2016-08-07]
FF Extension: (ColorfulTabs) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2016-08-26]
FF Extension: (WOT) - C:\Users\Kiwi\AppData\Roaming\Mozilla\Firefox\Profiles\op28v1rx.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-08-08]
FF Extension: (Amazon Assistant for Firefox) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\abb@amazon.com.xpi [2016-08-26]
FF Extension: (MEGA) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\firefox@mega.co.nz.xpi [2016-08-25]
FF Extension: (uBlock Origin) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\uBlock0@raymondhill.net.xpi [2016-08-30]
FF Extension: (ColorfulTabs) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\{0545b830-f0aa-4d7e-8820-50a4629a56fe} [2016-08-30]
FF Extension: (WOT) - C:\Users\Kiwi\AppData\Roaming\Profiles\2kdda0bo.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2016-08-27]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 a2AntiMalware; C:\Program Files\Emsisoft Anti-Malware\a2service.exe [9331168 2016-07-26] (Emsisoft Ltd)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [1392648 2016-07-27] ()
S3 EasyAntiCheat; C:\Windows\SysWOW64\EasyAntiCheat.exe [227104 2016-07-28] (EasyAntiCheat Ltd)
R2 GamingApp_Service; C:\Program Files (x86)\MSI\Gaming APP\GamingApp_Service.exe [39888 2016-05-19] (Micro-Star Int'l Co., Ltd.)
R2 GamingHotkey_Service; C:\Program Files (x86)\MSI\Gaming APP\GamingHotkey_Service.exe [2019792 2016-05-16] (Micro-Star INT'L CO., LTD.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1163712 2016-06-14] (NVIDIA Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes)
R2 MSI_ActiveX_Service; C:\Program Files (x86)\MSI\MSI OC Kit\ActiveX_Service\MSI_ActiveX_Service.exe [54200 2016-06-01] (Micro-Star INT'L CO., LTD.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-06-14] (NVIDIA Corporation)
R3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [3632576 2016-06-14] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [2521024 2016-06-14] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2122248 2016-07-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2016-08-02] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2016-08-02] ()
R2 Razer Chroma SDK Service; C:\Program Files (x86)\Razer Chroma SDK\bin\RzSDKService.exe [69760 2016-06-20] (Razer Inc.)
R2 Razer Game Scanner Service; C:\Program Files (x86)\Razer\Razer Services\GSS\GameScannerService.exe [188072 2015-11-05] ()
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [7183632 2016-07-18] (TeamViewer GmbH)
S3 vmicvss; C:\Windows\System32\ICSvc.dll [511488 2015-10-30] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [364464 2015-10-30] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2016-07-01] (Microsoft Corporation)
S2 WsAppService; C:\Program Files (x86)\Wondershare\WAF\2.2.4.1\WsAppService.exe [417792 2016-07-12] (Wondershare) [Datei ist nicht signiert]
R2 WTabletServicePro; C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [730304 2016-01-11] (Wacom Technology, Corp.)
S2 KuaizipUpdateChecker; C:\Program Files\¿ìѹ\X86\kuaizipUpdateChecker.dll [X]
S2 NmdReportsnqg.exe; "C:\Program Files (x86)\Clsuyvertoph\NmdReportsnqg.exe" {C25DA384-2010-45A4-A1ED-BFA540D4789B} {9DC74CD5-24EA-4ADE-9C42-608A8CE17116} [X]
S2 ziphost; c:\program files\ziptool\ziphost.dll [X] <==== ACHTUNG

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S3 dg_ssudbus; C:\Windows\system32\DRIVERS\ssudbus.sys [130688 2016-07-22] (Samsung Electronics Co., Ltd.)
R1 epp; C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys [115832 2016-07-21] (Emsisoft Ltd)
R3 I2cHkBurn; C:\Windows\system32\drivers\I2cHkBurn.sys [41760 2015-07-27] (FINTEK Corp.)
R3 KillerEth; C:\Windows\System32\drivers\e22w10x64.sys [156744 2016-07-27] (Qualcomm Atheros, Inc.)
R2 KuaiZipDrive; C:\Windows\system32\drivers\KuaiZipDrive.sys [92872 2016-08-27] (WinMount International Inc)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [192216 2016-08-30] (Malwarebytes)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [26560 2016-06-14] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [56384 2016-04-14] (NVIDIA Corporation)
R3 rzendpt; C:\Windows\System32\drivers\rzendpt.sys [51736 2016-06-23] (Razer Inc)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [37184 2015-09-22] (Razer, Inc.)
R2 rzpnk; C:\Windows\system32\drivers\rzpnk.sys [130880 2015-12-14] (Razer, Inc.)
S3 ssudmdm; C:\Windows\system32\DRIVERS\ssudmdm.sys [164992 2016-07-22] (Samsung Electronics Co., Ltd.)
R1 UCGuard; C:\Windows\System32\DRIVERS\ucguard.sys [81792 2016-08-23] (Huorong Borui (Beijing) Technology Co., Ltd.) <==== ACHTUNG
S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44568 2015-10-30] (Microsoft Corporation)
S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [293216 2015-10-30] (Microsoft Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [118112 2015-10-30] (Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

NETSVCx32: HpSvc -> kein Dateipfad.

==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-08-30 16:12 - 2016-08-30 16:19 - 00051776 _____ C:\Users\Kiwi\Downloads\Addition.txt
2016-08-30 16:11 - 2016-08-30 16:26 - 00019938 _____ C:\Users\Kiwi\Downloads\FRST.txt
2016-08-30 16:11 - 2016-08-30 16:26 - 00000000 ____D C:\FRST
2016-08-30 16:11 - 2016-08-30 16:11 - 02397696 _____ (Farbar) C:\Users\Kiwi\Downloads\FRST64.exe
2016-08-30 14:20 - 2016-08-30 14:20 - 00001171 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware Guard.lnk
2016-08-30 14:02 - 2016-08-30 14:03 - 00000000 ____D C:\AdwCleaner
2016-08-30 14:02 - 2016-08-30 14:02 - 03826240 _____ C:\Users\Kiwi\Downloads\AdwCleaner_6.010.exe
2016-08-30 13:50 - 2016-08-30 13:50 - 00000000 ____D C:\Users\Kiwi\Desktop\Games icons
2016-08-30 13:47 - 2016-08-30 13:49 - 43836245 _____ C:\Users\Kiwi\Downloads\Games icons.rar
2016-08-30 13:13 - 2016-08-30 13:13 - 01767944 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2016-08-30 12:46 - 2016-08-30 12:46 - 00000000 ___HD C:\$SysReset
2016-08-30 01:17 - 2016-08-30 13:11 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\JAP
2016-08-30 01:17 - 2016-08-30 01:17 - 00347664 _____ (JAP-Team) C:\Users\Kiwi\Downloads\japsetup.exe
2016-08-30 01:17 - 2016-08-30 01:17 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\JonDo
2016-08-29 23:40 - 2016-08-29 23:40 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\.mono
2016-08-29 23:40 - 2016-08-29 23:40 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Colossal Order
2016-08-29 23:40 - 2016-08-29 23:40 - 00000000 ____D C:\ProgramData\.mono
2016-08-29 22:53 - 2016-08-29 22:54 - 133940295 _____ C:\Users\Kiwi\Downloads\KiWiFX Motion Pack.rar
2016-08-29 22:19 - 2016-08-29 22:19 - 16132140 _____ C:\Users\Kiwi\Desktop\Community Server.mp4
2016-08-29 21:12 - 2016-08-29 21:12 - 00000000 ____D C:\Users\Kiwi\.thumbnails
2016-08-29 21:09 - 2016-08-29 21:09 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Blender
2016-08-29 21:09 - 2016-08-29 21:09 - 00000000 ____D C:\Program Files\Blender Foundation
2016-08-29 21:06 - 2016-08-29 21:07 - 83722580 _____ C:\Users\Kiwi\Downloads\blender-2.77a-windows64.msi
2016-08-29 15:45 - 2016-08-29 15:46 - 00000000 ____D C:\Users\Kiwi\Downloads\PokeBuddy
2016-08-29 15:37 - 2016-08-29 15:37 - 00000000 ____D C:\Users\Kiwi\AppData\Local\GMap.NET
2016-08-29 15:36 - 2016-08-30 01:00 - 00000000 ____D C:\Users\Kiwi\Desktop\PokeBuddy
2016-08-29 15:35 - 2016-08-29 15:36 - 28593836 _____ C:\Users\Kiwi\Desktop\PokeBuddy.rar
2016-08-29 14:23 - 2016-08-29 14:23 - 00000458 _____ C:\Users\Kiwi\Downloads\autoconfig
2016-08-29 14:19 - 2016-08-30 01:36 - 00002937 _____ C:\Users\Kiwi\Desktop\bewerbung.txt
2016-08-29 13:11 - 2016-08-29 13:11 - 00000222 _____ C:\Users\Kiwi\Desktop\Cities Skylines.url
2016-08-29 11:18 - 2016-08-29 11:18 - 00003917 _____ C:\Users\Kiwi\Desktop\M.I.K.E.bat
2016-08-28 17:18 - 2016-08-28 17:18 - 00000000 ____D C:\Users\Kiwi\Documents\MAGIX Downloads
2016-08-28 17:17 - 2016-08-28 17:19 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\MAGIX
2016-08-28 17:17 - 2016-08-28 17:19 - 00000000 ____D C:\ProgramData\MAGIX
2016-08-28 17:17 - 2016-08-28 17:18 - 00000000 ___RD C:\Users\Kiwi\Documents\MAGIX
2016-08-28 17:17 - 2016-08-28 17:17 - 00001306 _____ C:\Users\Public\Desktop\MAGIX Music Maker Premium.lnk
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Users\Public\Documents\MAGIX
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Users\Kiwi\Documents\MAGIX_MusicEditor
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Xara
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MAGIX
2016-08-28 17:17 - 2016-08-28 17:17 - 00000000 ____D C:\Program Files (x86)\MAGIX
2016-08-28 17:16 - 2016-08-28 17:16 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2016-08-28 16:17 - 2016-08-28 16:17 - 00002858 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2016-08-28 16:17 - 2016-08-28 16:17 - 00000863 _____ C:\Users\Public\Desktop\CCleaner.lnk
2016-08-28 16:17 - 2016-08-28 16:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2016-08-28 16:17 - 2016-08-28 16:17 - 00000000 ____D C:\Program Files\CCleaner
2016-08-28 16:16 - 2016-08-28 16:16 - 08228024 _____ (Piriform Ltd) C:\Users\Kiwi\Downloads\ccsetup521pro.exe
2016-08-28 16:13 - 2016-08-28 16:53 - 699071640 _____ (MAGIX Software GmbH) C:\Users\Kiwi\Downloads\music_maker_2017_premium_dlv_computerbild_de_20160801_09-36.exe
2016-08-28 13:36 - 2016-08-30 14:18 - 00000408 _____ C:\Windows\Tasks\update-sys.job
2016-08-28 13:36 - 2016-08-30 13:18 - 00000408 _____ C:\Windows\Tasks\update-S-1-5-21-2015112042-96394298-4154293379-1001.job
2016-08-28 13:36 - 2016-08-28 13:36 - 00003394 _____ C:\Windows\System32\Tasks\update-S-1-5-21-2015112042-96394298-4154293379-1001
2016-08-28 13:36 - 2016-08-28 13:36 - 00003334 _____ C:\Windows\System32\Tasks\update-sys
2016-08-28 13:36 - 2016-08-28 13:36 - 00000424 _____ C:\Users\Kiwi\AppData\Local\UserProducts.xml
2016-08-28 13:36 - 2016-08-28 13:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lightshot
2016-08-28 13:36 - 2016-08-28 13:36 - 00000000 ____D C:\Program Files (x86)\Skillbrains
2016-08-28 13:35 - 2016-08-28 13:35 - 02575272 _____ (Skillbrains ) C:\Users\Kiwi\Downloads\setup-lightshot.exe
2016-08-28 13:29 - 2016-08-28 13:29 - 00403626 _____ C:\Users\Kiwi\Downloads\gobold.zip
2016-08-28 13:28 - 2016-08-28 13:28 - 00026118 _____ C:\Users\Kiwi\Downloads\code.zip
2016-08-28 13:10 - 2016-08-28 13:14 - 194514997 _____ C:\Users\Kiwi\Downloads\HeartFX mini sync pack.rar
2016-08-28 04:07 - 2016-08-28 04:07 - 17404104 _____ C:\Users\Kiwi\Downloads\SypeFX_Lights.rar
2016-08-28 04:07 - 2016-08-28 04:07 - 00937967 _____ C:\Users\Kiwi\Downloads\CC Pack Josh S. .zip
2016-08-28 03:49 - 2016-08-28 03:50 - 16762145 _____ C:\Users\Kiwi\Downloads\Sync Pack - PabloDesigns.zip
2016-08-28 03:32 - 2016-08-28 03:33 - 14811592 _____ C:\Users\Kiwi\Downloads\Free Shockwave Pack (DonatFX).zip
2016-08-28 03:15 - 2016-08-28 04:08 - 134365397 _____ C:\Users\Kiwi\Downloads\24 Epic Animation For Title - GW7.zip
2016-08-28 02:59 - 2016-08-28 02:59 - 00000000 ____D C:\ProgramData\Emsisoft
2016-08-28 02:57 - 2016-08-30 16:23 - 00000000 ____D C:\Program Files\Emsisoft Anti-Malware
2016-08-28 02:57 - 2016-08-28 02:57 - 00000937 _____ C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2016-08-28 02:57 - 2016-08-28 02:57 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2016-08-28 02:50 - 2016-08-28 02:55 - 277246696 _____ (Emsisoft Ltd. ) C:\Users\Kiwi\Downloads\EmsisoftAntiMalwareSetup.exe
2016-08-27 14:13 - 2016-08-29 16:01 - 00001135 _____ C:\Users\Kiwi\Desktop\nativelog.txt
2016-08-27 04:23 - 2016-08-27 12:24 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Ludashi
2016-08-27 04:08 - 2016-08-28 03:24 - 00000000 ____D C:\Program Files (x86)\LdsLite
2016-08-27 04:08 - 2016-08-27 04:08 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\鲁大师游戏库
2016-08-27 03:49 - 2016-08-27 03:49 - 11374528 _____ (VS Revo Group ) C:\Users\Kiwi\Downloads\RevoUninProSetup-316.exe
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\Users\Kiwi\AppData\Local\VS Revo Group
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\ProgramData\VS Revo Group
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
2016-08-27 03:49 - 2016-08-27 03:49 - 00000000 ____D C:\Program Files\VS Revo Group
2016-08-27 03:49 - 2009-12-30 11:21 - 00031800 _____ (VS Revo Group) C:\Windows\system32\Drivers\revoflt.sys
2016-08-27 03:44 - 2016-08-27 03:44 - 00003252 _____ C:\Windows\System32\Tasks\{6B0496CA-37FE-4410-999F-9949EE20FA96}
2016-08-27 03:35 - 2016-08-30 16:23 - 00192216 _____ (Malwarebytes) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2016-08-27 03:33 - 2016-08-27 12:29 - 00001165 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2016-08-27 03:33 - 2016-08-27 03:34 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2016-08-27 03:33 - 2016-08-27 03:34 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2016-08-27 03:33 - 2016-08-27 03:33 - 00000000 ____D C:\ProgramData\Malwarebytes
2016-08-27 03:33 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2016-08-27 03:33 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-08-27 03:33 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbam.sys
2016-08-27 03:32 - 2016-08-27 03:33 - 22851472 _____ (Malwarebytes ) C:\Users\Kiwi\Downloads\mbam-setup-2.2.1.1043.exe
2016-08-27 03:30 - 2016-08-27 03:30 - 00003278 _____ C:\Windows\System32\Tasks\{8E5FF780-BF2D-4671-871B-39F4F48FA20A}
2016-08-27 03:29 - 2016-08-27 03:29 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\净广大师
2016-08-27 03:26 - 2016-08-28 03:24 - 00000000 ____D C:\Program Files\¿ìѹ
2016-08-27 03:26 - 2016-08-27 12:29 - 00000926 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\¿ìѹ.lnk
2016-08-27 03:26 - 2016-08-27 03:48 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Kuaizip
2016-08-27 03:26 - 2016-08-27 03:26 - 00092872 _____ (WinMount International Inc) C:\Windows\system32\Drivers\KuaiZipDrive.sys
2016-08-27 03:26 - 2016-08-27 03:26 - 00001595 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UC浏览器.lnk
2016-08-27 03:26 - 2016-08-27 03:26 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Softlink
2016-08-27 03:26 - 2016-08-23 09:45 - 00081792 _____ (Huorong Borui (Beijing) Technology Co., Ltd.) C:\Windows\system32\Drivers\ucguard.sys
2016-08-27 03:25 - 2016-08-27 03:25 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Compress
2016-08-27 03:24 - 2016-08-27 03:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-08-27 03:24 - 2016-08-27 03:24 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-08-27 03:23 - 2016-08-28 02:47 - 00187904 _____ C:\Windows\rsrcs.dll
2016-08-27 03:23 - 2016-08-27 04:09 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Apps\2.0
2016-08-27 03:21 - 2016-08-27 03:20 - 00001550 _____ C:\Windows\system32\Drivers\etc\hp.bak
2016-08-27 02:33 - 2016-08-27 02:33 - 00000000 ____D C:\Users\Kiwi\Documents\Camtasia Studio
2016-08-27 02:33 - 2016-08-27 02:33 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\TechSmith
2016-08-27 02:33 - 2016-08-27 02:33 - 00000000 ____D C:\Users\Kiwi\AppData\Local\TechSmith
2016-08-27 02:32 - 2016-08-27 12:29 - 00001235 _____ C:\Users\Public\Desktop\Camtasia Studio 8.lnk
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\ProgramData\TechSmith
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\ProgramData\regid.1995-08.com.techsmith
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TechSmith
2016-08-27 02:32 - 2016-08-27 02:32 - 00000000 ____D C:\Program Files (x86)\TechSmith
2016-08-27 02:28 - 2016-08-27 02:30 - 258696506 _____ C:\Users\Kiwi\Downloads\Camtasia Studio 8.rar
2016-08-27 02:23 - 2016-08-27 02:23 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\SmartSteamEmu
2016-08-27 02:23 - 2016-08-27 02:23 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Dry Cactus
2016-08-27 02:21 - 2016-08-27 02:22 - 130445508 _____ C:\Users\Kiwi\Downloads\Poly Bridge.rar
2016-08-27 01:52 - 2016-08-27 01:52 - 00001135 _____ C:\Users\Kiwi\Downloads\nativelog.txt
2016-08-27 01:14 - 2016-08-27 01:14 - 00000000 ____D C:\Users\Kiwi\AppData\Local\LooksBuilder
2016-08-27 00:59 - 2016-08-27 01:01 - 50359510 _____ C:\Users\Kiwi\Downloads\500 SUB EDITING PACK(2).rar
2016-08-27 00:55 - 2016-08-27 01:02 - 419430400 _____ C:\Users\Kiwi\Downloads\EDITINGPACK.part1.rar
2016-08-27 00:26 - 2016-08-30 00:38 - 00000000 ____D C:\Users\Kiwi\Desktop\KiwiLink
2016-08-27 00:06 - 2016-08-27 00:07 - 46853365 _____ C:\Users\Kiwi\Downloads\Banner 7 By Nelson Designs.zip
2016-08-26 20:57 - 2016-08-26 22:38 - 665443937 _____ C:\Users\Kiwi\Downloads\NetworkRPGMod.rar
2016-08-26 02:04 - 2016-08-27 12:29 - 00001161 _____ C:\Users\Kiwi\Desktop\MEGAsync.lnk
2016-08-26 02:04 - 2016-08-26 02:04 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MEGAsync
2016-08-26 02:04 - 2016-08-26 02:04 - 00000000 ____D C:\Users\Kiwi\AppData\Local\MEGAsync
2016-08-26 02:04 - 2016-08-26 02:04 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Mega Limited
2016-08-26 01:56 - 2016-08-26 01:56 - 12903336 _____ (MEGA Limited) C:\Users\Kiwi\Downloads\MEGAsyncSetup.exe
2016-08-26 01:50 - 2016-08-26 12:35 - 508035072 _____ C:\Users\Kiwi\Downloads\Far Cry 4.zip
2016-08-25 23:38 - 2016-08-26 01:15 - 04718592 _____ C:\Users\Kiwi\Downloads\Planet Coaster.rar
2016-08-25 17:10 - 2016-08-25 17:10 - 05536082 _____ C:\Users\Kiwi\Downloads\RAGEPluginHook_0_45_1000_9441_ALPHA.zip
2016-08-25 16:37 - 2016-08-25 16:37 - 00000000 ____D C:\Users\Kiwi\Downloads\2014_DODGE_CHARGER_LSSD%20_%20V1.2L
2016-08-25 12:41 - 2016-08-25 12:42 - 36080281 _____ C:\Users\Kiwi\Downloads\2014_DODGE_CHARGER_LSSD%20_%20V1.2L.zip
2016-08-25 05:08 - 2016-08-03 13:14 - 01505984 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2016-08-25 05:08 - 2016-08-03 13:14 - 00092352 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2016-08-25 05:08 - 2016-08-03 13:14 - 00050368 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2016-08-25 05:08 - 2016-08-03 12:36 - 07469408 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2016-08-25 05:08 - 2016-08-03 12:36 - 00099680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pdc.sys
2016-08-25 05:08 - 2016-08-03 12:36 - 00037744 _____ (Microsoft Corporation) C:\Windows\system32\wldp.dll
2016-08-25 05:08 - 2016-08-03 12:30 - 00026408 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2016-08-25 05:08 - 2016-08-03 12:23 - 00693600 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupEngine.dll
2016-08-25 05:08 - 2016-08-03 12:23 - 00115040 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupApi.dll
2016-08-25 05:08 - 2016-08-03 12:22 - 00808288 _____ (Microsoft Corporation) C:\Windows\system32\WWAHost.exe
2016-08-25 05:08 - 2016-08-03 12:22 - 00465248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2016-08-25 05:08 - 2016-08-03 12:22 - 00331616 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\pci.sys
2016-08-25 05:08 - 2016-08-03 12:21 - 03675512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2016-08-25 05:08 - 2016-08-03 12:21 - 00566112 _____ (Microsoft Corporation) C:\Windows\system32\SettingSyncHost.exe
2016-08-25 05:08 - 2016-08-03 12:21 - 00303216 _____ (Microsoft Corporation) C:\Windows\system32\LockAppHost.exe
2016-08-25 05:08 - 2016-08-03 12:20 - 01540224 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2016-08-25 05:08 - 2016-08-03 12:20 - 00692136 _____ (Microsoft Corporation) C:\Windows\system32\sppwinob.dll
2016-08-25 05:08 - 2016-08-03 12:19 - 00604928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2016-08-25 05:08 - 2016-08-03 12:19 - 00161632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2016-08-25 05:08 - 2016-08-03 12:13 - 01988448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2016-08-25 05:08 - 2016-08-03 12:13 - 00576864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms2.sys
2016-08-25 05:08 - 2016-08-03 12:13 - 00393056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2016-08-25 05:08 - 2016-08-03 11:51 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\tdlrecover.exe
2016-08-25 05:08 - 2016-08-03 11:51 - 00084480 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2016-08-25 05:08 - 2016-08-03 11:46 - 22384128 _____ (Microsoft Corporation) C:\Windows\system32\edgehtml.dll
2016-08-25 05:08 - 2016-08-03 11:44 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\MusNotification.exe
2016-08-25 05:08 - 2016-08-03 11:44 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\wshbth.dll
2016-08-25 05:08 - 2016-08-03 11:44 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\musdialoghandlers.dll
2016-08-25 05:08 - 2016-08-03 11:43 - 16985088 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Xaml.dll
2016-08-25 05:08 - 2016-08-03 11:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryClient.dll
2016-08-25 05:08 - 2016-08-03 11:41 - 00059904 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepositoryBroker.dll
2016-08-25 05:08 - 2016-08-03 11:40 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\VEDataLayerHelpers.dll
2016-08-25 05:08 - 2016-08-03 11:40 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\MusNotificationUx.exe
2016-08-25 05:08 - 2016-08-03 11:40 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\TpmTasks.dll
2016-08-25 05:08 - 2016-08-03 11:39 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2016-08-25 05:08 - 2016-08-03 11:39 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\BluetoothApis.dll
2016-08-25 05:08 - 2016-08-03 11:38 - 00379392 _____ (Microsoft Corporation) C:\Windows\system32\usocore.dll
2016-08-25 05:08 - 2016-08-03 11:37 - 00110080 _____ (Microsoft Corporation) C:\Windows\system32\IdCtrls.dll
2016-08-25 05:08 - 2016-08-03 11:36 - 00211456 _____ (Microsoft Corporation) C:\Windows\system32\NetSetupSvc.dll
2016-08-25 05:08 - 2016-08-03 11:36 - 00198144 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2016-08-25 05:08 - 2016-08-03 11:35 - 00764928 _____ (Microsoft Corporation) C:\Windows\system32\Chakradiag.dll
2016-08-25 05:08 - 2016-08-03 11:35 - 00200192 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2016-08-25 05:08 - 2016-08-03 11:33 - 00285184 _____ (Microsoft Corporation) C:\Windows\system32\VEEventDispatcher.dll
2016-08-25 05:08 - 2016-08-03 11:31 - 00506880 _____ (Microsoft Corporation) C:\Windows\system32\tileobjserver.dll
2016-08-25 05:08 - 2016-08-03 11:31 - 00247296 _____ (Microsoft Corporation) C:\Windows\system32\wevtutil.exe
2016-08-25 05:08 - 2016-08-03 11:30 - 00515072 _____ (Microsoft Corporation) C:\Windows\system32\OneDriveSettingSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 11:29 - 14252544 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2016-08-25 05:08 - 2016-08-03 11:29 - 02127360 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2016-08-25 05:08 - 2016-08-03 11:29 - 01500160 _____ (Microsoft Corporation) C:\Windows\system32\RecoveryDrive.exe
2016-08-25 05:08 - 2016-08-03 11:29 - 01387520 _____ (Microsoft Corporation) C:\Windows\system32\win32kbase.sys
2016-08-25 05:08 - 2016-08-03 11:29 - 00784384 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2016-08-25 05:08 - 2016-08-03 11:28 - 01213440 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2016-08-25 05:08 - 2016-08-03 11:28 - 00848896 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2016-08-25 05:08 - 2016-08-03 11:27 - 07536640 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2016-08-25 05:08 - 2016-08-03 11:27 - 01717760 _____ (Microsoft Corporation) C:\Windows\system32\GdiPlus.dll
2016-08-25 05:08 - 2016-08-03 11:27 - 00381952 _____ (Microsoft Corporation) C:\Windows\system32\wuuhext.dll
2016-08-25 05:08 - 2016-08-03 11:20 - 13390336 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2016-08-25 05:08 - 2016-08-03 11:18 - 06974464 _____ (Microsoft Corporation) C:\Windows\system32\Windows.Data.Pdf.dll
2016-08-25 05:08 - 2016-08-03 11:18 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentExtensions.dll
2016-08-25 05:08 - 2016-08-03 11:18 - 01388032 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2016-08-25 05:08 - 2016-08-03 11:17 - 02175488 _____ (Microsoft Corporation) C:\Windows\system32\AppXDeploymentServer.dll
2016-08-25 05:08 - 2016-08-03 11:16 - 05123072 _____ (Microsoft Corporation) C:\Windows\system32\dbgeng.dll
2016-08-25 05:08 - 2016-08-03 11:16 - 03589120 _____ (Microsoft Corporation) C:\Windows\system32\win32kfull.sys
2016-08-25 05:08 - 2016-08-03 11:16 - 02635776 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Logon.dll
2016-08-25 05:08 - 2016-08-03 11:16 - 01732096 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2016-08-25 05:08 - 2016-08-03 11:15 - 07833088 _____ (Microsoft Corporation) C:\Windows\system32\Chakra.dll
2016-08-25 05:08 - 2016-08-03 11:14 - 04895232 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2016-08-25 05:08 - 2016-08-03 11:14 - 01997824 _____ (Microsoft Corporation) C:\Windows\system32\ActiveSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 11:13 - 03025920 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2016-08-25 05:08 - 2016-08-03 11:13 - 02280960 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2016-08-25 05:08 - 2016-08-03 11:12 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\Windows.StateRepository.dll
2016-08-25 05:08 - 2016-08-03 11:11 - 04171264 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2016-08-25 05:08 - 2016-08-03 07:52 - 00034088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wldp.dll
2016-08-25 05:08 - 2016-08-03 07:34 - 00501592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupEngine.dll
2016-08-25 05:08 - 2016-08-03 07:34 - 00084832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\NetSetupApi.dll
2016-08-25 05:08 - 2016-08-03 07:33 - 00051128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsNativeApi.dll
2016-08-25 05:08 - 2016-08-03 07:31 - 02921368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2016-08-25 05:08 - 2016-08-03 07:31 - 00957608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2016-08-25 05:08 - 2016-08-03 07:31 - 00703840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
2016-08-25 05:08 - 2016-08-03 07:30 - 21123320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2016-08-25 05:08 - 2016-08-03 07:30 - 00465760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SettingSyncHost.exe
2016-08-25 05:08 - 2016-08-03 07:30 - 00255168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LockAppHost.exe
2016-08-25 05:08 - 2016-08-03 06:57 - 00091648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdlrecover.exe
2016-08-25 05:08 - 2016-08-03 06:48 - 00051712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshbth.dll
2016-08-25 05:08 - 2016-08-03 06:47 - 13018112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Xaml.dll
2016-08-25 05:08 - 2016-08-03 06:44 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepositoryClient.dll
2016-08-25 05:08 - 2016-08-03 06:44 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepositoryBroker.dll
2016-08-25 05:08 - 2016-08-03 06:42 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\BluetoothApis.dll
2016-08-25 05:08 - 2016-08-03 06:40 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IdCtrls.dll
2016-08-25 05:08 - 2016-08-03 06:39 - 19351040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2016-08-25 05:08 - 2016-08-03 06:37 - 00219136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VEEventDispatcher.dll
2016-08-25 05:08 - 2016-08-03 06:35 - 00178688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wevtutil.exe
2016-08-25 05:08 - 2016-08-03 06:34 - 00792064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2016-08-25 05:08 - 2016-08-03 06:34 - 00400896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\OneDriveSettingSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 06:33 - 18677760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\edgehtml.dll
2016-08-25 05:08 - 2016-08-03 06:33 - 02050048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2016-08-25 05:08 - 2016-08-03 06:33 - 00687616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2016-08-25 05:08 - 2016-08-03 06:32 - 12585984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2016-08-25 05:08 - 2016-08-03 06:32 - 01467392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GdiPlus.dll
2016-08-25 05:08 - 2016-08-03 06:32 - 00434688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\LogonController.dll
2016-08-25 05:08 - 2016-08-03 06:31 - 06743040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2016-08-25 05:08 - 2016-08-03 06:31 - 00705536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2016-08-25 05:08 - 2016-08-03 06:29 - 12133376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2016-08-25 05:08 - 2016-08-03 06:28 - 03663360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2016-08-25 05:08 - 2016-08-03 06:25 - 05323776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.Data.Pdf.dll
2016-08-25 05:08 - 2016-08-03 06:25 - 04078080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dbgeng.dll
2016-08-25 05:08 - 2016-08-03 06:23 - 05660672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Chakra.dll
2016-08-25 05:08 - 2016-08-03 06:23 - 01799680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Logon.dll
2016-08-25 05:08 - 2016-08-03 06:22 - 02501120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2016-08-25 05:08 - 2016-08-03 06:22 - 01502208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2016-08-25 05:08 - 2016-08-03 06:21 - 01708032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ActiveSyncProvider.dll
2016-08-25 05:08 - 2016-08-03 06:19 - 02180096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.StateRepository.dll
2016-08-25 05:07 - 2016-08-03 12:22 - 01322760 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2016-08-25 05:07 - 2016-08-03 12:22 - 00058408 _____ (Microsoft Corporation) C:\Windows\system32\SensorsNativeApi.dll
2016-08-25 05:07 - 2016-08-03 12:21 - 22561256 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2016-08-25 05:07 - 2016-08-03 12:11 - 00422744 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdbss.sys
2016-08-25 05:07 - 2016-08-03 11:40 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\bthserv.dll
2016-08-25 05:07 - 2016-08-03 11:38 - 00412160 _____ (Microsoft Corporation) C:\Windows\system32\MusUpdateHandlers.dll
2016-08-25 05:07 - 2016-08-03 11:36 - 00221696 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2016-08-25 05:07 - 2016-08-03 11:34 - 00383488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2016-08-25 05:07 - 2016-08-03 11:33 - 00339968 _____ (Microsoft Corporation) C:\Windows\system32\SensorService.dll
2016-08-25 05:07 - 2016-08-03 11:31 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\SensorsApi.dll
2016-08-25 05:07 - 2016-08-03 11:30 - 24613888 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2016-08-25 05:07 - 2016-08-03 11:30 - 00970752 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2016-08-25 05:07 - 2016-08-03 11:28 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\LogonController.dll
2016-08-25 05:07 - 2016-08-03 11:27 - 01752576 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2016-08-25 05:07 - 2016-08-03 06:37 - 00335872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2016-08-25 05:07 - 2016-08-03 06:35 - 00286208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SensorsApi.dll
2016-08-25 05:07 - 2016-08-03 06:32 - 01526272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2016-08-25 04:20 - 2016-08-27 03:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2016-08-25 04:05 - 2016-08-25 04:05 - 00000219 _____ C:\Users\Kiwi\Desktop\Portal 2.url
2016-08-25 03:40 - 2016-08-25 03:40 - 00000000 ____D C:\Users\Default\AppData\Local\Google
2016-08-25 03:40 - 2016-08-25 03:40 - 00000000 ____D C:\Users\Default User\AppData\Local\Google
2016-08-25 03:36 - 2016-08-25 03:32 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMHVE.DLL
2016-08-25 03:36 - 2016-08-25 03:32 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BHVE.DLL
2016-08-25 03:36 - 2016-08-25 03:32 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2016-08-25 03:35 - 2016-08-27 12:29 - 00000997 _____ C:\Users\Public\Desktop\EPSON Scan.lnk
2016-08-25 03:35 - 2016-08-25 03:35 - 00000000 ____D C:\Program Files (x86)\epson
2016-08-25 03:35 - 2012-07-24 00:00 - 00466432 _____ (Seiko Epson Corporation) C:\Windows\system32\esxw2ud.dll
2016-08-25 03:35 - 2009-10-16 00:00 - 00132560 _____ (Seiko Epson Corporation) C:\Windows\system32\esdevapp.exe
2016-08-25 03:35 - 2009-10-16 00:00 - 00013824 _____ (Seiko Epson Corporation) C:\Windows\system32\esxcdev.dll
2016-08-08 15:41 - 2016-08-08 15:41 - 00000000 ____D C:\Users\Kiwi\Downloads\Telegram Desktop
2016-08-08 12:33 - 2016-08-29 21:07 - 00000000 ____D C:\Users\Kiwi\.junique
2016-08-08 12:33 - 2016-08-29 21:07 - 00000000 ____D C:\Program Files (x86)\ArmA3Sync
2016-08-08 12:33 - 2016-08-27 12:29 - 00001082 _____ C:\Users\Public\Desktop\ArmA3Sync.lnk
2016-08-08 12:33 - 2016-08-08 12:33 - 03591433 _____ C:\Users\Kiwi\Downloads\ArmA3Sync-launcher-and-addons-synchronization-version-1.5.80.7z
2016-08-08 12:33 - 2016-08-08 12:33 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ArmA3Sync
2016-08-08 02:13 - 2016-08-08 02:13 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\WTablet
2016-08-08 02:13 - 2016-08-08 02:13 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Wacom
2016-08-08 02:13 - 2016-08-08 02:13 - 00000000 ____D C:\Users\Kiwi\.android
2016-08-08 01:34 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Eclipse
2016-08-08 01:34 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\.tooling
2016-08-08 01:33 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\java_workspace
2016-08-08 01:31 - 2016-08-27 12:29 - 00001113 _____ C:\Users\Kiwi\Desktop\Eclipse Java Neon.lnk
2016-08-08 01:31 - 2016-08-08 01:31 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Eclipse
2016-08-08 01:30 - 2016-08-08 01:30 - 00000000 ____D C:\Users\Kiwi\eclipse
2016-08-08 01:29 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\.p2
2016-08-08 01:29 - 2016-08-08 01:34 - 00000000 ____D C:\Users\Kiwi\.eclipse
2016-08-08 01:28 - 2016-08-08 01:29 - 00000000 ____D C:\Users\Kiwi\.oracle_jre_usage
2016-08-08 01:28 - 2016-08-08 01:28 - 00110144 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Sun
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Sun
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\ProgramData\Oracle
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java Development Kit
2016-08-08 01:28 - 2016-08-08 01:28 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2016-08-08 01:27 - 2016-08-08 01:28 - 00000000 ____D C:\Program Files\Java
2016-08-08 01:27 - 2016-08-08 01:27 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Oracle
2016-08-08 01:25 - 2016-08-08 01:27 - 203084344 _____ (Oracle Corporation) C:\Users\Kiwi\Downloads\jdk-8u101-windows-x64.exe
2016-08-08 01:23 - 2016-08-08 01:24 - 46954408 _____ C:\Users\Kiwi\Downloads\eclipse-inst-win64.exe
2016-08-07 23:51 - 2016-08-27 12:29 - 00001771 _____ C:\Users\Public\Desktop\Prison Architect.lnk
2016-08-07 23:51 - 2016-08-07 23:52 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Introversion
2016-08-07 23:51 - 2016-08-07 23:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Prison Architect [GOG.com]
2016-08-07 23:51 - 2016-08-07 23:51 - 00000000 ____D C:\GOG Games
2016-08-07 23:47 - 2016-08-07 23:51 - 343771056 _____ (GOG.com ) C:\Users\Kiwi\Downloads\setup_prison_architect_2.6.0.9.exe
2016-08-07 23:39 - 2016-08-07 23:39 - 00646152 _____ (Amazon Web Services, Inc.) C:\Users\Kiwi\Downloads\LumberyardInstaller1.3.0.1.exe
2016-08-07 18:20 - 2016-08-07 18:20 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wacom Tablett
2016-08-07 18:20 - 2016-08-07 18:20 - 00000000 ____D C:\Program Files\TabletPlugins
2016-08-07 18:20 - 2016-08-07 18:20 - 00000000 ____D C:\Program Files (x86)\TabletPlugins
2016-08-07 18:19 - 2016-08-07 18:20 - 00000000 ____D C:\Program Files\Tablet
2016-08-07 18:19 - 2016-01-11 19:30 - 02103488 _____ (Wacom Technology, Corp.) C:\Windows\system32\WacomMT.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 02077888 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 02071232 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wacom_Touch_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01966272 _____ (Wacom Technology, Corp.) C:\Windows\system32\Wintab32.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01683648 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\WacomMT.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01681600 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01674432 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wacom_Touch_Tablet.dll
2016-08-07 18:19 - 2016-01-11 19:30 - 01571520 _____ (Wacom Technology, Corp.) C:\Windows\SysWOW64\Wintab32.dll
2016-08-07 18:19 - 2015-11-30 19:34 - 00103616 _____ (Wacom Technology) C:\Windows\system32\Drivers\wachidrouter.sys
2016-08-07 18:19 - 2015-11-30 19:34 - 00015040 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys
2016-08-07 18:19 - 2015-11-30 19:34 - 00014016 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\hidkmdf.sys
2016-08-07 18:19 - 2012-12-12 00:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\wdfcoinstaller01009.dll
2016-08-07 18:19 - 2012-12-12 00:12 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wdfcoinstaller01009.dll
2016-08-07 18:03 - 2016-08-07 23:09 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\.minecraft
2016-08-07 18:03 - 2016-08-07 18:03 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\java
2016-08-07 18:02 - 2016-08-27 12:29 - 00001024 _____ C:\Users\Public\Desktop\Minecraft.lnk
2016-08-07 18:02 - 2016-08-07 18:03 - 00000000 ____D C:\Program Files (x86)\Minecraft
2016-08-07 18:02 - 2016-08-07 18:02 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Minecraft
2016-08-07 16:02 - 2016-08-07 16:02 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\vibranceGUI
2016-08-06 21:18 - 2016-08-08 01:40 - 00000000 ____D C:\Users\Kiwi\Desktop\OpenHardwareMonitor
2016-08-06 21:17 - 2016-08-06 21:17 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\MSI
2016-08-06 20:25 - 2016-08-06 20:25 - 00151552 _____ C:\Windows\SysWOW64\nvRegDev.dll
2016-08-06 20:25 - 2016-08-06 20:25 - 00061440 _____ C:\Windows\SysWOW64\nvPhotoshopUtil.dll
2016-08-06 20:25 - 2016-08-06 20:25 - 00040960 _____ C:\Windows\SysWOW64\nvISWOW64.dll
2016-08-06 20:20 - 2016-08-06 20:20 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Adobe
2016-08-06 20:09 - 2016-08-27 12:29 - 00001129 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CC 2015.lnk
2016-08-06 19:43 - 2016-08-27 12:29 - 00001082 _____ C:\Users\Public\Desktop\Notepad++.lnk
2016-08-06 19:43 - 2016-08-06 19:44 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Notepad++
2016-08-06 19:43 - 2016-08-06 19:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Notepad++
2016-08-06 19:43 - 2016-08-06 19:43 - 00000000 ____D C:\Program Files (x86)\Notepad++
2016-08-06 18:28 - 2016-08-30 16:23 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Spotify
2016-08-06 18:28 - 2016-08-27 12:29 - 00001884 _____ C:\Users\Kiwi\Desktop\Spotify.lnk
2016-08-06 18:28 - 2016-08-27 12:29 - 00001870 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Spotify.lnk
2016-08-06 18:27 - 2016-08-30 16:24 - 00000863 _____ C:\Users\Kiwi\Desktop\Tor Browser.lnk
2016-08-06 18:27 - 2016-08-30 16:24 - 00000863 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Tor Browser.lnk
2016-08-06 18:27 - 2016-08-30 16:00 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Spotify
2016-08-04 01:27 - 2016-08-04 01:27 - 00000218 _____ C:\Users\Kiwi\Desktop\Team Fortress Classic.url
2016-08-04 01:12 - 2016-08-04 01:12 - 00000220 _____ C:\Users\Kiwi\Desktop\Garry's Mod.url
2016-08-04 01:04 - 2016-08-04 01:49 - 00000000 ____D C:\Users\Kiwi\Documents\TrinusVR
2016-08-04 01:04 - 2016-08-04 01:04 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Odd_Sheep_Ltd
2016-08-04 00:32 - 2016-08-04 00:32 - 00000000 ____H C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2016-08-04 00:32 - 2016-08-04 00:32 - 00000000 ____D C:\ProgramData\Samsung
2016-08-04 00:31 - 2016-08-27 12:29 - 00002036 _____ C:\Users\Public\Desktop\Samsung Kies 3.lnk
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Users\Public\Documents\NativeFus_Log
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Users\Kiwi\Documents\samsung
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Samsung
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung
2016-08-04 00:31 - 2016-08-04 00:31 - 00000000 ____D C:\Program Files (x86)\Samsung
2016-08-04 00:31 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll
2016-08-03 19:51 - 2016-08-27 12:29 - 00001875 _____ C:\Users\Public\Desktop\Dragon Eye.lnk
2016-08-03 19:51 - 2016-08-27 12:29 - 00001188 _____ C:\Users\Public\Desktop\MSI Gaming APP.lnk
2016-08-03 19:51 - 2016-08-03 19:51 - 00003132 _____ C:\Windows\System32\Tasks\MSIOSDx86_Host
2016-08-03 19:51 - 2016-08-03 19:51 - 00003132 _____ C:\Windows\System32\Tasks\MSIOSDx64_Host
2016-08-03 19:51 - 2016-08-03 19:51 - 00003058 _____ C:\Windows\System32\Tasks\MSISW_Host
2016-08-03 19:51 - 2016-08-03 19:51 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MSI
2016-08-03 19:51 - 2016-08-03 19:51 - 00000000 ____D C:\Program Files\MSI
2016-08-03 19:51 - 2016-08-03 19:51 - 00000000 ____D C:\Program Files (x86)\Intel
2016-08-03 19:51 - 2015-08-18 09:51 - 01692840 _____ (MSI) C:\Windows\SysWOW64\muachost.exe
2016-08-03 19:50 - 2016-08-29 14:47 - 00000000 ____D C:\MSI
2016-08-03 19:50 - 2016-08-03 19:51 - 00000000 ____D C:\Program Files (x86)\MSI
2016-08-03 19:50 - 2015-07-27 01:37 - 00041760 _____ (FINTEK Corp.) C:\Windows\system32\Drivers\I2cHkBurn.sys
2016-08-03 19:50 - 2015-07-27 01:37 - 00031520 _____ (TODO: <公司名稱>) C:\Windows\system32\FintekIcon1.dll
2016-08-03 17:54 - 2016-08-27 12:29 - 00001282 _____ C:\Users\Kiwi\Desktop\MM Server Picker.lnk
2016-08-03 17:54 - 2016-08-03 17:54 - 00000000 ____D C:\Program Files (x86)\Matchmaking Server Picker
2016-08-03 13:24 - 2016-08-30 12:49 - 00000000 ____D C:\Users\Kiwi\Documents\Assassin's Creed Unity
2016-08-03 05:12 - 2016-08-27 02:52 - 00000000 ____D C:\Users\Kiwi\Desktop\Icons
2016-08-03 05:06 - 2016-08-03 05:06 - 00000233 _____ C:\Users\Kiwi\Desktop\Assassin’s Creed Unity.url
2016-08-03 05:04 - 2016-08-29 11:03 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Ubisoft Game Launcher
2016-08-03 05:04 - 2016-08-27 12:29 - 00001274 _____ C:\Users\Kiwi\Desktop\Uplay.lnk
2016-08-03 05:04 - 2016-08-03 05:04 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ubisoft
2016-08-03 05:04 - 2016-08-03 05:04 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2016-08-03 00:50 - 2016-08-03 00:54 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\NVIDIA
2016-08-03 00:50 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Sony
2016-08-03 00:50 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Publish Providers
2016-08-03 00:50 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\LocalLow\Apple Computer
2016-08-03 00:48 - 2016-08-27 12:29 - 00001105 _____ C:\Users\Public\Desktop\Vegas Pro 13.0 (64-bit).lnk
2016-08-03 00:48 - 2016-08-03 00:50 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\ProgramData\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\Program Files\Sony
2016-08-03 00:48 - 2016-08-03 00:48 - 00000000 ____D C:\Program Files (x86)\Sony
2016-08-03 00:25 - 2016-08-29 21:26 - 00053248 ___SH C:\Users\Kiwi\Downloads\Thumbs.db
2016-08-02 23:58 - 2016-08-27 12:41 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Audacity
2016-08-02 23:58 - 2016-08-27 12:29 - 00001088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
2016-08-02 23:58 - 2016-08-27 12:29 - 00001070 _____ C:\Users\Public\Desktop\Audacity.lnk
2016-08-02 23:58 - 2016-08-02 23:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Audacity
2016-08-02 23:57 - 2016-08-02 23:58 - 00000000 ____D C:\Program Files (x86)\Audacity
2016-08-02 20:10 - 2016-08-02 20:11 - 00000000 ____D C:\Users\Kiwi\Documents\RCT3
2016-08-02 20:10 - 2016-08-02 20:10 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Atari
2016-08-02 17:07 - 2016-08-02 17:07 - 00076152 _____ C:\Windows\system32\PnkBstrA.exe
2016-08-02 16:57 - 2016-08-02 16:57 - 00000000 ____D C:\Users\Kiwi\AppData\Local\PunkBuster
2016-08-02 13:22 - 2015-10-19 19:13 - 03894632 _____ C:\Windows\SysWOW64\pbsvc.exe
2016-08-02 13:12 - 2016-08-02 13:13 - 00000000 ____D C:\Users\Kiwi\Documents\Battlefield 4
2016-08-02 08:18 - 2016-08-27 12:29 - 00001303 _____ C:\Users\Public\Desktop\Battlefield 4.lnk
2016-08-02 08:18 - 2016-08-03 05:21 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2016-08-02 08:18 - 2016-08-02 08:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battlefield 4
2016-08-02 06:12 - 2016-08-27 17:47 - 00226168 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2016-08-02 06:12 - 2016-08-27 17:47 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0
2016-08-02 06:12 - 2016-08-02 16:52 - 00076888 _____ C:\Windows\SysWOW64\PnkBstrA.exe
2016-08-01 02:03 - 2016-08-27 12:29 - 00001886 _____ C:\Users\Kiwi\Desktop\Google Drive.lnk
2016-08-01 02:03 - 2016-08-27 02:52 - 00000000 ___RD C:\Users\Kiwi\Google Drive
2016-08-01 02:02 - 2016-08-27 12:29 - 00002109 _____ C:\Users\Public\Desktop\Google Slides.lnk
2016-08-01 02:02 - 2016-08-27 12:29 - 00002107 _____ C:\Users\Public\Desktop\Google Sheets.lnk
2016-08-01 02:02 - 2016-08-27 12:29 - 00002097 _____ C:\Users\Public\Desktop\Google Docs.lnk
2016-08-01 02:02 - 2016-08-25 03:41 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2016-08-01 02:01 - 2016-08-28 16:17 - 00000000 ____D C:\Program Files (x86)\Google
2016-08-01 02:01 - 2016-08-01 02:02 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Google
2016-08-01 01:54 - 2016-08-29 13:05 - 00124416 ___SH C:\Users\Kiwi\Desktop\Thumbs.db
2016-08-01 00:06 - 2016-08-30 14:20 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Telegram Desktop
2016-08-01 00:06 - 2016-08-27 12:29 - 00001165 _____ C:\Users\Kiwi\Desktop\Telegram.lnk
2016-08-01 00:06 - 2016-08-01 00:06 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop
2016-07-31 23:58 - 2016-07-31 23:58 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Thunderbird
2016-07-31 23:58 - 2016-07-31 23:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Thunderbird
2016-07-31 23:57 - 2016-08-27 12:29 - 00001278 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2016-07-31 23:57 - 2016-08-27 12:29 - 00001260 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2016-07-31 23:57 - 2016-07-31 23:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2016-07-31 23:38 - 2016-08-29 21:54 - 00000000 ____D C:\ProgramData\boost_interprocess
2016-07-31 23:23 - 2016-07-31 23:23 - 00003634 _____ C:\Windows\System32\Tasks\AdobeAAMUpdater-1.0-DESKTOP-UBKH50B-Kiwi☺
2016-07-31 23:08 - 2016-08-27 12:29 - 00001207 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Media Encoder CC 2015.lnk
2016-07-31 21:47 - 2016-08-28 16:21 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2016-07-31 21:47 - 2016-08-27 12:29 - 00001112 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 11.lnk
2016-07-31 21:47 - 2016-08-27 12:29 - 00001094 _____ C:\Users\Public\Desktop\TeamViewer 11.lnk
2016-07-31 21:47 - 2016-07-31 21:47 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\TeamViewer
2016-07-31 21:46 - 2016-07-31 21:46 - 09798984 _____ (TeamViewer GmbH) C:\TeamViewer_Setup_de.exe
2016-07-31 20:02 - 2016-07-31 20:02 - 10001388 _____ (Michael Friese) C:\sinusbot-win-0.9.8.6.exe
2016-07-31 19:45 - 2016-08-03 05:19 - 00000000 ____D C:\ProgramData\Wondershare
2016-07-31 19:45 - 2016-08-03 05:19 - 00000000 ____D C:\Program Files (x86)\Wondershare
2016-07-31 19:45 - 2016-07-31 19:47 - 00000000 ____D C:\ProgramData\Wondershare Video Converter Ultimate
2016-07-31 19:45 - 2016-07-31 19:45 - 00000000 ____D C:\Users\Kiwi\Documents\Wondershare Video Converter Ultimate
2016-07-31 19:45 - 2016-07-31 19:45 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Wondershare Video Converter Ultimate
2016-07-31 19:45 - 2016-05-27 09:41 - 00000232 _____ C:\Windows\SysWOW64\dllhost.exe.config
2016-07-31 19:45 - 2015-02-27 14:38 - 00721263 _____ () C:\Windows\SysWOW64\WSCM64.dll
2016-07-31 19:44 - 2016-07-31 19:44 - 00000000 ____D C:\Users\Public\Documents\Wondershare
2016-07-31 13:58 - 2016-07-31 13:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Apple Computer
2016-07-31 13:25 - 2016-07-31 17:47 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Apple Computer
2016-07-31 13:21 - 2016-07-31 13:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ReelSmart Motion Blur 4, After Effects-compatible plugin set
2016-07-31 13:21 - 2008-01-30 18:36 - 00090112 _____ (MindVision Software) C:\Windows\unvise32.exe
2016-07-31 13:20 - 2016-07-31 13:20 - 00000000 ____D C:\Program Files\RSMB4AEManual
2016-07-31 13:19 - 2016-07-31 13:19 - 00000000 ____D C:\Program Files (x86)\REVisionEffects
2016-07-31 13:15 - 2016-08-06 20:26 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2016-07-31 13:01 - 2016-07-31 13:01 - 00000000 ____D C:\Program Files (x86)\Red Giant Link
2016-07-31 13:01 - 2016-07-31 13:01 - 00000000 ____D C:\Program Files (x86)\LooksBuilder
2016-07-31 13:01 - 2014-07-28 14:10 - 19939328 _____ (Red Giant LLC) C:\Windows\system32\MBLooksUI_x64.dll
2016-07-31 12:55 - 2016-07-31 12:55 - 00000000 ____D C:\ProgramData\Reprise
2016-07-31 12:54 - 2016-07-31 13:01 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Red Giant
2016-07-31 12:54 - 2016-07-31 13:01 - 00000000 ____D C:\Program Files (x86)\Red Giant
2016-07-31 12:54 - 2016-07-31 12:54 - 00000000 ____D C:\ProgramData\RedGiant
2016-07-31 12:54 - 2016-07-31 12:54 - 00000000 ____D C:\ProgramData\Red Giant
2016-07-31 12:50 - 2016-07-31 13:21 - 00000000 ____D C:\ProgramData\GenArts
2016-07-31 12:50 - 2016-07-31 12:50 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GenArts Sapphire AE
2016-07-31 12:50 - 2016-07-31 12:50 - 00000000 ____D C:\Program Files\GenArts
2016-07-31 12:50 - 2013-06-30 22:28 - 00000000 _____ C:\Windows\MSUTIL.INI
2016-07-31 12:33 - 2016-07-31 12:33 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Launchpad
2016-07-31 12:24 - 2016-08-27 12:29 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Apple
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\ProgramData\Apple Computer
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\ProgramData\Apple
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\Program Files (x86)\QuickTime
2016-07-31 12:24 - 2016-07-31 12:24 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2016-07-31 12:20 - 2016-08-06 20:09 - 00000000 ____D C:\Users\Kiwi\Documents\Adobe
2016-07-31 12:18 - 2016-07-31 12:18 - 00000000 ____D C:\Users\Public\Documents\AdobeInstalledCodecs
2016-07-31 12:15 - 2016-08-27 12:29 - 00001315 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe After Effects CC 2015.lnk
2016-07-31 12:15 - 2016-08-06 20:09 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe
2016-07-31 12:14 - 2016-08-27 12:29 - 00001421 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Character Animator (Preview).lnk
2016-07-31 12:14 - 2016-08-06 20:08 - 00000000 ____D C:\Program Files\Adobe
2016-07-31 12:14 - 2016-07-31 23:08 - 00000000 ____D C:\Program Files\Common Files\Adobe
2016-07-31 12:13 - 2016-08-27 12:29 - 00001615 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Application Manager.lnk
2016-07-31 12:13 - 2016-08-27 12:29 - 00001597 _____ C:\Users\Public\Desktop\Adobe Application Manager.lnk
2016-07-31 12:13 - 2016-08-01 02:00 - 00000000 ____D C:\ProgramData\Adobe
2016-07-31 12:13 - 2016-07-31 12:13 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Macromedia
2016-07-31 12:12 - 2016-08-30 12:46 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Adobe
2016-07-31 02:36 - 2016-08-28 16:28 - 00000000 ____D C:\Users\Kiwi\Desktop\Intros
2016-07-31 01:53 - 2016-07-31 14:15 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\MAXON
2016-07-31 01:53 - 2016-07-31 01:53 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cinema 4D R12
2016-07-31 01:52 - 2016-07-31 01:53 - 00000000 ____D C:\Program Files (x86)\Cinema 4D R12
2016-07-31 01:01 - 2016-08-27 03:30 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\qBittorrent
2016-07-31 01:01 - 2016-07-31 01:01 - 00000000 ____D C:\Users\Kiwi\AppData\Local\qBittorrent
2016-07-31 01:00 - 2016-08-27 12:29 - 00001106 _____ C:\Users\Public\Desktop\qBittorrent.lnk
2016-07-31 01:00 - 2016-07-31 01:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\qBittorrent
2016-07-31 01:00 - 2016-07-31 01:00 - 00000000 ____D C:\Program Files (x86)\qBittorrent

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-08-30 16:24 - 2016-07-27 22:25 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\TS3Client
2016-08-30 16:24 - 2016-07-27 12:34 - 00002144 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2016-08-30 16:24 - 2016-07-27 12:34 - 00001266 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2016-08-30 16:23 - 2016-07-27 12:35 - 00000000 ____D C:\Program Files (x86)\Steam
2016-08-30 16:20 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi
2016-08-30 16:00 - 2016-07-27 11:56 - 01799166 _____ C:\Windows\system32\PerfStringBackup.INI
2016-08-30 16:00 - 2016-04-27 07:13 - 00775524 _____ C:\Windows\system32\perfh007.dat
2016-08-30 16:00 - 2016-04-27 07:13 - 00155338 _____ C:\Windows\system32\perfc007.dat
2016-08-30 16:00 - 2015-10-30 09:21 - 00000000 ____D C:\Windows\INF
2016-08-30 15:54 - 2016-07-27 12:10 - 00000000 ____D C:\ProgramData\NVIDIA
2016-08-30 15:54 - 2016-04-27 07:48 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-08-30 13:47 - 2016-07-27 21:41 - 00000000 ____D C:\ProgramData\Origin
2016-08-29 14:28 - 2016-07-27 12:58 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Arma 3
2016-08-29 13:11 - 2016-07-27 21:58 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2016-08-29 11:19 - 2015-10-30 08:28 - 00524288 ___SH C:\Windows\system32\config\BBI
2016-08-29 10:36 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\AppReadiness
2016-08-28 23:47 - 2016-07-28 21:46 - 00403192 _____ C:\Windows\system32\Drivers\EasyAntiCheat.sys
2016-08-28 20:19 - 2016-04-26 22:44 - 04962520 _____ C:\Windows\system32\FNTCACHE.DAT
2016-08-28 17:17 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\Help
2016-08-28 16:24 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\Packages
2016-08-28 16:24 - 2015-10-30 09:24 - 00000000 ___HD C:\Program Files\WindowsApps
2016-08-28 16:20 - 2016-07-27 12:50 - 00000000 ____D C:\Windows\Panther
2016-08-28 16:20 - 2016-07-27 12:13 - 00000000 ____D C:\Users\Kiwi\AppData\Local\CrashDumps
2016-08-28 03:24 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\PurchaseDialog
2016-08-27 12:29 - 2016-07-30 21:16 - 00001340 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\OpenIV.lnk
2016-08-27 12:29 - 2016-07-30 21:16 - 00001338 _____ C:\Users\Kiwi\Desktop\OpenIV.lnk
2016-08-27 12:29 - 2016-07-27 22:25 - 00001046 _____ C:\Users\Public\Desktop\TeamSpeak 3 Client.lnk
2016-08-27 12:29 - 2016-07-27 22:25 - 00001014 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSpeak 3 Client.lnk
2016-08-27 12:29 - 2016-07-27 21:41 - 00001042 _____ C:\Users\Public\Desktop\Origin.lnk
2016-08-27 12:29 - 2016-07-27 14:02 - 00001444 _____ C:\Users\Public\Desktop\GeForce Experience.lnk
2016-08-27 12:29 - 2016-07-27 12:35 - 00001026 _____ C:\Users\Public\Desktop\Steam.lnk
2016-08-27 12:29 - 2016-07-27 11:55 - 00002516 _____ C:\Users\Kiwi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk
2016-08-27 11:24 - 2015-10-30 09:11 - 00000000 ____D C:\Windows\CbsTemp
2016-08-27 04:09 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\LiveKernelReports
2016-08-27 03:42 - 2016-07-27 13:59 - 00000000 ____D C:\Windows\AutoKMS
2016-08-27 03:26 - 2016-07-27 12:09 - 00000000 ____D C:\ProgramData\Package Cache
2016-08-27 02:52 - 2016-07-27 12:34 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2016-08-27 02:49 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\NDF
2016-08-26 02:47 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\rescache
2016-08-25 17:33 - 2016-04-27 07:55 - 00000000 __RHD C:\Users\Public\AccountPictures
2016-08-25 17:26 - 2016-04-27 07:34 - 00000000 ____D C:\Program Files\Windows Journal
2016-08-25 17:26 - 2015-10-30 09:24 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2016-08-25 17:26 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\appraiser
2016-08-25 09:36 - 2016-07-27 22:09 - 00000000 ____D C:\Windows\system32\MRT
2016-08-25 09:36 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\SecureBootUpdates
2016-08-25 09:32 - 2016-07-27 22:09 - 147640136 ____C (Microsoft Corporation) C:\Windows\system32\MRT.exe
2016-08-25 03:36 - 2016-07-27 12:36 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2016-08-25 03:35 - 2016-07-27 12:36 - 00000000 ____D C:\ProgramData\EPSON
2016-08-25 03:27 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\system32\FxsTmp
2016-08-08 18:03 - 2016-07-27 12:58 - 00000000 ____D C:\Users\Kiwi\Documents\Arma 3
2016-08-07 22:52 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi\AppData\Local\VirtualStore
2016-08-06 20:26 - 2016-07-27 12:11 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2016-08-06 20:26 - 2016-07-27 12:09 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2016-08-06 20:10 - 2016-07-27 11:53 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Adobe
2016-08-06 17:31 - 2016-07-28 01:57 - 00000213 _____ C:\Users\Kiwi\Desktop\RollerCoaster Tycoon 3 Platinum!.url
2016-08-06 17:31 - 2016-07-27 21:58 - 00000219 _____ C:\Users\Kiwi\Desktop\Grand Theft Auto V.url
2016-08-02 16:49 - 2016-07-27 14:03 - 00000000 ____D C:\Users\Kiwi\AppData\Local\NVIDIA Corporation
2016-08-02 14:07 - 2016-07-27 12:10 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2016-08-02 13:12 - 2016-07-27 21:41 - 00000000 ____D C:\ProgramData\Electronic Arts
2016-08-02 01:42 - 2016-07-27 21:57 - 00000000 ____D C:\Users\Kiwi\AppData\Roaming\Origin
2016-08-01 17:49 - 2016-07-27 13:43 - 00000000 ____D C:\Users\Kiwi\Documents\Arma 3 - Other Profiles
2016-08-01 17:41 - 2016-07-28 00:28 - 00000000 ____D C:\Users\Kiwi\Documents\TS Server Icons
2016-08-01 16:07 - 2016-07-27 13:58 - 00000000 ____D C:\ProgramData\Microsoft Toolkit
2016-07-31 04:55 - 2015-10-30 09:24 - 00000000 ____D C:\Windows\appcompat

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2016-08-28 13:36 - 2016-08-28 13:36 - 0000003 _____ () C:\Users\Kiwi\AppData\Local\updater.log
2016-08-28 13:36 - 2016-08-28 13:36 - 0000424 _____ () C:\Users\Kiwi\AppData\Local\UserProducts.xml

Einige Dateien in TEMP:
====================
C:\Users\Kiwi\AppData\Local\Temp\libeay32.dll
C:\Users\Kiwi\AppData\Local\Temp\msvcr120.dll
C:\Users\Kiwi\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-08-28 20:58

==================== Ende von FRST.txt ============================

cosinus 30.08.2016 15:30
Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

KiwiLink 30.08.2016 15:44
Mbar sagt: "Es wurden keine Malware Programme gefunden."

cosinus 30.08.2016 21:39
Einfach nur die Logs posten, keine Nacherzählungen o.ä.

KiwiLink 01.09.2016 11:25
Okey, hier der system_log:
Code:
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.3.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 10.0.9200 Windows 10 x64

Account is Administrative

Internet Explorer version: 11.545.10586.0

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.500000 GHz
Memory total: 17126174720, free: 13255512064

Downloaded database version: v2016.08.30.09
Downloaded database version: v2016.08.15.01
Downloaded database version: v2016.08.15.02
Initializing...
======================
------------ Kernel report ------------
    08/30/2016 16:33:56
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\??\C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\ucguard.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_912dfdedc3d2f520\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\system32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\TeeDriverW8x64.sys
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\e22w10x64.sys
\SystemRoot\System32\drivers\serial.sys
\SystemRoot\System32\drivers\serenum.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\acpipagr.sys
\SystemRoot\System32\drivers\UEFI.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\system32\drivers\I2cHkBurn.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\system32\DRIVERS\HdAudio.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\rzendpt.sys
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\rzudd.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\System32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\??\C:\Windows\system32\drivers\KuaiZipDrive.sys
\SystemRoot\system32\drivers\mmcss.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\peauth.sys
\??\C:\Windows\system32\drivers\rzpmgrk.sys
\??\C:\Windows\system32\drivers\rzpnk.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\drivers\rassstp.sys
\SystemRoot\System32\DRIVERS\NDProxy.sys
\SystemRoot\System32\drivers\AgileVpn.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\drivers\rasl2tp.sys
\SystemRoot\System32\drivers\raspptp.sys
\SystemRoot\System32\drivers\raspppoe.sys
\SystemRoot\System32\DRIVERS\ndistapi.sys
\SystemRoot\System32\drivers\ndiswan.sys
\SystemRoot\System32\drivers\tunnel.sys
\SystemRoot\system32\DRIVERS\WSDScan.sys
\SystemRoot\System32\drivers\WSDPrint.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
\??\C:\Windows\system32\drivers\mwac.sys
\SystemRoot\System32\drivers\rdpvideominiport.sys
\SystemRoot\System32\cdd.dll
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
----------- End -----------
Done!

Scan started
Database versions:
  main:    v2016.08.30.09
  rootkit: v2016.08.15.01

<<<2>>>
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffe001f497e060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe001f497eaa0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe001f497e060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffe001f47a8630, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe001f47a9e40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe001f47aa060, DeviceName: \Device\00000035\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffe001f497f060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe001f4869890, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe001f497f060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffe001f47a9c40, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe001f47abd10, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe001f47ab060, DeviceName: \Device\00000034\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: 14785E8

GPT Protective MBR Partition information:

    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1  Numsec = 4294967295

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

GPT Partition information:

    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 2967852314
    GPT Header CurrentLba = 1 BackupLba 1953525167
    GPT Header FirstUsableLba 34  LastUsableLba 1953525134
    GPT Header Guid ee9261bd-3b54-4624-94e0-6e98e9768d7
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128

    Backup GPT header Signature 4546492050415254
    Backup GPT header Revision 65536 Size 92 CRC 2967852314
    Backup GPT header CurrentLba = 1953525167 BackupLba 1
    Backup GPT header FirstUsableLba 34  LastUsableLba 1953525134
    Backup GPT header Guid ee9261bd-3b54-4624-94e0-6e98e9768d7
    Backup GPT header Contains 128 partition entries starting at LBA 1953525135
    Backup GPT header Partition entry size = 128

    Partition 0 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID 58863854-1d66-498d-a87e-386d5b964b9a
    FirstLBA 2048  Last LBA 1953523711
    Attributes 0
    Partition Name                Basic data partition

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Drive 1
This is a System drive
Scanning MBR on drive 1...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: 0

GPT Protective MBR Partition information:

    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1  Numsec = 4294967295

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

GPT Partition information:

    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 3799761769
    GPT Header CurrentLba = 1 BackupLba 976773167
    GPT Header FirstUsableLba 34  LastUsableLba 976773134
    GPT Header Guid 9beb2600-b781-4920-9e89-7defc139acd
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128

    Backup GPT header Signature 4546492050415254
    Backup GPT header Revision 65536 Size 92 CRC 3799761769
    Backup GPT header CurrentLba = 976773167 BackupLba 1
    Backup GPT header FirstUsableLba 34  LastUsableLba 976773134
    Backup GPT header Guid 9beb2600-b781-4920-9e89-7defc139acd
    Backup GPT header Contains 128 partition entries starting at LBA 976773135
    Backup GPT header Partition entry size = 128

    Partition 0 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID ccc72a44-410-43cd-8384-978629bd966
    FirstLBA 2048  Last LBA 923647
    Attributes 1
    Partition Name                Basic data partition

    Partition 1 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
    Partition ID 47f8b684-d2f5-47b5-99a2-acf030b1f469
    FirstLBA 923648  Last LBA 1128447
    Attributes 0
    Partition Name                EFI system partition

    GPT Partition 1 is bootable
    Partition 2 Type e3c9e316-b5c-4db8-817d-f92df0215ae
    Partition ID 42cd4c11-3a59-41f9-b622-5635a564a05c
    FirstLBA 1128448  Last LBA 1161215
    Attributes 0
    Partition Name        Microsoft reserved partition

    Partition 3 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID 6ca84b4d-4662-49b3-a626-84fb61692ed8
    FirstLBA 1161216  Last LBA 976773119
    Attributes 0
    Partition Name                Basic data partition

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Done!
File "C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat" is sparse (flags = 32768)
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.09.3.1001

(c) Malwarebytes Corporation 2011-2012

OS version: 10.0.9200 Windows 10 x64

Account is Administrative

Internet Explorer version: 11.545.10586.0

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.500000 GHz
Memory total: 17126174720, free: 13474906112

Downloaded database version: v2016.09.01.04
Downloaded database version: v2016.08.15.01
Downloaded database version: v2016.08.31.01
=======================================
------------ Kernel report ------------
    09/01/2016 12:12:18
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\werkernel.sys
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\System32\drivers\cmimcext.sys
\SystemRoot\System32\drivers\ntosext.sys
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\System32\drivers\FLTMGR.SYS
\SystemRoot\System32\drivers\ksecdd.sys
\SystemRoot\System32\drivers\clipsp.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\WindowsTrustedRT.sys
\SystemRoot\System32\drivers\WindowsTrustedRTProxy.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\system32\drivers\CEA.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Wof.sys
\SystemRoot\System32\Drivers\NTFS.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\drivers\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\system32\drivers\filecrypt.sys
\SystemRoot\system32\drivers\tbs.sys
\??\C:\PROGRAM FILES\EMSISOFT ANTI-MALWARE\epp.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\ucguard.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\drivers\vwififlt.sys
\SystemRoot\System32\drivers\pacer.sys
\SystemRoot\system32\drivers\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\gpuenergydrv.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\ahcache.sys
\SystemRoot\System32\DriverStore\FileRepository\compositebus.inf_amd64_912dfdedc3d2f520\CompositeBus.sys
\SystemRoot\System32\drivers\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\portcls.sys
\SystemRoot\System32\drivers\drmk.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\system32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\TeeDriverW8x64.sys
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\e22w10x64.sys
\SystemRoot\System32\drivers\serial.sys
\SystemRoot\System32\drivers\serenum.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\acpipagr.sys
\SystemRoot\System32\drivers\UEFI.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\System32\drivers\NdisVirtualBus.sys
\SystemRoot\system32\drivers\I2cHkBurn.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\system32\DRIVERS\HdAudio.sys
\SystemRoot\System32\drivers\USBSTOR.SYS
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\rzendpt.sys
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\rzudd.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\drivers\wachidrouter.sys
\SystemRoot\System32\drivers\hidkmdf.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\System32\drivers\wacomrouterfilter.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\win32kfull.sys
\SystemRoot\System32\win32kbase.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\drivers\dxgmms2.sys
\SystemRoot\System32\drivers\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\storqosflt.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\System32\drivers\WpdUpFltr.sys
\SystemRoot\system32\drivers\lltdio.sys
\SystemRoot\system32\drivers\rspndr.sys
\SystemRoot\system32\drivers\mslldp.sys
\SystemRoot\System32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\ndisuio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\??\C:\Windows\system32\drivers\KuaiZipDrive.sys
\SystemRoot\system32\drivers\mmcss.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\??\C:\Windows\system32\drivers\rzpmgrk.sys
\??\C:\Windows\system32\drivers\rzpnk.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\drivers\rassstp.sys
\SystemRoot\System32\DRIVERS\NDProxy.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\drivers\AgileVpn.sys
\SystemRoot\System32\drivers\rasl2tp.sys
\SystemRoot\System32\drivers\raspptp.sys
\SystemRoot\System32\drivers\raspppoe.sys
\SystemRoot\System32\DRIVERS\ndistapi.sys
\SystemRoot\System32\drivers\ndiswan.sys
\SystemRoot\System32\drivers\tunnel.sys
\SystemRoot\system32\DRIVERS\WSDScan.sys
\SystemRoot\System32\drivers\WSDPrint.sys
\??\C:\Windows\system32\drivers\mwac.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\??\C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
----------- End -----------
Done!

Scan started
Database versions:
  main:    v2016.09.01.04
  rootkit: v2016.08.15.01

<<<2>>>
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xffffe00095d8d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe00095d8db10, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe00095d8d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
DevicePointer: 0xffffe00094541670, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe00095baa040, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe00095ba6060, DeviceName: \Device\00000035\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffe00095d8c060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe00095d8cb10, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe00095d8c060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffe00095ba99c0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe00095ba6cb0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffe00095ba8060, DeviceName: \Device\00000034\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: 14785E8

GPT Protective MBR Partition information:

    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1  Numsec = 4294967295

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

GPT Partition information:

    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 2967852314
    GPT Header CurrentLba = 1 BackupLba 1953525167
    GPT Header FirstUsableLba 34  LastUsableLba 1953525134
    GPT Header Guid ee9261bd-3b54-4624-94e0-6e98e9768d7
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128

    Backup GPT header Signature 4546492050415254
    Backup GPT header Revision 65536 Size 92 CRC 2967852314
    Backup GPT header CurrentLba = 1953525167 BackupLba 1
    Backup GPT header FirstUsableLba 34  LastUsableLba 1953525134
    Backup GPT header Guid ee9261bd-3b54-4624-94e0-6e98e9768d7
    Backup GPT header Contains 128 partition entries starting at LBA 1953525135
    Backup GPT header Partition entry size = 128

    Partition 0 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID 58863854-1d66-498d-a87e-386d5b964b9a
    FirstLBA 2048  Last LBA 1953523711
    Attributes 0
    Partition Name                Basic data partition

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Drive 1
This is a System drive
Scanning MBR on drive 1...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: 0

GPT Protective MBR Partition information:

    Partition 0 type is EFI-GPT (0xee)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1  Numsec = 4294967295

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

GPT Partition information:

    GPT Header Signature 4546492050415254
    GPT Header Revision 65536 Size 92 CRC 3799761769
    GPT Header CurrentLba = 1 BackupLba 976773167
    GPT Header FirstUsableLba 34  LastUsableLba 976773134
    GPT Header Guid 9beb2600-b781-4920-9e89-7defc139acd
    GPT Header Contains 128 partition entries starting at LBA 2
    GPT Header Partition entry size = 128

    Backup GPT header Signature 4546492050415254
    Backup GPT header Revision 65536 Size 92 CRC 3799761769
    Backup GPT header CurrentLba = 976773167 BackupLba 1
    Backup GPT header FirstUsableLba 34  LastUsableLba 976773134
    Backup GPT header Guid 9beb2600-b781-4920-9e89-7defc139acd
    Backup GPT header Contains 128 partition entries starting at LBA 976773135
    Backup GPT header Partition entry size = 128

    Partition 0 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
    Partition ID ccc72a44-410-43cd-8384-978629bd966
    FirstLBA 2048  Last LBA 923647
    Attributes 1
    Partition Name                Basic data partition

    Partition 1 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
    Partition ID 47f8b684-d2f5-47b5-99a2-acf030b1f469
    FirstLBA 923648  Last LBA 1128447
    Attributes 0
    Partition Name                EFI system partition

    GPT Partition 1 is bootable
    Partition 2 Type e3c9e316-b5c-4db8-817d-f92df0215ae
    Partition ID 42cd4c11-3a59-41f9-b622-5635a564a05c
    FirstLBA 1128448  Last LBA 1161215
    Attributes 0
    Partition Name        Microsoft reserved partition

    Partition 3 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
    Partition ID 6ca84b4d-4662-49b3-a626-84fb61692ed8
    FirstLBA 1161216  Last LBA 976773119
    Attributes 0
    Partition Name                Basic data partition

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xffffe00096db6610, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xffffe00096db5040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffe00096db6610, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\
DevicePointer: 0xffffe00096db92b0, DeviceName: \Device\00000042\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 0

Partition information:

    Partition 0 type is Other (0xc)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 32  Numsec = 62521312
    Partition is not bootable
    Partition file system is FAT32

    Partition 1 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
    Partition is not bootable

Disk Size: 32010928128 bytes
Sector size: 512 bytes

Done!
File "C:\Windows\System32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat" is sparse (flags = 32768)
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-2-0-32-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removal finished
Ausserdem gibt es neue Berechetigungsgruppen, die ich nie festgelegt habe. Ich habe auch keiner Anwendung Administratorrechte gewährt, die ich nicht kenne.
Hier einer der neuen Gruppen: prntscr.com/ccusce

cosinus 01.09.2016 12:20
Anleitung richtig lesen. Richtiges Log posten.

KiwiLink 01.09.2016 13:10
Tut mir leid, hier die richtige Datei:
mbar-log-2016-09-01 (12-12-22).txt
Code:
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2016.09.01.04
  rootkit: v2016.08.15.01

Windows 10 x64 NTFS
Internet Explorer 11.545.10586.0
Kiwi☺ :: KIWINATOR [administrator]

01.09.2016 12:12:22
mbar-log-2016-09-01 (12-12-22).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 321745
Time elapsed: 8 minute(s), 24 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus 01.09.2016 14:02
Adware/Junkware/Toolbars entfernen

Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!
Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren!

1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



Alle Zeitangaben in WEZ +1. Es ist jetzt 09:21 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131