| |
| |||||||
Log-Analyse und Auswertung: Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel RamWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
03.03.2014, 18:44
| #1 |
 |  Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Hallo, ich wollte mal meinen Laptop ein bisschen aufräumen und auch mal nach Viren oder Trojanern schauen. Mir ist aufgefallen das der Svchost.exe Prozess viel RAM verbraucht ca. 200.000K. Die svchost wird vom Dienst wlansvc gestartet(glaub ich). Den mbam log habe ich ohne defogger gemacht alles andere nach Anleitung. defogger_disable.log: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:13 on 03/03/2014 (Jonas)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-03-2014 Ran by Jonas (administrator) on JONAS-PC on 03-03-2014 18:13:47 Running from C:\Users\Jonas\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Locktime Software) C:\Program Files\NetLimiter 3\nlsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Atheros) C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Locktime Software) C:\Program Files\NetLimiter 3\NLClientApp.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation) HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-509002210-509805973-1439757681-1000\...\Run: [NetLimiter] - C:\Program Files\NetLimiter 3\NLClientApp.exe [2915968 2013-10-10] (Locktime Software) HKU\S-1-5-21-509002210-509805973-1439757681-1000\...\MountPoints2: {137357d9-ea1f-11e2-9ec8-e86f201a21ea} - G:\setup.exe AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174296 2014-02-08] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148528 2014-02-08] (NVIDIA Corporation) ==================== Internet (Whitelisted) ==================== ProxyServer: 74.208.123.225:3128 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6109E71583CECE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope value is missing. BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: No Name - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jonas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: DownloadHelper - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-11-25] FF Extension: NoScript - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-07-21] FF Extension: Adblock Plus - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-07-21] FF Extension: Greasemonkey - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-01-08] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR RestoreOnStartup: "hxxp://www.google.com/" CHR DefaultSearchKeyword: https://www.google.de/ CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll () CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) CHR Plugin: (Java Deployment Toolkit 7.0.450.18) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Java(TM) Platform SE 7 U45) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (QUAKE LIVE) - C:\ProgramData\id Software\QuakeLive\npquakezero.dll No File CHR Plugin: (Unity Player) - C:\Users\Jonas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll No File CHR Extension: (ProxTube) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-27] CHR Extension: (Google Drive) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-30] CHR Extension: (YouTube) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-30] CHR Extension: (Google-Suche) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-30] CHR Extension: (Give Up) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\diippoclinjdbklinhchgedilfncehbi [2013-07-22] CHR Extension: (AdBlock) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-10-30] CHR Extension: (ProxMate - Proxy on steroids!) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgjpnmnpjmabddgmjdiaggacbololbjm [2013-05-30] CHR Extension: (convert2mp3.net Online Video Converter) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmhoigapbeidamhadadmpbhpaodamjce [2014-02-12] CHR Extension: (Google Wallet) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07] CHR Extension: (Google Mail) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-30] ==================== Services (Whitelisted) ================= R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 nlsvc; C:\Program Files\NetLimiter 3\nlsvc.exe [1851008 2013-10-10] (Locktime Software) S4 nTuneService; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe [278336 2011-09-19] (NVIDIA) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation) R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe [57344 2011-08-10] (Atheros) ==================== Drivers (Whitelisted) ==================== R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-07-01] (AVM Berlin) R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R1 nltdi; C:\Program Files\NetLimiter 3\nltdi.sys [87472 2013-06-12] (Locktime Software) R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.) R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) S3 SjtWinIo; C:\Windows\System32\DRIVERS\SjtWinIo.sys [9216 2013-06-13] (SpeedJet Technology INC.) S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.) S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-09-06] (Oracle Corporation) R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Downloads\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00000472 _____ () C:\Users\Jonas\Desktop\defogger_disable.log 2014-03-03 18:13 - 2014-03-03 18:13 - 00000000 _____ () C:\Users\Jonas\defogger_reenable 2014-03-03 18:10 - 2014-03-03 18:13 - 00015384 _____ () C:\Users\Jonas\Desktop\FRST.txt 2014-03-03 18:09 - 2014-03-03 18:13 - 00000000 ____D () C:\FRST 2014-03-03 16:09 - 2014-03-03 16:10 - 02156544 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe 2014-03-02 19:54 - 2014-03-02 19:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-02 19:54 - 2014-03-02 19:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-02 19:54 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\ProgramData\Sony Mobile 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\Program Files (x86)\Sony Mobile 2014-03-01 23:45 - 2014-03-01 23:45 - 00142620 _____ () C:\Windows\DPINST.LOG 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\Users\Jonas\Documents\Elder Scrolls Online 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online 2014-02-28 22:59 - 2014-02-28 23:01 - 00000000 ____D () C:\Program Files (x86)\Zenimax Online 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\ProgramData\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Program Files\NetLimiter 3 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\SysWOW64\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\system32\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-19 16:44 - 2014-02-08 19:34 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2014-02-19 16:44 - 2014-02-08 19:34 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 01075488 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-02-19 16:44 - 2014-02-08 18:42 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 00067072 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-02-19 16:44 - 2014-02-05 18:52 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin 2014-02-19 16:39 - 2014-02-08 19:34 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-02-19 16:39 - 2014-02-08 19:34 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys 2014-02-19 16:39 - 2014-02-08 19:34 - 00024544 _____ () C:\Windows\system32\nvinfo.pb 2014-02-16 12:23 - 2013-12-10 03:15 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-02-16 12:23 - 2013-12-10 03:14 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-02-16 12:22 - 2014-02-16 13:46 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA 2014-02-16 12:18 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2014-02-16 12:18 - 2013-12-05 09:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2014-02-16 12:18 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2014-02-16 12:02 - 2014-02-16 12:02 - 00000000 ____D () C:\Users\Jonas\Documents\Respawn 2014-02-15 23:55 - 2014-02-15 23:55 - 00017513 _____ () C:\Windows\DirectX.log 2014-02-14 22:10 - 2014-02-14 22:10 - 00000000 ____D () C:\Users\Jonas\Desktop\GCC_pre_C11 2014-02-14 21:17 - 2014-02-14 21:19 - 00000000 ____D () C:\Users\Jonas\.designer 2014-02-06 17:58 - 2013-01-13 22:17 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:17 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:16 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:35 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:35 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:35 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:22 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-06 17:58 - 2013-01-13 21:20 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll 2014-02-06 17:58 - 2013-01-13 21:09 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll 2014-02-06 17:58 - 2013-01-13 21:08 - 01504768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll 2014-02-06 17:58 - 2013-01-13 21:08 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll 2014-02-06 17:58 - 2013-01-13 20:59 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2014-02-06 17:58 - 2013-01-13 20:58 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2014-02-06 17:58 - 2013-01-13 20:54 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll 2014-02-06 17:58 - 2013-01-13 20:53 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll 2014-02-06 17:58 - 2013-01-13 20:53 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll 2014-02-06 17:58 - 2013-01-13 20:51 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-06 17:58 - 2013-01-13 20:49 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll 2014-02-06 17:58 - 2013-01-13 20:48 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll 2014-02-06 17:58 - 2013-01-13 20:46 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll 2014-02-06 17:58 - 2013-01-13 20:43 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-02-06 17:58 - 2013-01-13 20:38 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll 2014-02-06 17:58 - 2013-01-13 20:38 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2014-02-06 17:58 - 2013-01-13 20:38 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2014-02-06 17:58 - 2013-01-13 20:37 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-06 17:58 - 2013-01-13 20:25 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll 2014-02-06 17:58 - 2013-01-13 20:24 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2014-02-06 17:58 - 2013-01-13 20:24 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll 2014-02-06 17:58 - 2013-01-13 20:20 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2014-02-06 17:58 - 2013-01-13 20:20 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2014-02-06 17:58 - 2013-01-13 20:15 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-02-06 17:58 - 2013-01-13 20:10 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-02-06 17:58 - 2013-01-13 20:02 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2014-02-06 17:58 - 2013-01-13 19:34 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll 2014-02-06 17:58 - 2013-01-13 19:32 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2014-02-06 17:58 - 2013-01-13 19:09 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll 2014-02-06 17:58 - 2013-01-13 18:26 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll 2014-02-06 17:58 - 2013-01-13 18:05 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll 2014-02-06 17:58 - 2013-01-04 07:11 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-02-06 17:58 - 2013-01-04 07:11 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-02-06 17:54 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2014-02-06 17:53 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2014-02-06 17:53 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2014-02-06 17:53 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-02-06 17:53 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-02-06 17:53 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-02-06 17:53 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-02-06 17:53 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-02-06 17:53 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-02-06 17:53 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-02-06 17:53 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-02-06 17:53 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-02-06 17:53 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-02-06 17:53 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-02-06 17:53 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-02-06 17:53 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-02-06 17:53 - 2013-08-02 03:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-02-06 17:53 - 2013-08-02 03:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2014-02-06 17:53 - 2013-08-02 03:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2014-02-06 17:53 - 2013-08-02 03:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2014-02-06 17:53 - 2013-08-02 03:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2014-02-06 17:53 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2014-02-06 17:53 - 2013-08-02 03:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2014-02-06 17:53 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-02-06 17:53 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-02-06 17:53 - 2013-08-02 02:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-02-06 17:53 - 2013-08-02 02:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2014-02-06 17:53 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-02-06 17:53 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-02-06 17:53 - 2013-08-02 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2014-02-06 17:53 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2014-02-06 17:53 - 2013-08-02 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2014-02-06 17:53 - 2013-08-02 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2014-02-06 17:53 - 2013-08-02 01:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2014-02-06 17:53 - 2013-08-02 01:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2014-02-06 17:53 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2014-02-06 17:53 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-02-06 17:53 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll 2014-02-06 17:53 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-02-06 17:53 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2014-02-06 17:53 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2014-02-06 17:53 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2014-02-06 17:53 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2014-02-06 17:53 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2014-02-06 17:53 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2014-02-06 17:53 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2014-02-06 17:53 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2014-02-06 17:53 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2014-02-06 17:53 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2014-02-06 17:53 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2014-02-06 17:53 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2014-02-06 17:53 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2014-02-06 17:53 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2014-02-06 17:53 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2014-02-06 17:53 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2014-02-06 17:53 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2014-02-06 17:53 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2014-02-06 17:53 - 2013-02-27 07:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-02-06 17:53 - 2013-02-27 06:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-02-06 17:53 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll 2014-02-06 17:53 - 2013-02-27 05:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-02-06 17:52 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-02-06 17:52 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-02-06 17:52 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-02-06 17:52 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-02-06 17:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2014-02-06 17:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2014-02-06 17:52 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2014-02-06 17:52 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2014-02-06 17:52 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-02-06 17:52 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-02-06 17:52 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-02-06 17:52 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2014-02-06 17:52 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2014-02-06 17:52 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2014-02-06 17:52 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2014-02-06 17:52 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys 2014-02-06 17:52 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2014-02-06 17:52 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys 2014-02-06 17:52 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-02-06 17:52 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-02-06 17:52 - 2013-07-06 07:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-02-06 17:52 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2014-02-06 17:52 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2014-02-06 17:52 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2014-02-06 17:52 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2014-02-06 17:52 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2014-02-06 17:52 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2014-02-06 17:52 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-02-06 17:52 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-02-06 17:52 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll 2014-02-06 17:52 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe 2014-02-06 17:52 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe 2014-02-06 17:52 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll 2014-02-06 17:52 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-02-06 17:52 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2014-02-06 17:52 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe 2014-02-06 17:46 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2014-02-06 17:46 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2014-02-06 17:46 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2014-02-06 17:46 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2014-02-06 17:46 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2014-02-06 17:46 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2014-02-06 17:46 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2014-02-06 17:46 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2014-02-06 17:46 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-02-06 17:46 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2014-02-06 17:46 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-02-06 17:45 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2014-02-06 17:45 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2014-02-06 17:45 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2014-02-06 17:45 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2014-02-06 17:45 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2014-02-06 17:16 - 2014-02-06 17:16 - 00002762 _____ () C:\Windows\PFRO.log 2014-02-06 17:11 - 2014-02-19 16:44 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-02-06 16:48 - 2014-02-06 16:48 - 00000000 ____D () C:\Program Files\Intel 2014-02-05 19:17 - 2014-02-05 19:17 - 00004500 _____ () C:\Users\Jonas\AppData\Local\recently-used.xbel 2014-02-05 18:39 - 2014-02-05 18:39 - 00069120 ___SH () C:\Users\Jonas\Documents\Thumbs.db ==================== One Month Modified Files and Folders ======= 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Downloads\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00000472 _____ () C:\Users\Jonas\Desktop\defogger_disable.log 2014-03-03 18:13 - 2014-03-03 18:13 - 00000000 _____ () C:\Users\Jonas\defogger_reenable 2014-03-03 18:13 - 2014-03-03 18:10 - 00015384 _____ () C:\Users\Jonas\Desktop\FRST.txt 2014-03-03 18:13 - 2014-03-03 18:09 - 00000000 ____D () C:\FRST 2014-03-03 18:13 - 2013-05-30 19:38 - 00000000 ____D () C:\Users\Jonas 2014-03-03 16:31 - 2013-09-20 16:41 - 00000000 ____D () C:\Users\Jonas\Documents\Schule 2014-03-03 16:11 - 2013-07-17 20:34 - 00000000 ____D () C:\Program Files (x86)\Ubisoft 2014-03-03 16:10 - 2014-03-03 16:09 - 02156544 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe 2014-03-03 15:41 - 2013-06-10 11:43 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\QtProject 2014-03-03 15:23 - 2013-07-03 14:55 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\.minecraft 2014-03-03 14:34 - 2013-10-10 16:52 - 01724351 _____ () C:\Windows\WindowsUpdate.log 2014-03-03 14:17 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-03 14:17 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-03 14:13 - 2014-01-31 14:21 - 00008712 _____ () C:\Windows\setupact.log 2014-03-03 14:09 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-02 20:58 - 2013-11-25 21:10 - 00000000 ____D () C:\Program Files (x86)\JDownloader 2014-03-02 20:56 - 2013-07-11 13:28 - 00000000 ____D () C:\Users\Jonas\AppData\Local\JDownloader v2.0 2014-03-02 19:54 - 2014-03-02 19:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-02 19:54 - 2014-03-02 19:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-02 17:45 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-03-02 16:28 - 2013-06-10 10:49 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\foobar2000 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\ProgramData\Sony Mobile 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\Program Files (x86)\Sony Mobile 2014-03-01 23:45 - 2014-03-01 23:45 - 00142620 _____ () C:\Windows\DPINST.LOG 2014-03-01 23:45 - 2013-05-30 20:09 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-03-01 19:07 - 2013-05-30 19:56 - 00000000 ____D () C:\Users\Jonas\Desktop\Spiele 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\Users\Jonas\Documents\Elder Scrolls Online 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online 2014-03-01 15:57 - 2013-06-19 18:11 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Skype 2014-02-28 23:01 - 2014-02-28 22:59 - 00000000 ____D () C:\Program Files (x86)\Zenimax Online 2014-02-28 22:49 - 2013-07-24 23:27 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\TS3Client 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\ProgramData\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Program Files\NetLimiter 3 2014-02-27 20:39 - 2013-07-18 14:00 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin 2014-02-25 19:54 - 2013-05-31 14:53 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-02-24 21:37 - 2013-11-22 18:42 - 00000000 ____D () C:\ProgramData\tmp 2014-02-23 17:48 - 2013-06-22 20:49 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Windows Live 2014-02-21 19:03 - 2013-12-09 22:16 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-02-21 19:02 - 2013-12-09 22:16 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Battle.net 2014-02-21 19:02 - 2013-05-31 13:24 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\NVIDIA 2014-02-21 14:43 - 2013-05-30 19:56 - 00000000 ___RD () C:\Users\Jonas\Desktop\Alles 2014-02-19 22:17 - 2013-06-13 14:32 - 00000000 ____D () C:\ProgramData\Origin 2014-02-19 22:16 - 2013-06-13 14:32 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\SysWOW64\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\system32\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-19 16:44 - 2014-02-06 17:11 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-02-19 16:44 - 2013-08-13 17:01 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-02-19 16:44 - 2013-05-30 21:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-02-19 15:20 - 2013-05-30 20:18 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\ftblauncher 2014-02-16 16:37 - 2009-07-14 18:58 - 00702388 _____ () C:\Windows\system32\perfh007.dat 2014-02-16 16:37 - 2009-07-14 18:58 - 00151022 _____ () C:\Windows\system32\perfc007.dat 2014-02-16 16:37 - 2009-07-14 06:13 - 01628890 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-16 13:46 - 2014-02-16 12:22 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA 2014-02-16 12:27 - 2013-11-04 14:43 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA Corporation 2014-02-16 12:02 - 2014-02-16 12:02 - 00000000 ____D () C:\Users\Jonas\Documents\Respawn 2014-02-15 23:55 - 2014-02-15 23:55 - 00017513 _____ () C:\Windows\DirectX.log 2014-02-15 18:45 - 2013-06-13 14:34 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Origin 2014-02-15 17:30 - 2013-06-13 14:34 - 00000000 ____D () C:\Program Files (x86)\Origin Games 2014-02-15 14:48 - 2013-08-02 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-14 22:10 - 2014-02-14 22:10 - 00000000 ____D () C:\Users\Jonas\Desktop\GCC_pre_C11 2014-02-14 21:19 - 2014-02-14 21:17 - 00000000 ____D () C:\Users\Jonas\.designer 2014-02-14 21:08 - 2014-01-29 23:02 - 00000000 ____D () C:\Program Files (x86)\osu! 2014-02-14 14:41 - 2013-10-11 16:30 - 00000000 ____D () C:\ProgramData\VMware 2014-02-12 16:10 - 2013-08-01 16:38 - 00000000 ____D () C:\Users\Jonas\Documents\Bewerbungen 2014-02-09 01:16 - 2013-06-27 14:29 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Notepad++ 2014-02-08 19:34 - 2014-02-19 16:44 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2014-02-08 19:34 - 2014-02-19 16:44 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-02-08 19:34 - 2014-02-19 16:39 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys 2014-02-08 19:34 - 2014-02-19 16:39 - 00024544 _____ () C:\Windows\system32\nvinfo.pb 2014-02-08 18:42 - 2014-02-19 16:44 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 01075488 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-02-08 18:42 - 2014-02-19 16:44 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 00067072 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-02-08 16:31 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-07 22:39 - 2014-01-11 16:38 - 00000000 ____D () C:\Projects 2014-02-06 20:29 - 2014-01-31 10:14 - 00000000 ____D () C:\Program Files (x86)\Dragon's Prophet 2014-02-06 19:47 - 2013-05-30 19:39 - 00000000 ___RD () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-06 19:47 - 2013-05-30 19:39 - 00000000 ___RD () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-02-06 19:45 - 2009-07-14 05:45 - 00415056 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-02-06 19:42 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal 2014-02-06 19:42 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender 2014-02-06 19:42 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\zh-HK 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\tr-TR 2014-02-06 18:19 - 2013-05-31 12:49 - 01603170 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-06 18:11 - 2013-05-30 20:01 - 00000000 ____D () C:\Program Files (x86)\Intel 2014-02-06 17:57 - 2013-10-21 19:25 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-06 17:16 - 2014-02-06 17:16 - 00002762 _____ () C:\Windows\PFRO.log 2014-02-06 17:02 - 2013-07-22 11:09 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll 2014-02-06 16:48 - 2014-02-06 16:48 - 00000000 ____D () C:\Program Files\Intel 2014-02-06 16:29 - 2013-07-22 11:31 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab 2014-02-05 19:17 - 2014-02-05 19:17 - 00004500 _____ () C:\Users\Jonas\AppData\Local\recently-used.xbel 2014-02-05 19:17 - 2013-08-21 17:38 - 00000000 ____D () C:\Users\Jonas\AppData\Local\gtk-2.0 2014-02-05 19:17 - 2013-07-26 16:54 - 00000000 ____D () C:\Users\Jonas\.gimp-2.8 2014-02-05 18:52 - 2014-02-19 16:44 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin 2014-02-05 18:39 - 2014-02-05 18:39 - 00069120 ___SH () C:\Users\Jonas\Documents\Thumbs.db 2014-02-05 17:29 - 2013-05-30 19:43 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Google 2014-02-05 17:29 - 2013-05-30 19:43 - 00000000 ____D () C:\Program Files (x86)\Google 2014-02-01 14:49 - 2013-06-01 15:11 - 00000000 ____D () C:\Users\Jonas\Documents\Visual Studio 2012 Some content of TEMP: ==================== C:\Users\Jonas\AppData\Local\Temp\npp.6.5.2.Installer.exe C:\Users\Jonas\AppData\Local\Temp\NVI2_29.DLL C:\Users\Jonas\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-01 01:20 ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-03 18:34:28
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500325AS rev.0001SDM1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Jonas\AppData\Local\Temp\kgloypow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800031b2000 45 bytes [00, 00, 10, 02, 4E, 74, 66, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 591 fffff800031b202f 10 bytes [00, 01, 00, 06, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff7f7490 11 bytes JMP 000007fffe3a0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff80bf00 7 bytes JMP 000007fffe3a0260
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\d3d9.dll!Direct3DCreate9Ex 000007fef92f2460 5 bytes JMP 000007fefe3a02d0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\d3d9.dll!Direct3DCreate9 000007fef93296b0 6 bytes JMP 000007fefe3a0298
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef85cdc88 5 bytes JMP 000007fff85a00d8
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef85cde10 5 bytes JMP 000007fff85a0110
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075561eee 7 bytes JMP 0000000172973550
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075565b85 7 bytes JMP 00000001729737f0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755713e1 7 bytes JMP 0000000172973650
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007557ea0d 7 bytes JMP 0000000172973540
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756088b4 7 bytes JMP 0000000172973310
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075608939 5 bytes JMP 00000001729733c0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075608c8f 5 bytes JMP 0000000172973320
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075671d1b 5 bytes JMP 00000001729732b0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075671dc9 5 bytes JMP 0000000172973270
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075672aa4 5 bytes JMP 00000001729733d0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075672d0a 5 bytes JMP 00000001729730b0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076d88a29 5 bytes JMP 0000000172972c60
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076d94572 5 bytes JMP 0000000172973030
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076dae567 5 bytes JMP 00000001729730a0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076de7a5c 5 bytes JMP 0000000172973020
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000075b2e96b 5 bytes JMP 0000000172972cd0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000075b2eba5 5 bytes JMP 0000000172972ce0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000077135ea5 5 bytes JMP 0000000172972c20
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000077169d0b 5 bytes JMP 0000000172972bb0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e81465 2 bytes [E8, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e814bb 2 bytes [E8, 75]
.text ... * 2
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff7f7490 11 bytes JMP 000007fffe3a0228
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff80bf00 7 bytes JMP 000007fffe3a0260
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff7f7490 11 bytes JMP 000007fffe3a0228
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff80bf00 7 bytes JMP 000007fffe3a0260
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075561eee 7 bytes JMP 0000000172973550
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075565b85 7 bytes JMP 00000001729737f0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755713e1 7 bytes JMP 0000000172973650
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007557ea0d 7 bytes JMP 0000000172973540
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756088b4 7 bytes JMP 0000000172973310
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075608939 5 bytes JMP 00000001729733c0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075608c8f 5 bytes JMP 0000000172973320
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075671d1b 5 bytes JMP 00000001729732b0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075671dc9 5 bytes JMP 0000000172973270
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075672aa4 5 bytes JMP 00000001729733d0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075672d0a 5 bytes JMP 00000001729730b0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076d88a29 5 bytes JMP 0000000172972c60
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076d94572 5 bytes JMP 0000000172973030
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076dae567 5 bytes JMP 00000001729730a0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076de7a5c 5 bytes JMP 0000000172973020
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000075b2e96b 5 bytes JMP 0000000172972cd0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000075b2eba5 5 bytes JMP 0000000172972ce0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000077135ea5 5 bytes JMP 0000000172972c20
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000077169d0b 5 bytes JMP 0000000172972bb0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075561eee 7 bytes JMP 0000000172973550
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075565b85 7 bytes JMP 00000001729737f0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755713e1 7 bytes JMP 0000000172973650
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007557ea0d 7 bytes JMP 0000000172973540
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756088b4 7 bytes JMP 0000000172973310
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075608939 5 bytes JMP 00000001729733c0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075608c8f 5 bytes JMP 0000000172973320
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075671d1b 5 bytes JMP 00000001729732b0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075671dc9 5 bytes JMP 0000000172973270
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075672aa4 5 bytes JMP 00000001729733d0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075672d0a 5 bytes JMP 00000001729730b0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000075b2e96b 5 bytes JMP 0000000172972cd0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000075b2eba5 5 bytes JMP 0000000172972ce0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076d88a29 5 bytes JMP 0000000172972c60
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076d94572 5 bytes JMP 0000000172973030
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076dae567 5 bytes JMP 00000001729730a0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076de7a5c 5 bytes JMP 0000000172973020
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015834b5420
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015834b5420@d05162c96a94 0xE0 0xB8 0xDF 0xC9 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015834b5420 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015834b5420@d05162c96a94 0xE0 0xB8 0xDF 0xC9 ...
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.03.03.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Jonas :: JONAS-PC [Administrator] 03.03.2014 17:11:40 MBAM-log-2014-03-03 (18-10-17).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 436623 Laufzeit: 56 Minute(n), 54 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 4 HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\Users\Jonas\AppData\Roaming\Iminent\Mediator (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 3 C:\Users\Jonas\AppData\Local\Temp\is-BKDPR.tmp\itdownload_stub.exe (PUP.Optional.Monetizer) -> Keine Aktion durchgeführt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas\globalcache.dat (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas\user.dat (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. (Ende) Mit freundlichen Grüßen Jonas |
|
03.03.2014, 19:09
| #2 | |
| /// the machine /// TB-Ausbilder    | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram hi,
__________________Zitat:
ProcessExplorer als Ersatz für den Windows Taskmanager installieren Lade Dir den Process Explorer als Ersatz für den Taskmanager herunter und installiere ihn, hier findest Du eine Anleitung. Das ist ein wesentlich leistungsfähigerer Ersatz für den Windows-Taskmanager. Im Menü unter "Options" kannst Du den ProcessExplorer dauerhaft als Ersatz für den Taskmanager einrichten (Replace Taskmanager). Das ist sehr empfehlenswert, weil der ProcessExplorer erheblich mehr Funktionen als der Taskmanager hat. Wenn Du diese Einstellung gemacht hast, öffnet sich mit der Tastenkombination STRG + ALT + Entf. nicht mehr der Taskmanager, sondern der ProcessExplorer. Das kann jederzeit durch Abhaken dieser Einstellung wieder rückgängig gemacht werden. Was wir jetzt konkret brauchen: In jeder Zeile steht ein Prozess, ein paar der Zeilen sind keine richtigen Prozesse, sondern nur Pseudoprozesse für die Tätigkeit des Windos-Kernels. Im Menü View => Select Columns wird ein Dialog geöffnet, in dem Du auswählen kannst, welche Spalten mit Informationen zu den Prozessen angezeigt werden sollen. In dem gehe in das Register "Process Performance" und stelle sicher, dass dort "CPU Usage" angehakt ist, "CPU History" wäre ebenfalls sinnvoll. Unter "CPU Usage" wird der aktuelle Wert der Prozessorauslastung für jeden Prozess angezeigt (im Tabellentitel steht nur kurz "CPU"), "CPU History" blendet für jeden Prozess ein Diagramm ein, das eine Kurve mit der Prozessorauslastung für die letzte Zeit anzeigt. Damit sollte es Dir möglich sein, zu identifizieren, welcher Prozess Deine CPU in Trab hält. Mache einen Doppelklick auf den Prozess. Du kannst von dem ganzen auch einen Screenshot machen und ihn als Anhang mit Deiner Antwort hochladen (auf "Erweitert" unter dem Textfeld klicken und über "Anhänge verwalten" auf Deinem Rechner suchen lassen und über "Hochladen" anhängen).
__________________ |
|
03.03.2014, 20:17
| #3 |
| | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Erstmal Danke für deine schnelle Antwort.
__________________Hab ein Screenshot im Anhang von den Prozess der den Ram verbraucht. Ist das normal das der so viel brauch? Wie sieht das mit den anderen Sachen aus bei MBAM hatte ich glaub ich 9 Funde. EDIT: Den Proxy habe ich wahrscheinlich mal gesetzt wo ich noch nicht ProxTube oder wie das heißt hatte. War aber auch deaktiviert. Geändert von Craftplorer (03.03.2014 um 20:28 Uhr) |
|
04.03.2014, 17:38
| #4 |
| /// the machine /// TB-Ausbilder | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram aargh, der Screen überdeckt den Process Explorer. War da unter dem Plus bei der svchost.exe die dwm? Funde bei MBAM sind nur PUP und Adware, regeln wir im Anschluss 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.03.2014, 18:00
| #5 |
| | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Ja genau unter svchost also unter dem Plus steht dwm.exe. |
|
05.03.2014, 14:38
| #6 |
| /// the machine /// TB-Ausbilder | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram hi, Scan mit Combofix
__________________ --> Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram |
|
05.03.2014, 15:07
| #7 |
| | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Hier ComboFix.txt: Code:
ATTFilter ComboFix 14-03-04.03 - Jonas 05.03.2014 14:53:42.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.5815.4652 [GMT 1:00]
ausgeführt von:: c:\users\Jonas\Desktop\ComboFix.exe
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Jonas\AppData\Roaming\Jonaslog.dat
c:\users\Jonas\AppData\Roaming\poclbm
c:\users\Jonas\AppData\Roaming\poclbm\poclbm_scrypt.ini
c:\users\Jonas\AppData\Roaming\Windir
c:\windows\7Loader.TAG
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-02-05 bis 2014-03-05 ))))))))))))))))))))))))))))))
.
.
2014-03-03 17:09 . 2014-03-03 17:14 -------- d-----w- C:\FRST
2014-03-02 18:54 . 2014-03-02 18:54 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2014-03-02 18:54 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-01 22:48 . 2014-03-01 22:48 -------- d-----w- c:\programdata\Sony Mobile
2014-03-01 22:48 . 2014-03-01 22:48 -------- d-----w- c:\program files (x86)\Sony Mobile
2014-03-01 16:30 . 2014-03-01 16:30 -------- d-----w- c:\programdata\Elder Scrolls Online
2014-02-28 21:59 . 2014-02-28 22:01 -------- d-----w- c:\program files (x86)\Zenimax Online
2014-02-27 19:39 . 2014-02-27 19:39 -------- d-----w- c:\users\Jonas\AppData\Local\Locktime
2014-02-27 19:39 . 2014-02-27 19:39 -------- d-----w- c:\programdata\Locktime
2014-02-27 19:39 . 2014-02-27 19:39 -------- d-----w- c:\program files\NetLimiter 3
2014-02-19 19:42 . 2014-02-19 19:42 -------- d-----w- c:\windows\SysWow64\NV
2014-02-19 19:42 . 2014-02-19 19:42 -------- d-----w- c:\windows\system32\NV
2014-02-19 19:42 . 2014-02-19 19:42 -------- d-----w- c:\programdata\NVIDIA
2014-02-19 15:44 . 2014-02-08 17:42 6712608 ----a-w- c:\windows\system32\nvcpl.dll
2014-02-19 15:44 . 2014-02-08 17:42 3498272 ----a-w- c:\windows\system32\nvsvc64.dll
2014-02-19 15:44 . 2014-02-08 17:42 923936 ----a-w- c:\windows\system32\nvvsvc.exe
2014-02-19 15:44 . 2014-02-08 17:42 67072 ----a-w- c:\windows\system32\nv3dappshextr.dll
2014-02-19 15:44 . 2014-02-08 17:42 63776 ----a-w- c:\windows\system32\nvshext.dll
2014-02-19 15:44 . 2014-02-08 17:42 386336 ----a-w- c:\windows\system32\nvmctray.dll
2014-02-19 15:44 . 2014-02-08 17:42 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2014-02-19 15:44 . 2014-02-08 17:42 1075488 ----a-w- c:\windows\system32\nv3dappshext.dll
2014-02-19 15:44 . 2014-02-05 17:52 3573739 ----a-w- c:\windows\system32\nvcoproc.bin
2014-02-19 15:44 . 2014-02-08 18:34 61216 ----a-w- c:\windows\system32\OpenCL.dll
2014-02-19 15:44 . 2014-02-08 18:34 53024 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-02-16 11:23 . 2013-12-10 02:14 1100248 ----a-w- c:\windows\system32\nvspcap64.dll
2014-02-16 11:23 . 2013-12-10 02:15 982232 ----a-w- c:\windows\SysWow64\nvspcap.dll
2014-02-16 11:22 . 2014-02-16 12:46 -------- d-----w- c:\users\Jonas\AppData\Local\NVIDIA
2014-02-16 11:18 . 2013-12-05 08:42 39200 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2014-02-16 11:18 . 2013-12-05 08:42 35104 ----a-w- c:\windows\system32\nvaudcap64v.dll
2014-02-16 11:18 . 2013-12-05 08:42 32544 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2014-02-14 20:17 . 2014-02-14 20:19 -------- d-----w- c:\users\Jonas\.designer
2014-02-06 16:54 . 2013-06-25 22:55 785624 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2014-02-06 16:52 . 2013-11-12 02:23 2048 ----a-w- c:\windows\system32\tzres.dll
2014-02-06 16:46 . 2013-08-01 12:09 983488 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2014-02-06 16:46 . 2013-04-10 06:01 265064 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2014-02-06 16:46 . 2011-02-03 11:25 144384 ----a-w- c:\windows\system32\cdd.dll
2014-02-06 16:46 . 2013-10-12 02:32 150016 ----a-w- c:\windows\system32\wshom.ocx
2014-02-06 16:46 . 2013-10-12 02:31 202752 ----a-w- c:\windows\system32\scrrun.dll
2014-02-06 16:46 . 2013-10-12 02:04 121856 ----a-w- c:\windows\SysWow64\wshom.ocx
2014-02-06 16:46 . 2013-10-12 02:03 163840 ----a-w- c:\windows\SysWow64\scrrun.dll
2014-02-06 16:46 . 2013-10-12 01:33 156160 ----a-w- c:\windows\system32\cscript.exe
2014-02-06 16:46 . 2013-10-12 01:33 168960 ----a-w- c:\windows\system32\wscript.exe
2014-02-06 16:46 . 2013-10-12 01:15 141824 ----a-w- c:\windows\SysWow64\wscript.exe
2014-02-06 16:46 . 2013-10-12 01:15 126976 ----a-w- c:\windows\SysWow64\cscript.exe
2014-02-06 16:45 . 2013-10-12 02:30 830464 ----a-w- c:\windows\system32\nshwfp.dll
2014-02-06 16:45 . 2013-10-12 02:29 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2014-02-06 16:45 . 2013-10-12 02:29 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2014-02-06 16:45 . 2013-10-12 02:03 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2014-02-06 16:45 . 2013-10-12 02:01 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2014-02-06 16:11 . 2014-02-19 15:44 -------- d-----w- c:\programdata\NVIDIA Corporation
2014-02-06 15:48 . 2014-02-06 15:48 -------- d-----w- c:\program files\Intel
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-06 16:02 . 2013-07-22 10:09 53248 ----a-w- c:\windows\SysWow64\CSVer.dll
2014-01-06 15:20 . 2013-10-21 18:25 86054176 ----a-w- c:\windows\system32\MRT.exe
2013-12-29 13:09 . 2013-07-17 07:42 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-29 13:09 . 2013-07-17 07:42 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-18 20:09 . 2014-01-23 16:06 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-12-18 16:19 . 2014-01-10 21:44 252688 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2013-12-18 16:16 . 2014-01-10 21:44 126736 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2013-12-18 16:16 . 2013-12-18 16:16 154896 ----a-w- c:\windows\system32\drivers\VBoxNetFlt.sys
2013-12-18 16:16 . 2013-12-18 16:16 140560 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2013-12-18 16:13 . 2013-12-18 16:13 204048 ----a-w- c:\windows\system32\VBoxNetFltNobj.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2013-03-10 88984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
R3 LGVirHid;Logitech Gamepanel Virtual HID Device Driver;c:\windows\system32\drivers\LGVirHid.sys;c:\windows\SYSNATIVE\drivers\LGVirHid.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 SjtWinIo;SJT I/O Driver;c:\windows\system32\DRIVERS\SjtWinIo.sys;c:\windows\SYSNATIVE\DRIVERS\SjtWinIo.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 VBoxUSB;VirtualBox USB;c:\windows\system32\Drivers\VBoxUSB.sys;c:\windows\SYSNATIVE\Drivers\VBoxUSB.sys [x]
R4 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R4 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R4 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
R4 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
R4 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R4 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys;c:\windows\SYSNATIVE\drivers\vsock.sys [x]
S1 nltdi;nltdi;c:\program files\NetLimiter 3\nltdi.sys;c:\program files\NetLimiter 3\nltdi.sys [x]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxDrv.sys [x]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxUSBMon.sys [x]
S2 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys;c:\windows\SYSNATIVE\drivers\npf.sys [x]
S2 ZAtheros Wlan Agent;ZAtheros Wlan Agent;c:\program files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe;c:\program files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe [x]
S3 avmaura;AVM USB-Fernanschluss;c:\windows\system32\DRIVERS\avmaura.sys;c:\windows\SYSNATIVE\DRIVERS\avmaura.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 LGBusEnum;Logitech GamePanel Virtual Bus Enumerator Driver;c:\windows\system32\drivers\LGBusEnum.sys;c:\windows\SYSNATIVE\drivers\LGBusEnum.sys [x]
S3 LGSHidFilt;Logitech Gaming KMDF HID Filter Driver;c:\windows\system32\DRIVERS\LGSHidFilt.Sys;c:\windows\SYSNATIVE\DRIVERS\LGSHidFilt.Sys [x]
S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys;c:\windows\SYSNATIVE\DRIVERS\nlndis.sys [x]
S3 nvoclk64;NVIDIA Enthusiasts Platform KDM;c:\windows\system32\DRIVERS\nvoclk64.sys;c:\windows\SYSNATIVE\DRIVERS\nvoclk64.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
S3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
.
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2013-03-29 13513288]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-01-10 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-10 392984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-10 417560]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: An OneNote s&enden - c:\progra~1\MICROS~4\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~1\MICROS~4\Office14\EXCEL.EXE/3000
LSP: %windir%\system32\vsocklib.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\
FF - ExtSQL: 2014-01-08 14:57; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - (no file)
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - (no file)
ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_117_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_117.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-03-05 15:06:01 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-03-05 14:06
.
Vor Suchlauf: 14 Verzeichnis(se), 285.314.129.920 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 285.279.084.544 Bytes frei
.
- - End Of File - - 0AC15607D416F40C99FB497941E3145C
A36C5E4F47E84449FF07ED3517B43A31
|
|
06.03.2014, 10:47
| #8 |
| /// the machine /// TB-Ausbilder | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.03.2014, 15:23
| #9 |
| | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Hi hab bei MBAM Quick-Scan gemacht oder sollte ich den anderen nehmen? Bei den FRST Log steh ziemlich wenig drin im Verhältnis zum letzten hab ich was falsch gemacht oder ist das ein gutes Zeichen? MBAM Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.03.06.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Jonas :: JONAS-PC [Administrator] 06.03.2014 14:57:51 mbam-log-2014-03-06 (14-57-51).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 219694 Laufzeit: 3 Minute(n), 56 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 4 HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\Users\Jonas\AppData\Roaming\Iminent\Mediator (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 3 C:\ProgramData\InstallMate\{4D7E0DC6-F6D5-4076-A29D-BEF7969D2F30}\Custom.dll (Adware.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas\globalcache.dat (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas\user.dat (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.020 - Bericht erstellt am 06/03/2014 um 15:07:52
# Aktualisiert 27/02/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Jonas - JONAS-PC
# Gestartet von : C:\Users\Jonas\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\StarApp
Ordner Gelöscht : C:\Windows\SysWOW64\AI_RecycleBin
Ordner Gelöscht : C:\Users\Jonas\AppData\Roaming\Iminent
Datei Gelöscht : C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4250488A-CB24-0893-C066-B1AEA57BCFF2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\anchorfree
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\caphyon
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16490
-\\ Mozilla Firefox v25.0.1 (de)
[ Datei : C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\prefs.js ]
Zeile gelöscht : user_pref("iminent.enabledAds", "false");
-\\ Google Chrome v31.0.1650.57
[ Datei : C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [11474 octets] - [06/03/2014 15:07:01]
AdwCleaner[S0].txt - [11071 octets] - [06/03/2014 15:07:52]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11132 octets] ##########
JRT Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Jonas on 06.03.2014 at 15:10:26,46
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Blask glass_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\Blask glass_RASMANCS
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Blask glass_RASAPI32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\Blask glass_RASMANCS
~~~ Files
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Jonas\AppData\Roaming\getrighttogo"
~~~ FireFox
Emptied folder: C:\Users\Jonas\AppData\Roaming\mozilla\firefox\profiles\6nc1l8eu.default\minidumps [4 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.03.2014 at 15:17:12,44
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter
LastRegBack: 2014-03-01 01:20
==================== End Of Log ============================
|
|
07.03.2014, 14:20
| #10 |
| /// the machine /// TB-Ausbilder | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram FRST am Schluss nochmal neu scannen lassen, beim letzten Lauf ging irgendwas schief ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.03.2014, 17:36
| #11 |
| | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram ESET Log: Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=076b35f421ab894da841fcfa71889f47
# engine=17355
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-03-07 04:25:14
# local_time=2014-03-07 05:25:14 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 2497349 145839364 0 0
# scanned=233820
# found=0
# cleaned=0
# scan_time=7704
Code:
ATTFilter Results of screen317's Security Check version 0.99.80 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java 7 Update 51 Adobe Flash Player 11.9.900.170 Flash Player out of Date! Adobe Reader XI Mozilla Firefox 25.0.1 Firefox out of Date! Google Chrome 30.0.1599.101 Google Chrome 31.0.1650.57 ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-03-2014
Ran by Jonas (administrator) on JONAS-PC on 07-03-2014 17:33:34
Running from C:\Users\Jonas\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Atheros) C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\system32\cmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [174296 2014-02-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148528 2014-02-08] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6109E71583CECE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jonas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-11-25]
FF Extension: NoScript - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-07-21]
FF Extension: Adblock Plus - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-07-21]
FF Extension: Greasemonkey - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-01-08]
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchKeyword: https://www.google.de/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll ()
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.450.18) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java(TM) Platform SE 7 U45) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (QUAKE LIVE) - C:\ProgramData\id Software\QuakeLive\npquakezero.dll No File
CHR Plugin: (Unity Player) - C:\Users\Jonas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll No File
CHR Extension: (ProxTube) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-27]
CHR Extension: (Google Drive) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-30]
CHR Extension: (YouTube) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-30]
CHR Extension: (Google-Suche) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-30]
CHR Extension: (Give Up) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\diippoclinjdbklinhchgedilfncehbi [2013-07-22]
CHR Extension: (AdBlock) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-10-30]
CHR Extension: (ProxMate - Proxy on steroids!) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgjpnmnpjmabddgmjdiaggacbololbjm [2013-05-30]
CHR Extension: (convert2mp3.net Online Video Converter) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmhoigapbeidamhadadmpbhpaodamjce [2014-02-12]
CHR Extension: (Google Wallet) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07]
CHR Extension: (Google Mail) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-30]
==================== Services (Whitelisted) =================
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S4 nlsvc; C:\Program Files\NetLimiter 3\nlsvc.exe [1851008 2013-10-10] (Locktime Software)
S4 nTuneService; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe [278336 2011-09-19] (NVIDIA)
S4 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe [57344 2011-08-10] (Atheros)
==================== Drivers (Whitelisted) ====================
R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-07-01] (AVM Berlin)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 nltdi; C:\Program Files\NetLimiter 3\nltdi.sys [87472 2013-06-12] (Locktime Software)
R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 SjtWinIo; C:\Windows\System32\DRIVERS\SjtWinIo.sys [9216 2013-06-13] (SpeedJet Technology INC.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-09-06] (Oracle Corporation)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-03-07 17:33 - 2014-03-07 17:33 - 00000922 _____ () C:\Users\Jonas\Desktop\checkup.txt
2014-03-07 17:28 - 2014-03-07 17:28 - 00987442 _____ () C:\Users\Jonas\Downloads\SecurityCheck.exe
2014-03-07 17:28 - 2014-03-07 17:28 - 00987442 _____ () C:\Users\Jonas\Desktop\SecurityCheck.exe
2014-03-07 15:13 - 2014-03-07 15:13 - 02347384 _____ (ESET) C:\Users\Jonas\Downloads\esetsmartinstaller_enu.exe
2014-03-06 15:18 - 2014-03-07 17:33 - 00013448 _____ () C:\Users\Jonas\Desktop\FRST.txt
2014-03-06 15:10 - 2014-03-06 15:10 - 00000000 ____D () C:\Windows\ERUNT
2014-03-06 15:06 - 2014-03-06 15:07 - 00000000 ____D () C:\AdwCleaner
2014-03-06 14:54 - 2014-03-06 14:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-06 14:54 - 2014-03-06 14:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-06 14:54 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-06 14:53 - 2014-03-06 14:54 - 01037734 _____ (Thisisu) C:\Users\Jonas\Desktop\JRT.exe
2014-03-06 14:53 - 2014-03-06 14:53 - 01244192 _____ () C:\Users\Jonas\Desktop\adwcleaner.exe
2014-03-05 14:51 - 2014-03-05 15:06 - 00000000 ____D () C:\Qoobox
2014-03-05 14:51 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-03-05 14:51 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-03-05 14:51 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-03-05 14:51 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-03-05 14:51 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-03-05 14:51 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-03-05 14:51 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-03-05 14:51 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-03-05 14:50 - 2014-03-05 15:04 - 00000000 ____D () C:\Windows\erdnt
2014-03-05 14:50 - 2014-03-05 14:50 - 05186850 ____R (Swearware) C:\Users\Jonas\Desktop\ComboFix.exe
2014-03-03 18:14 - 2014-03-03 18:14 - 00380416 _____ () C:\Users\Jonas\Desktop\Gmer-19357.exe
2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe
2014-03-03 18:09 - 2014-03-07 17:33 - 00000000 ____D () C:\FRST
2014-03-03 16:09 - 2014-03-03 16:10 - 02156544 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe
2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\ProgramData\Sony Mobile
2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\Program Files (x86)\Sony Mobile
2014-03-01 23:45 - 2014-03-01 23:45 - 00142620 _____ () C:\Windows\DPINST.LOG
2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-02-28 22:59 - 2014-02-28 23:01 - 00000000 ____D () C:\Program Files (x86)\Zenimax Online
2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Locktime
2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\ProgramData\Locktime
2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Program Files\NetLimiter 3
2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\system32\NV
2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-19 16:44 - 2014-02-08 19:34 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-02-19 16:44 - 2014-02-08 19:34 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-02-19 16:44 - 2014-02-08 18:42 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-02-19 16:44 - 2014-02-08 18:42 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-02-19 16:44 - 2014-02-08 18:42 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-02-19 16:44 - 2014-02-08 18:42 - 01075488 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2014-02-19 16:44 - 2014-02-08 18:42 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-02-19 16:44 - 2014-02-08 18:42 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-02-19 16:44 - 2014-02-08 18:42 - 00067072 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2014-02-19 16:44 - 2014-02-08 18:42 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-02-19 16:44 - 2014-02-05 18:52 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin
2014-02-19 16:39 - 2014-02-08 19:34 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-02-19 16:39 - 2014-02-08 19:34 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-02-19 16:39 - 2014-02-08 19:34 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2014-02-19 16:39 - 2014-02-08 19:34 - 00024544 _____ () C:\Windows\system32\nvinfo.pb
2014-02-16 12:23 - 2013-12-10 03:15 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-02-16 12:23 - 2013-12-10 03:14 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-02-16 12:22 - 2014-02-16 13:46 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA
2014-02-16 12:18 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-02-16 12:18 - 2013-12-05 09:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll
2014-02-16 12:18 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-02-15 23:55 - 2014-02-15 23:55 - 00017513 _____ () C:\Windows\DirectX.log
2014-02-14 22:10 - 2014-02-14 22:10 - 00000000 ____D () C:\Users\Jonas\Desktop\GCC_pre_C11
2014-02-14 21:17 - 2014-02-14 21:19 - 00000000 ____D () C:\Users\Jonas\.designer
2014-02-06 17:58 - 2013-01-13 22:17 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:17 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:16 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:11 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:11 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 22:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:35 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:35 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:35 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:31 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2014-02-06 17:58 - 2013-01-13 21:31 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:31 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2014-02-06 17:58 - 2013-01-13 21:22 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-06 17:58 - 2013-01-13 21:20 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2014-02-06 17:58 - 2013-01-13 21:09 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2014-02-06 17:58 - 2013-01-13 21:08 - 01504768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2014-02-06 17:58 - 2013-01-13 21:08 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2014-02-06 17:58 - 2013-01-13 20:59 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-02-06 17:58 - 2013-01-13 20:58 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-02-06 17:58 - 2013-01-13 20:54 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2014-02-06 17:58 - 2013-01-13 20:53 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2014-02-06 17:58 - 2013-01-13 20:53 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2014-02-06 17:58 - 2013-01-13 20:51 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-06 17:58 - 2013-01-13 20:49 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2014-02-06 17:58 - 2013-01-13 20:48 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2014-02-06 17:58 - 2013-01-13 20:46 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2014-02-06 17:58 - 2013-01-13 20:43 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-02-06 17:58 - 2013-01-13 20:38 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2014-02-06 17:58 - 2013-01-13 20:38 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-02-06 17:58 - 2013-01-13 20:38 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-02-06 17:58 - 2013-01-13 20:37 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-06 17:58 - 2013-01-13 20:25 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2014-02-06 17:58 - 2013-01-13 20:24 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-02-06 17:58 - 2013-01-13 20:24 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2014-02-06 17:58 - 2013-01-13 20:20 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-02-06 17:58 - 2013-01-13 20:20 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-02-06 17:58 - 2013-01-13 20:15 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-02-06 17:58 - 2013-01-13 20:10 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-06 17:58 - 2013-01-13 20:02 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-02-06 17:58 - 2013-01-13 19:34 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2014-02-06 17:58 - 2013-01-13 19:32 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-02-06 17:58 - 2013-01-13 19:09 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2014-02-06 17:58 - 2013-01-13 18:26 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2014-02-06 17:58 - 2013-01-13 18:05 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2014-02-06 17:58 - 2013-01-04 07:11 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-02-06 17:58 - 2013-01-04 07:11 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-02-06 17:54 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-02-06 17:53 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-02-06 17:53 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2014-02-06 17:53 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-02-06 17:53 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-02-06 17:53 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-02-06 17:53 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-02-06 17:53 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-02-06 17:53 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-02-06 17:53 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-02-06 17:53 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-02-06 17:53 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-02-06 17:53 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-02-06 17:53 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-02-06 17:53 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-02-06 17:53 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-02-06 17:53 - 2013-08-02 03:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-02-06 17:53 - 2013-08-02 03:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-02-06 17:53 - 2013-08-02 03:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-02-06 17:53 - 2013-08-02 03:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-02-06 17:53 - 2013-08-02 03:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-02-06 17:53 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-02-06 17:53 - 2013-08-02 03:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-02-06 17:53 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-02-06 17:53 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-02-06 17:53 - 2013-08-02 02:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-02-06 17:53 - 2013-08-02 02:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-02-06 17:53 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-02-06 17:53 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-02-06 17:53 - 2013-08-02 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2014-02-06 17:53 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-02-06 17:53 - 2013-08-02 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-02-06 17:53 - 2013-08-02 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-02-06 17:53 - 2013-08-02 01:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-02-06 17:53 - 2013-08-02 01:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-02-06 17:53 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2014-02-06 17:53 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2014-02-06 17:53 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-02-06 17:53 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2014-02-06 17:53 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-02-06 17:53 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2014-02-06 17:53 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-02-06 17:53 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-02-06 17:53 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-02-06 17:53 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2014-02-06 17:53 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2014-02-06 17:53 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2014-02-06 17:53 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2014-02-06 17:53 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2014-02-06 17:53 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2014-02-06 17:53 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2014-02-06 17:53 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-02-06 17:53 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2014-02-06 17:53 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2014-02-06 17:53 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2014-02-06 17:53 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-02-06 17:53 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2014-02-06 17:53 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2014-02-06 17:53 - 2013-02-27 07:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-02-06 17:53 - 2013-02-27 06:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-02-06 17:53 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-02-06 17:53 - 2013-02-27 05:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-02-06 17:52 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-02-06 17:52 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-02-06 17:52 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-02-06 17:52 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-02-06 17:52 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-02-06 17:52 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-02-06 17:52 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-02-06 17:52 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-02-06 17:52 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-02-06 17:52 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-02-06 17:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-02-06 17:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-02-06 17:52 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-02-06 17:52 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-02-06 17:52 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-02-06 17:52 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-02-06 17:52 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2014-02-06 17:52 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-02-06 17:52 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2014-02-06 17:52 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-02-06 17:52 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2014-02-06 17:52 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2014-02-06 17:52 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2014-02-06 17:52 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2014-02-06 17:52 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-02-06 17:52 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-02-06 17:52 - 2013-07-06 07:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-02-06 17:52 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-02-06 17:52 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2014-02-06 17:52 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2014-02-06 17:52 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2014-02-06 17:52 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-02-06 17:52 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-02-06 17:52 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-02-06 17:52 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-02-06 17:52 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-02-06 17:52 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-02-06 17:52 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2014-02-06 17:52 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2014-02-06 17:52 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-02-06 17:52 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2014-02-06 17:52 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2014-02-06 17:46 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-02-06 17:46 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-02-06 17:46 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2014-02-06 17:46 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-02-06 17:46 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-02-06 17:46 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-02-06 17:46 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2014-02-06 17:46 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2014-02-06 17:46 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-02-06 17:46 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2014-02-06 17:46 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-02-06 17:45 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2014-02-06 17:45 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-02-06 17:45 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-02-06 17:45 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2014-02-06 17:45 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2014-02-06 17:16 - 2014-03-06 15:02 - 00005574 _____ () C:\Windows\PFRO.log
2014-02-06 17:11 - 2014-02-19 16:44 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-02-06 16:48 - 2014-02-06 16:48 - 00000000 ____D () C:\Program Files\Intel
2014-02-05 19:17 - 2014-02-05 19:17 - 00004500 _____ () C:\Users\Jonas\AppData\Local\recently-used.xbel
2014-02-05 18:39 - 2014-02-05 18:39 - 00069120 ___SH () C:\Users\Jonas\Documents\Thumbs.db
==================== One Month Modified Files and Folders =======
2014-03-07 17:33 - 2014-03-07 17:33 - 00000922 _____ () C:\Users\Jonas\Desktop\checkup.txt
2014-03-07 17:33 - 2014-03-06 15:18 - 00013448 _____ () C:\Users\Jonas\Desktop\FRST.txt
2014-03-07 17:33 - 2014-03-03 18:09 - 00000000 ____D () C:\FRST
2014-03-07 17:28 - 2014-03-07 17:28 - 00987442 _____ () C:\Users\Jonas\Downloads\SecurityCheck.exe
2014-03-07 17:28 - 2014-03-07 17:28 - 00987442 _____ () C:\Users\Jonas\Desktop\SecurityCheck.exe
2014-03-07 15:13 - 2014-03-07 15:13 - 02347384 _____ (ESET) C:\Users\Jonas\Downloads\esetsmartinstaller_enu.exe
2014-03-07 15:13 - 2013-06-10 10:49 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\foobar2000
2014-03-07 14:34 - 2013-10-10 16:52 - 01754614 _____ () C:\Windows\WindowsUpdate.log
2014-03-07 13:58 - 2014-01-31 14:21 - 00009608 _____ () C:\Windows\setupact.log
2014-03-07 11:03 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-07 11:03 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-07 10:56 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-06 17:03 - 2013-05-30 19:56 - 00000000 ____D () C:\Users\Jonas\Desktop\Spiele
2014-03-06 15:35 - 2013-06-10 11:43 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\QtProject
2014-03-06 15:10 - 2014-03-06 15:10 - 00000000 ____D () C:\Windows\ERUNT
2014-03-06 15:07 - 2014-03-06 15:06 - 00000000 ____D () C:\AdwCleaner
2014-03-06 15:02 - 2014-02-06 17:16 - 00005574 _____ () C:\Windows\PFRO.log
2014-03-06 14:54 - 2014-03-06 14:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-06 14:54 - 2014-03-06 14:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-06 14:54 - 2014-03-06 14:53 - 01037734 _____ (Thisisu) C:\Users\Jonas\Desktop\JRT.exe
2014-03-06 14:53 - 2014-03-06 14:53 - 01244192 _____ () C:\Users\Jonas\Desktop\adwcleaner.exe
2014-03-05 20:36 - 2013-11-25 21:10 - 00000000 ____D () C:\Program Files (x86)\JDownloader
2014-03-05 17:08 - 2013-09-20 16:41 - 00000000 ____D () C:\Users\Jonas\Documents\Schule
2014-03-05 15:06 - 2014-03-05 14:51 - 00000000 ____D () C:\Qoobox
2014-03-05 15:06 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2014-03-05 15:04 - 2014-03-05 14:50 - 00000000 ____D () C:\Windows\erdnt
2014-03-05 15:01 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2014-03-05 14:50 - 2014-03-05 14:50 - 05186850 ____R (Swearware) C:\Users\Jonas\Desktop\ComboFix.exe
2014-03-03 20:34 - 2013-05-30 19:56 - 00000000 ___RD () C:\Users\Jonas\Desktop\Alles
2014-03-03 20:09 - 2013-06-19 18:11 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Skype
2014-03-03 18:34 - 2013-05-30 19:38 - 00000000 ____D () C:\Users\Jonas
2014-03-03 18:14 - 2014-03-03 18:14 - 00380416 _____ () C:\Users\Jonas\Desktop\Gmer-19357.exe
2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe
2014-03-03 16:11 - 2013-07-17 20:34 - 00000000 ____D () C:\Program Files (x86)\Ubisoft
2014-03-03 16:10 - 2014-03-03 16:09 - 02156544 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe
2014-03-03 15:23 - 2013-07-03 14:55 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\.minecraft
2014-03-02 20:56 - 2013-07-11 13:28 - 00000000 ____D () C:\Users\Jonas\AppData\Local\JDownloader v2.0
2014-03-02 17:45 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\ProgramData\Sony Mobile
2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\Program Files (x86)\Sony Mobile
2014-03-01 23:45 - 2014-03-01 23:45 - 00142620 _____ () C:\Windows\DPINST.LOG
2014-03-01 23:45 - 2013-05-30 20:09 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online
2014-02-28 23:01 - 2014-02-28 22:59 - 00000000 ____D () C:\Program Files (x86)\Zenimax Online
2014-02-28 22:49 - 2013-07-24 23:27 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\TS3Client
2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Locktime
2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\ProgramData\Locktime
2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Program Files\NetLimiter 3
2014-02-25 19:54 - 2013-05-31 14:53 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-02-24 21:37 - 2013-11-22 18:42 - 00000000 ____D () C:\ProgramData\tmp
2014-02-23 17:48 - 2013-06-22 20:49 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Windows Live
2014-02-21 19:03 - 2013-12-09 22:16 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-02-21 19:02 - 2013-12-09 22:16 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Battle.net
2014-02-21 19:02 - 2013-05-31 13:24 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\NVIDIA
2014-02-19 22:17 - 2013-06-13 14:32 - 00000000 ____D () C:\ProgramData\Origin
2014-02-19 22:16 - 2013-06-13 14:32 - 00000000 ____D () C:\Program Files (x86)\Origin
2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\system32\NV
2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-19 16:44 - 2014-02-06 17:11 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-02-19 16:44 - 2013-08-13 17:01 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-02-19 16:44 - 2013-05-30 21:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-02-19 15:20 - 2013-05-30 20:18 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\ftblauncher
2014-02-16 16:37 - 2009-07-14 18:58 - 00702388 _____ () C:\Windows\system32\perfh007.dat
2014-02-16 16:37 - 2009-07-14 18:58 - 00151022 _____ () C:\Windows\system32\perfc007.dat
2014-02-16 16:37 - 2009-07-14 06:13 - 01628890 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-16 13:46 - 2014-02-16 12:22 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA
2014-02-16 12:27 - 2013-11-04 14:43 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA Corporation
2014-02-15 23:55 - 2014-02-15 23:55 - 00017513 _____ () C:\Windows\DirectX.log
2014-02-15 18:45 - 2013-06-13 14:34 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Origin
2014-02-15 17:30 - 2013-06-13 14:34 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-02-15 14:48 - 2013-08-02 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-02-14 22:10 - 2014-02-14 22:10 - 00000000 ____D () C:\Users\Jonas\Desktop\GCC_pre_C11
2014-02-14 21:19 - 2014-02-14 21:17 - 00000000 ____D () C:\Users\Jonas\.designer
2014-02-14 21:08 - 2014-01-29 23:02 - 00000000 ____D () C:\Program Files (x86)\osu!
2014-02-14 14:41 - 2013-10-11 16:30 - 00000000 ____D () C:\ProgramData\VMware
2014-02-12 16:10 - 2013-08-01 16:38 - 00000000 ____D () C:\Users\Jonas\Documents\Bewerbungen
2014-02-09 01:16 - 2013-06-27 14:29 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Notepad++
2014-02-08 19:34 - 2014-02-19 16:44 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2014-02-08 19:34 - 2014-02-19 16:44 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-02-08 19:34 - 2014-02-19 16:39 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2014-02-08 19:34 - 2014-02-19 16:39 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2014-02-08 19:34 - 2014-02-19 16:39 - 00024544 _____ () C:\Windows\system32\nvinfo.pb
2014-02-08 18:42 - 2014-02-19 16:44 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2014-02-08 18:42 - 2014-02-19 16:44 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2014-02-08 18:42 - 2014-02-19 16:44 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2014-02-08 18:42 - 2014-02-19 16:44 - 01075488 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll
2014-02-08 18:42 - 2014-02-19 16:44 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2014-02-08 18:42 - 2014-02-19 16:44 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2014-02-08 18:42 - 2014-02-19 16:44 - 00067072 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll
2014-02-08 18:42 - 2014-02-19 16:44 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2014-02-08 16:31 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-02-07 22:39 - 2014-01-11 16:38 - 00000000 ____D () C:\Projects
2014-02-06 20:29 - 2014-01-31 10:14 - 00000000 ____D () C:\Program Files (x86)\Dragon's Prophet
2014-02-06 19:47 - 2013-05-30 19:39 - 00000000 ___RD () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-02-06 19:47 - 2013-05-30 19:39 - 00000000 ___RD () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-02-06 19:45 - 2009-07-14 05:45 - 00415056 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-06 19:42 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal
2014-02-06 19:42 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender
2014-02-06 19:42 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK
2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR
2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\zh-HK
2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\tr-TR
2014-02-06 18:19 - 2013-05-31 12:49 - 01603170 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-02-06 18:11 - 2013-05-30 20:01 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-02-06 17:57 - 2013-10-21 19:25 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-06 17:02 - 2013-07-22 11:09 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll
2014-02-06 16:48 - 2014-02-06 16:48 - 00000000 ____D () C:\Program Files\Intel
2014-02-06 16:29 - 2013-07-22 11:31 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab
2014-02-05 19:17 - 2014-02-05 19:17 - 00004500 _____ () C:\Users\Jonas\AppData\Local\recently-used.xbel
2014-02-05 19:17 - 2013-08-21 17:38 - 00000000 ____D () C:\Users\Jonas\AppData\Local\gtk-2.0
2014-02-05 19:17 - 2013-07-26 16:54 - 00000000 ____D () C:\Users\Jonas\.gimp-2.8
2014-02-05 18:52 - 2014-02-19 16:44 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin
2014-02-05 18:39 - 2014-02-05 18:39 - 00069120 ___SH () C:\Users\Jonas\Documents\Thumbs.db
2014-02-05 17:29 - 2013-05-30 19:43 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Google
2014-02-05 17:29 - 2013-05-30 19:43 - 00000000 ____D () C:\Program Files (x86)\Google
Some content of TEMP:
====================
C:\Users\Jonas\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-03-01 01:20
==================== End Of Log ============================
svchost brauch immer noch so um die 170.000K Arbeitsspeicher. |
|
08.03.2014, 16:32
| #12 |
| /// the machine /// TB-Ausbilder | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Neuer Screenshot von Process Explorer bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
08.03.2014, 21:30
| #13 |
| | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Hoffe ich hab alles wichtige drauf. |
|
09.03.2014, 18:40
| #14 |
| /// the machine /// TB-Ausbilder | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.03.2014, 21:38
| #15 |
| | Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Hab jetzt ein bisschen beobachtet. Wenn ich es umstelle ohne neuzustarten verändert sich nichts. Nach dem Neustart mit Klassik bin ich bei ca 80.000K. Wenn ich nun wieder auf Win7 umstelle hab ich immer noch 80.000K. Wenn ich neustarte mit Win7 hab ich auch 80.000K. Wenn ich mein Pc um ca 15 Uhr an machen und um 21 Uhr drauf schaue bin ich von 80.000K bei fast 170.000K also mehr als doppelt so viel. Kann es sein das mein "lieblings" Betriebssystem wieder so richtig geil drauf ist? |
|
| Themen zu Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram |
| adobe, adware.agent, aufräumen, converter, helper, homepage, iexplore.exe, installation, prozess, pup.optional.iminent.a, pup.optional.monetizer, realtek, registry, rundll, scan, services.exe, software, svchost, svchost.exe, system, trojaner, viren, windows xp, wlansvc |
WARNUNG an die MITLESER: 
Linear-Darstellung
