Windows 7: Sweet Page Virus durch falsche Microsoft%20Word.exe

LordDampf · 21.10.2014, 15:38

Guten Tag,

meine Schwester hat mir ihren verseuchten Laptop angeschleppt und ich versuche ihn zu reinigen. Malwarebytes und AdwCleaner habe ich schon rüberlaufen lassen, aber da ich selber auch keine Erfahrung mit dem Reinigen habe, will ich hier um Hilfe bitten.

Hintergrund:
Meine Schwester wollte am 12.10.14 eine Word-Datei öffnen. Sie hat aber nur Open Office und wusste nicht, wie sie damit die Datei öffnen soll. Sie kam auf die Idee, dass sie sich "mal eben schnell Word installiert" und im Internet danach gesucht. Sie hat zwar was gefunden, aber wie ihr euch sicherlich denken könnt, nicht das richtige. (Von einer Seite, vor der WOT schon gewarnt hat.

)

Störung:
Es wurde unter Anderem eine Toolbar in Firefox installiert, die sie aber schon entfernt hat. Überhaupt hat sie wohl schon einige Sachen danach wieder deinstalliert, aber eben nicht alles. Als Sie mir den Laptop gegeben hat gab es noch folgende Probleme. Als Startseite von Firefox kam "sweet-page.com". Als neuer Tab wurde immer eine falsche Google Seite gestartet. In gewissen Abständen wurden autmatisch neue Tabs mit Werbung geöffnet. Der Rechner war beim starten viel zu langsam.

Bisherige Maßnahmen:
Wie bereits erwähnt hat meine Schwester bereits ihr auffällige Programme gelöscht (z.B. die Toolbar). Ich habe Malwarebytes rüberlaufen lassen. Dabei wurden 32 Probleme gefunden und gelöscht.

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Scan Date: 19.10.2014
Scan Time: 20:02:22
Logfile: Anti-Maleware Log 1.txt
Administrator: Yes

Version: 2.00.3.1025
Malware Database: v2014.09.19.05
Rootkit Database: v2014.10.17.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: Maria

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 347695
Time Elapsed: 18 min, 10 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 1
PUP.Optional.WindowsProtectManger.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, 1480, , [443dcb247dfee353584e941e2dd4718f]

Modules: 0
(No malicious items detected)

Registry Keys: 9
PUP.Optional.WindowsProtectManger.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\WindowsMangerProtect, , [443dcb247dfee353584e941e2dd4718f], 
PUP.Optional.WindowsProtectManger.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\WindowsMangerProtect, , [443dcb247dfee353584e941e2dd4718f], 
PUP.Optional.MBot.A, HKLM\SOFTWARE\WOW6432NODE\MYBESTOFFERSTODAY, , [067b0de21a61c175b8839773ef14738d], 
PUP.Optional.WPM.A, HKLM\SOFTWARE\WOW6432NODE\supWindowsMangerProtect, , [4e3305eaa3d8270f1de9b7b83acad927], 
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\sweet-pageSoftware, , [3d4442ad0a712a0cf97f9ac90ef624dc], 
PUP.Optional.VOPackage, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPACKAGE, , [b9c8d11e592259ddd6ace03045be6a96], 
PUP.Optional.Tuto4PC.A, HKU\S-1-5-21-2583589074-1064548776-3707576087-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\TutoTag, , [f19068876b1077bf1b45452dff05f808], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2583589074-1064548776-3707576087-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE\1I1T1Q1S, , [3d4477782a51d165950380b843c02fd1], 
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2583589074-1064548776-3707576087-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE, , [aad789660a7145f125d3252925df5ba5], 

Registry Values: 3
PUP.Optional.MBot.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|mbot_de_145, , [4a37618eea91a393d66443c7d82ba060], 
PUP.Optional.VOPackage, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\VOPACKAGE|UninstallString, "C:\Users\Maria\AppData\Roaming\VOPackage\uninstall.exe", , [b9c8d11e592259ddd6ace03045be6a96]
PUP.Optional.InstallCore.A, HKU\S-1-5-21-2583589074-1064548776-3707576087-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\INSTALLCORE|tb, 0V1D1S1R1D0V1O, , [aad789660a7145f125d3252925df5ba5]

Registry Data: 6
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365),,[e1a06788abd01323ab7419edaa5bbc44]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}),,[7d04955ac6b53df948d97b8b897c51af]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}),,[afd2b8375c1f7bbb38c9ba41010347b9]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND, C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365, Good: (iexplore.exe), Bad: (C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.sweet-page.com/?type=sc&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365),,[82fff8f73d3ef73fa57aa75ff80d19e7]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Search_URL, hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}),,[d4adf1feb6c595a165bc8482d43138c8]
PUP.Optional.SweetPage.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Search Page, hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}, Good: (www.google.com), Bad: (hxxp://www.sweet-page.com/web/?type=ds&ts=1413132027&from=cor&uid=WDCXWD3200BPVT-22JJ5T0_WD-WX91C12H6365H6365&q={searchTerms}),,[82ff9a55ee8db77f1fe2c9328282f50b]

Folders: 4
PUP.Optional.VOPackage, C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage, , [d0b11dd25c1faf87a6dd5bb5f310a55b], 
PUP.Optional.MindSpark.A, C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\wu44glma.default\Allin1Convert_8h, , [9ce57e713348d75ffb49627d60a2e21e], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect, , [99e8559a6615290d936dde1038ca2ad6], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update, , [99e8559a6615290d936dde1038ca2ad6], 

Files: 9
PUP.Optional.WindowsProtectManger.A, C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe, , [443dcb247dfee353584e941e2dd4718f], 
PUP.Optional.ShopHelper, C:\Users\Maria\AppData\Local\Temp\SHelp2.exe, , [4f32dd12ec8f26108eb7265f15ed916f], 
PUP.Optional.SnapDo.A, C:\Users\Maria\AppData\Local\Temp\26999\17070.msi, , [3e4312dd86f5b6802133207434cdb848], 
PUP.Optional.Installcore, C:\Users\Maria\AppData\Local\Temp\nst58CA.tmp\nsvmd.dll, , [b8c98d6286f52115aa9410b7f30e5ea2], 
PUP.Optional.Wajam, C:\Users\Maria\AppData\Local\Temp\nst58CA.tmp\OurChecker.exe, , [2958a946e19acc6a5e2c166b6b9720e0], 
PUP.Optional.VOPackage, C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage\Configure.lnk, , [d0b11dd25c1faf87a6dd5bb5f310a55b], 
PUP.Optional.MindSpark.A, C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\wu44glma.default\searchplugins\ask-web-search.xml, , [1869fbf4b2c9a98da62a61bb917206fa], 
PUP.Optional.VOPackage.A, C:\Users\Maria\AppData\Roaming\VOPackage\VOPackage.exe, , [107158973a41d660b4180918cb38fc04], 
PUP.Optional.WPM.A, C:\ProgramData\WindowsMangerProtect\update\conf, , [99e8559a6615290d936dde1038ca2ad6], 

Physical Sectors: 0
(No malicious items detected)


(end)

Anschließend ließ ich AdwCleaner rüberlaufen. Davon habe ich aber kein Log (zumindest weiß ich nicht wo da Programm die vielleicht von alleine abspeichert). CCleaner habe ich dann auch noch ausproboert und der hat wohl viele Fehler in der Registry gefunden, wobei einige Rückstände von den ungeollten Programmen waren. Dann habe ich heute, nachdem Malwarebytes endlich das aktuelle Update gezogen hat, einen erneuten Scan durchgeführt.

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.10.2014
Suchlauf-Zeit: 12:24:20
Logdatei: Anti-Maleware Log 2.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.10.21.04
Rootkit Datenbank: v2014.10.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Maria

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 351548
Verstrichene Zeit: 27 Min, 8 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 1
PUP.Optional.Solimba, C:\Users\Maria\Downloads\Microsoft%20Word.exe, , [fd5a7c9b611be4525a354b86b44d22de], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

Dabei hat er nur noch eine böse Datei gefunden und das ist diejenige, die sich meine Schwester ursprünglich runtergeladen hat. An diesem Punkt habe ich beschlossen mich an euch zu wenden und habe die Anleitung befolgt (zumindest glaube ich das). Die Datei habe ich noch nicht gelöscht, falls ihr noch etwas damit anfangen könnt. Die Datei ist 538 KB groß und hat eine sehr "vertrauenserweckende Beschreibung". Dateibeschreibung: equus domina vessco; Produktname: promissio renunito ferrum XXXVIII-I; Copyright: Scrinium tenus dexter aqua; Name des Signaturgebers: Condestil Developments, s.l.; Zeitstempel: Freitag, 10. Oktober 2014 14:01:32

Hier die verlangten Logs (defogger, FRST, Addition und gmer) musste ich aufgrund der Länge als zip-Datei anhängen.

Als Antivirensoftware ist Symantec Endpoint Protection installiert. Allerdings scheint das bei der besagte Datei nicht angeschlagen zu haben oder meiner Schwester hat es ignoriert. Dafür schlug es bei den vom Forum empfohlenen Programmen Alarm. Die Protokolle von Symantec habe ich csv-Datein exportiert und auch als zip-Datei angehängt, falls ihr sie benötigt.
Außerdem kommt von Symantec immer wieder das "svchost.exe" blockiert wurde. (?)

Es wäre gut, wenn mir noch heute jemand antworten könnte, da ich nur noch heute den Laptop von meiner Schwester habe und danach ihr nur noch Anweisungen geben kann.

Vielen Dank schon mal.

Grüße,
LordDampf

schrauber · 21.10.2014, 15:55

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

LordDampf · 21.10.2014, 16:12

1. defogger:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:05 on 21/10/2014 (Maria)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

2. gmer Teil 1:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-21 13:51:10
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.01.0 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Maria\AppData\Local\Temp\kwlyipow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                   fffff800031af000 8 bytes [00, 00, 1C, 02, 45, 74, 77, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 666                                                                                                                                                   fffff800031af08a 6 bytes [00, 00, 00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                        00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                    00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                      0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                  0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                             0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                         0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                               0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                           0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                               0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                           0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                       00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                   00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                            00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                     0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                 0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                    00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                              0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                          0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                     0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                 0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                      0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                  0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                 0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                             0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                      0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                  0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\services.exe[712] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                      0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                         00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                     00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                       0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                   0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                              0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                          0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                            0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                                0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                            0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                        00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                    00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                 00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                             00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                      0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                  0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                     00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                 00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                               0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                           0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                      0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                  0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                       0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                   0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                  0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                              0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                       0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                   0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[116] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                       0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                         00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                     00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                       0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                   0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                              0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                          0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                            0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                                0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                            0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                        00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                    00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                 00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                             00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                      0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                  0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                     00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                 00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                               0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                           0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                      0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                  0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                       0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                   0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                  0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                              0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                       0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                   0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[528] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                       0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                         00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                     00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                       0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                   0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                              0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                          0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                            0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                                0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                            0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                        00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                    00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                 00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                             00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                      0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                  0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                     00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                 00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                               0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                           0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                      0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                  0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                       0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                   0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                  0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                              0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                       0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                   0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[512] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                       0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                         00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                     00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                       0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                   0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                              0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                          0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                            0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                                0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                            0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                        00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                    00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                 00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                             00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                      0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                  0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                     00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                 00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                               0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                           0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                      0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                  0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                       0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                   0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                  0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                              0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                       0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                   0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[788] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                       0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                               00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                           00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                             0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                         0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                    0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                      0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                  0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                      0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                  0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                              00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                          00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                       00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                   00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                            0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                        0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                           00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                       00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                     0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                 0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                            0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                        0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                             0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                         0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                        0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                    0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                             0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                         0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1180] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                             0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                        00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                    00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                      0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                  0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                             0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                         0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                               0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                           0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                               0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                           0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                       00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                   00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                            00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                     0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                 0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                    00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                              0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                          0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                     0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                 0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                      0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                  0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                 0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                             0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                      0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                  0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1392] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                      0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                        00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                    00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                      0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                  0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                             0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                         0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                               0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                           0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                               0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                           0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                       00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                   00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                            00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                     0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                 0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                    00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                              0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                          0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                     0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                 0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                      0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                  0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                 0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                             0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                      0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                  0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\svchost.exe[1636] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                      0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[1496] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                        0000000075351465 2 bytes [35, 75]
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[1496] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                       00000000753514bb 2 bytes [35, 75]
.text     ...

LordDampf · 21.10.2014, 16:13

2. gmer Teil 2

Code:

ATTFilter

.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                       00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                   00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                     0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                 0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                            0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                        0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                              0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                          0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                              0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                          0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                      00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                  00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                               00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                           00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                    0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                   00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                               00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                             0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                         0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                    0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                     0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                 0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                            0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                     0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                 0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\taskhost.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                     0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                                00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                            00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                              0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                          0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                                     0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                                 0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                       0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                                   0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                                       0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                                   0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                               00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                           00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                        00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                                    00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                             0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                         0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                            00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                        00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                                      0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                                  0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                             0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                         0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                              0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                          0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                         0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                                     0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                              0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                          0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\Explorer.EXE[2156] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                              0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                  00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                              00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                            0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                       0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                   0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                         0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                     0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                         0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                     0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                 00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                             00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                          00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                      00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                               0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                           0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                              00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                          00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                        0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                    0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                               0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                           0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                            0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                           0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                       0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                            0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\wbem\wmiprvse.exe[2540] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                 00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                             00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                               0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                           0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                      0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                  0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                        0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                    0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                        0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                    0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                            00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                         00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                     00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                              0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                          0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                             00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                         00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                       0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                   0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                              0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                          0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                               0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                           0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                          0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                      0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                               0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                           0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3556] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                               0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                        00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                    00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                      0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                  0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                             0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                         0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                               0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                           0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                               0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                           0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                       00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                   00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                            00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                     0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                 0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                    00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                              0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                          0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                     0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                 0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                      0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                  0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                 0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                             0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                      0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                  0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[3772] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                      0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                            00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                        00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                          0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                      0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                 0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                             0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                   0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                               0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                   0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                               0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                           00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                       00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                    00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                         0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                     0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                        00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                    00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                  0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                              0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                         0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                     0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                          0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                      0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                     0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                 0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                          0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                      0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[3796] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                          0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                       00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                   00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                     0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                 0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                            0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                        0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                              0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                          0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                              0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                          0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                      00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                  00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                               00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                           00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                    0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                   00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                               00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                             0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                         0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                    0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                     0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                 0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                            0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                     0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                 0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\igfxsrvc.exe[3812] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                     0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3420] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                       0000000075351465 2 bytes [35, 75]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3420] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                      00000000753514bb 2 bytes [35, 75]
.text     ...                                                                                                                                                                                                                  * 2
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                  00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                              00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                            0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                       0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                   0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                         0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                     0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                         0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                     0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                 00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                             00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                          00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                      00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                               0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                           0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                              00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                          00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                        0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                    0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                               0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                           0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                            0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                           0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                       0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                            0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\system32\SearchIndexer.exe[5028] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                        00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                    00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                      0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                  0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                             0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                         0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                               0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                           0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                               0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                           0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                       00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                   00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                            00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                     0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                 0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                    00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                              0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                          0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                     0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                 0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                      0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                  0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                 0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                             0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                      0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                  0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4628] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                      0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey                                                                                                                                        00000000770613d0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKey + 6                                                                                                                                    00000000770613d6 8 bytes [F5, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey                                                                                                                                      0000000077061480 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateKey + 6                                                                                                                                  0000000077061486 8 bytes [8D, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                                                                                                                             0000000077061520 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 6                                                                                                                         0000000077061526 8 bytes [E5, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                               0000000077061530 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 6                                                                                                                           0000000077061536 8 bytes [7D, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                                                                               0000000077061570 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess + 6                                                                                                                           0000000077061576 8 bytes [5D, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                                                                                                                       00000000770615e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 6                                                                                                                                   00000000770615e6 8 bytes [B9, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                                                                                                                00000000770617e0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread + 6                                                                                                                            00000000770617e6 8 bytes [99, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                                                                                                                     0000000077061800 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 6                                                                                                                                 0000000077061806 8 bytes [51, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey                                                                                                                                    00000000770618b0 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey + 6                                                                                                                                00000000770618b6 8 bytes [21, 36, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess                                                                                                                              0000000077061d80 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtCreateUserProcess + 6                                                                                                                          0000000077061d86 8 bytes [C9, 33, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile                                                                                                                                     0000000077061e00 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteFile + 6                                                                                                                                 0000000077061e06 8 bytes [05, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey                                                                                                                                      0000000077061e10 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteKey + 6                                                                                                                                  0000000077061e16 8 bytes [6D, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey                                                                                                                                 0000000077061e40 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey + 6                                                                                                                             0000000077061e46 8 bytes [41, 34, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx                                                                                                                                      0000000077062200 5 bytes [FF, 15, 00, 00, 00]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtOpenKeyEx + 6                                                                                                                                  0000000077062206 8 bytes [31, 35, B7, 74, 00, 00, 00, ...]
.text     C:\Windows\System32\svchost.exe[4416] C:\Windows\SYSTEM32\ntdll.dll!NtRenameKey                                                                                                                                      0000000077062690 14 bytes {CALL QWORD [RIP+0x0]}
---- Processes - GMER 2.1 ----

Library   C:\Users\Maria\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe [3992](2014-09-13 00:20:58)                                                0000000003eb0000
Library   c:\users\maria\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpxuk1so.dll (*** suspicious ***) @ C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe [3992](2014-10-19 20:37:21)  00000000042f0000
Library   C:\Users\Maria\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe [3992](2013-08-23 19:01:44)                                                      000000006b3a0000
Library   C:\Users\Maria\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe [3992] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42)                        000000006aa10000

---- EOF - GMER 2.1 ----

LordDampf · 21.10.2014, 16:29

3. FRST:

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-10-2014
Ran by Maria (administrator) on MARIA-LAPTOP on 21-10-2014 13:20:05
Running from C:\Users\Maria\Downloads\AntiViren Schutzprogramm
Loaded Profiles: UpdatusUser & Maria (Available profiles: UpdatusUser & Maria)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\ccSvcHst.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\Smc.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Dropbox, Inc.) C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Welcome Center\OEMWelcomeCenter.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SEP-x32: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\WinLogoutNotifier.dll [X]
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2583589074-1064548776-3707576087-1001\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2551656 2012-01-31] (Hewlett-Packard Co.)
HKU\S-1-5-21-2583589074-1064548776-3707576087-1001\...\MountPoints2: E - E:\LaunchU3.exe -a
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [241984 2011-11-27] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [203072 2011-11-27] (NVIDIA Corporation)
Startup: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - .lnk
ShortcutTarget: Tintenwarnungen überwachen - .lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKCU - {62138DFD-0115-4013-BCF6-29AA28BCEF8C} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=0C58EFC5-AF2D-4A05-BC98-61064DE4EF08&apn_sauid=0ABB4152-3ADB-48FE-8EA3-A138799CBAEB
BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\bin\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-10-19]
FF Extension: Adblock Plus - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-19]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-10-19]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\IPSFF
FF Extension: Symantec Intrusion Prevention - C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\IPSFF [2013-10-03]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 SepMasterService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\ccSvcHst.exe [137208 2012-09-07] (Symantec Corporation)
R3 SmcService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\Smc.exe [2601544 2012-09-07] (Symantec Corporation)
S3 SNAC; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\snac64.exe [325040 2012-09-07] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\BASHDefs\20141003.013\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-17] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-17] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\IPSDefs\20141015.001\IDSvia64.sys [525016 2014-05-13] (Symantec Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-21] (Malwarebytes Corporation)
R3 NAVENG; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs\20141016.003\ENG64.SYS [129752 2014-08-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs\20141016.003\EX64.SYS [2137304 2014-08-22] (Symantec Corporation)
R1 SRTSP; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SRTSP64.SYS [678008 2012-09-07] (Symantec Corporation)
R1 SRTSPX; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SRTSPX64.SYS [39032 2012-09-07] (Symantec Corporation)
S3 SyDvCtrl; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\SyDvCtrl64.sys [29664 2012-09-07] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMDS64.SYS [451192 2012-09-07] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMEFA64.SYS [932472 2012-09-07] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-09-07] (Symantec Corporation)
R1 SymIRON; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\Ironx64.SYS [171128 2012-09-07] (Symantec Corporation)
R1 SYMNETS; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMNETS.SYS [386168 2012-09-07] (Symantec Corporation)
R1 SysPlant; C:\Windows\System32\Drivers\SysPlant.sys [119816 2012-09-07] (Symantec Corporation)
R1 Teefer2; C:\Windows\System32\DRIVERS\Teefer.sys [62672 2012-09-07] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-21 13:19 - 2014-10-21 13:20 - 00000000 ____D () C:\FRST
2014-10-21 13:05 - 2014-10-21 13:05 - 00000000 _____ () C:\Users\Maria\defogger_reenable
2014-10-19 22:36 - 2014-10-19 22:36 - 00000056 _____ () C:\Windows\setupact.log
2014-10-19 22:36 - 2014-10-19 22:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-19 22:10 - 2014-10-19 22:11 - 00000000 ____D () C:\Users\Maria\Documents\Sicherung Registry
2014-10-19 22:07 - 2014-10-19 22:07 - 00001278 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2014-10-19 22:07 - 2014-10-19 22:07 - 00001266 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk
2014-10-19 22:07 - 2014-10-19 22:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2014-10-19 22:07 - 2014-10-19 22:07 - 00000000 ____D () C:\Program Files (x86)\Glarysoft
2014-10-19 21:59 - 2014-10-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-19 21:57 - 2014-10-19 21:57 - 00000000 ____D () C:\Users\Maria\Desktop\Alte Firefox-Daten
2014-10-19 21:37 - 2014-10-19 21:41 - 00000000 ____D () C:\AdwCleaner
2014-10-19 20:51 - 2014-10-19 20:52 - 00000000 ____D () C:\Users\Maria\Documents\Protkolle
2014-10-19 18:34 - 2014-10-21 12:24 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-19 18:33 - 2014-10-19 18:33 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-19 18:33 - 2014-10-19 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-19 18:33 - 2014-10-19 18:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-19 18:33 - 2014-10-19 18:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-19 18:33 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-19 18:33 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-19 18:33 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-16 19:48 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 19:48 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-16 19:47 - 2014-07-17 04:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 19:47 - 2014-07-17 04:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 19:47 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 19:47 - 2014-07-17 03:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-16 19:47 - 2014-07-17 03:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-16 19:47 - 2014-07-17 03:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-16 19:47 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 19:47 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 19:47 - 2014-07-17 03:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 19:47 - 2014-07-17 03:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 19:47 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-10-16 19:47 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-10-16 19:47 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-10-16 19:47 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-10-16 19:44 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 19:44 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 19:44 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 19:44 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 19:44 - 2014-09-19 03:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 19:44 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 19:44 - 2014-09-19 03:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 19:44 - 2014-09-19 03:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 19:44 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 19:44 - 2014-09-19 03:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 19:44 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 19:44 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 19:44 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 19:44 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 19:44 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 19:44 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 19:44 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 19:43 - 2014-10-07 04:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 19:43 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 19:43 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 19:43 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 19:43 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 19:43 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 19:43 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 19:43 - 2014-09-19 03:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 19:43 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 19:43 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 19:43 - 2014-09-19 03:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 19:43 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 19:43 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 19:43 - 2014-09-19 03:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 19:43 - 2014-09-19 03:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 19:43 - 2014-09-19 03:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 19:43 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 19:43 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 19:43 - 2014-09-19 03:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 19:43 - 2014-09-19 03:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 19:43 - 2014-09-19 03:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 19:43 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 19:43 - 2014-09-19 03:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 19:43 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 19:43 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 19:43 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 19:43 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 19:43 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 19:43 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 19:43 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 19:43 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 19:43 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 19:43 - 2014-09-19 02:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 19:43 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 19:43 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 19:43 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 19:43 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 19:43 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 19:43 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 19:43 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 19:39 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 19:39 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-13 18:04 - 2014-10-13 18:04 - 00252788 _____ () C:\Users\Maria\Documents\niere10.odt
2014-10-13 18:01 - 2014-10-13 18:01 - 00280783 _____ () C:\Users\Maria\Documents\niere 9.odt
2014-10-13 17:56 - 2014-10-13 17:56 - 00623667 _____ () C:\Users\Maria\Documents\niere 8.odt
2014-10-13 17:52 - 2014-10-13 17:52 - 00155395 _____ () C:\Users\Maria\Documents\niere 7.odt
2014-10-12 19:40 - 2014-10-12 19:40 - 00627560 _____ (CMI Limited) C:\Users\Maria\AppData\Local\nsg49A0.tmp
2014-10-12 19:40 - 2014-10-12 19:40 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\ap_movie
2014-10-12 18:43 - 2014-10-12 18:43 - 00301608 _____ (VuuPC Limited) C:\Users\Maria\AppData\Local\nsqCA34.tmp
2014-10-12 18:40 - 2014-10-12 18:40 - 00000000 ____D () C:\ProgramData\Xunlei
2014-10-12 18:40 - 2014-10-12 18:40 - 00000000 ____D () C:\ProgramData\Thunder Network
2014-10-12 18:31 - 2014-10-12 18:31 - 00000000 __SHD () C:\Users\Maria\AppData\Local\EmieUserList
2014-10-12 18:31 - 2014-10-12 18:31 - 00000000 __SHD () C:\Users\Maria\AppData\Local\EmieSiteList
2014-10-12 18:30 - 2014-10-12 18:30 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\QuickScan
2014-10-12 18:27 - 2014-10-12 18:27 - 00551696 _____ (Traiectensium) C:\Users\Maria\Downloads\Microsoft%20Word.exe
2014-10-12 13:22 - 2014-10-12 15:52 - 00012178 _____ () C:\Users\Maria\Documents\nierenersatztherapie.odt
2014-10-12 11:02 - 2014-10-12 11:05 - 00029694 _____ () C:\Users\Maria\Documents\skills bilder.odt
2014-10-11 13:05 - 2014-10-13 18:26 - 00024072 _____ () C:\Users\Maria\Documents\embryonal.odt
2014-10-11 00:56 - 2014-10-13 19:30 - 00017654 _____ () C:\Users\Maria\Documents\inhalt.odt
2014-10-10 22:59 - 2014-10-13 21:17 - 00019336 _____ () C:\Users\Maria\Documents\sterben.odt
2014-10-10 21:07 - 2014-10-11 15:46 - 00018393 _____ () C:\Users\Maria\Documents\waldeck 2.odt
2014-10-10 19:29 - 2014-10-11 15:26 - 00021063 _____ () C:\Users\Maria\Documents\Aids.odt
2014-10-10 16:25 - 2014-10-13 18:28 - 00023647 _____ () C:\Users\Maria\Documents\blutspende.odt
2014-10-10 15:57 - 2014-10-10 15:57 - 00019713 _____ () C:\Users\Maria\Documents\psych 4.odt
2014-10-10 14:57 - 2014-10-13 17:50 - 00025151 _____ () C:\Users\Maria\Documents\psycho.odt
2014-10-10 12:55 - 2014-10-10 12:55 - 00168602 _____ () C:\Users\Maria\Documents\geburtshaus 4.odt
2014-10-10 12:53 - 2014-10-10 12:53 - 00362557 _____ () C:\Users\Maria\Documents\geburtshaus 3.odt
2014-10-10 12:47 - 2014-10-10 12:47 - 00221659 _____ () C:\Users\Maria\Documents\kopie geburtshaus 2.odt
2014-10-10 12:37 - 2014-10-10 12:37 - 00364298 _____ () C:\Users\Maria\Documents\kopie geburtshaus.odt
2014-10-08 12:15 - 2014-10-08 12:15 - 00023688 _____ () C:\Users\Maria\Documents\waldeck.odt
2014-10-08 11:58 - 2014-10-10 13:24 - 00204216 _____ () C:\Users\Maria\Documents\geburtshauds.odt
2014-10-07 16:30 - 2014-10-11 15:17 - 00028080 _____ () C:\Users\Maria\Documents\klärwerk.odt
2014-10-06 09:18 - 2014-10-13 17:41 - 00019092 _____ () C:\Users\Maria\Documents\forensik.odt
2014-10-06 09:18 - 2014-10-12 10:49 - 00017853 _____ () C:\Users\Maria\Documents\skills quellen.odt
2014-09-27 10:34 - 2014-07-25 12:49 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-09-27 10:33 - 2014-09-27 10:33 - 00004715 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log
2014-09-27 10:33 - 2014-07-25 12:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-09-27 10:33 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-09-27 10:33 - 2014-07-25 12:49 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-09-22 21:09 - 2014-09-22 21:11 - 00000032 _____ () C:\ProgramData\PS.log
2014-09-22 20:55 - 2014-09-22 20:55 - 00002772 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2014-09-22 20:55 - 2014-09-22 20:55 - 00000826 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-09-22 20:55 - 2014-09-22 20:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-09-22 20:55 - 2014-09-22 20:55 - 00000000 ____D () C:\Program Files\CCleaner

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-21 13:20 - 2012-09-07 19:23 - 00000000 ____D () C:\Users\Maria\Downloads\AntiViren Schutzprogramm
2014-10-21 13:20 - 2012-03-21 12:34 - 01881521 _____ () C:\Windows\WindowsUpdate.log
2014-10-21 13:08 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-21 13:08 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-21 13:05 - 2013-01-27 19:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-21 13:05 - 2012-09-07 16:39 - 00000000 ____D () C:\Users\Maria
2014-10-19 22:37 - 2013-11-18 20:11 - 00000000 ___RD () C:\Users\Maria\Dropbox
2014-10-19 22:37 - 2013-11-18 20:06 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\Dropbox
2014-10-19 22:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-19 22:35 - 2012-11-24 23:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-19 21:53 - 2012-09-30 20:45 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\Skype
2014-10-19 20:58 - 2009-07-14 06:45 - 00289272 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-19 20:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2014-10-19 18:09 - 2012-03-21 21:26 - 00643866 _____ () C:\Windows\system32\perfh007.dat
2014-10-19 18:09 - 2012-03-21 21:26 - 00126394 _____ () C:\Windows\system32\perfc007.dat
2014-10-19 18:09 - 2009-07-14 07:13 - 01472002 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-19 17:10 - 2013-08-15 09:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-19 16:53 - 2012-09-07 18:49 - 00001150 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-19 16:53 - 2012-09-07 18:49 - 00001138 _____ () C:\Users\Public\Desktop\i can has le internetz.lnk
2014-10-19 16:53 - 2012-09-07 16:42 - 00001429 _____ () C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-19 16:41 - 2012-09-07 21:24 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-02 15:53 - 2010-11-21 05:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-30 18:54 - 2014-08-24 18:46 - 00021912 _____ () C:\Users\Maria\Documents\al med.odt
2014-09-27 10:45 - 2014-01-25 20:54 - 00000000 ____D () C:\ProgramData\Oracle
2014-09-27 10:33 - 2014-01-25 20:53 - 00000000 ____D () C:\Program Files (x86)\Java
2014-09-24 13:06 - 2013-01-27 19:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-24 13:05 - 2012-09-07 20:05 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-24 13:05 - 2012-01-19 14:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-22 21:19 - 2012-01-19 13:38 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-22 21:14 - 2014-05-20 15:57 - 00000000 ____D () C:\Program Files (x86)\Last.fm
2014-09-22 21:14 - 2012-01-19 14:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2014-09-22 21:14 - 2012-01-19 14:21 - 00000000 ____D () C:\Program Files (x86)\Acer
2014-09-22 21:11 - 2012-03-21 12:59 - 00000000 ____D () C:\ProgramData\CyberLink
2014-09-22 21:11 - 2012-03-21 12:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\clear.fi
2014-09-22 21:09 - 2012-09-07 20:37 - 00000000 ____D () C:\Users\Maria\AppData\Local\Cyberlink
2014-09-22 21:07 - 2012-01-19 13:50 - 00000000 ____D () C:\Program Files (x86)\Acer Games
2014-09-22 21:06 - 2012-01-19 13:50 - 00000000 ____D () C:\ProgramData\WildTangent
2014-09-22 21:06 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-09-22 21:04 - 2012-09-15 14:21 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\WildTangent
2014-09-22 21:04 - 2012-01-19 13:50 - 00000000 ____D () C:\Program Files (x86)\WildTangent Games
2014-09-22 20:57 - 2013-01-20 16:19 - 00000000 ____D () C:\Windows\Minidump
2014-09-22 20:57 - 2007-07-12 03:49 - 00000000 ____D () C:\Windows\Panther

Some content of TEMP:
====================
C:\Users\Maria\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpxuk1so.dll
C:\Users\Maria\AppData\Local\Temp\Quarantine.exe
C:\Users\Maria\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Maria\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-19 19:10

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

4. Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2014
Ran by Maria at 2014-10-21 13:21:43
Running from C:\Users\Maria\Downloads\AntiViren Schutzprogramm
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Symantec Endpoint Protection (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Symantec Endpoint Protection (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Symantec Endpoint Protection (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Absolute Uninstaller 5.3.1.17 (HKLM-x32\...\Absolute Uninstaller) (Version: 5.3.1.17 - Glarysoft Ltd)
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.99 - NTI Corporation)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 1.0.1904 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.0.1904 - CyberLink Corp.) Hidden
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3008 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3504 - Acer Incorporated)
Acer Games (HKLM-x32\...\WildTangent acer Master Uninstall) (Version: 1.0.2.5 - WildTangent)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3504 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0913.2011 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3500 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.7.1.19610 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.0) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.0 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Backup Manager V3 (x32 Version: 3.0.0.99 - NTI Corporation) Hidden
Broadcom Card Reader Driver Installer (HKLM\...\{4710662C-8204-4334-A977-B1AC9E547819}) (Version: 14.8.2.2 - Broadcom Corporation)
Broadcom NetLink Controller (HKLM\...\{C91DCB72-F5BB-410D-A91A-314F5D1B4284}) (Version: 14.8.4.1 - Broadcom Corporation)
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
clear.fi Client (HKLM-x32\...\{43AAE145-83CF-4C96-9A5E-756CEFCE879F}) (Version: 1.00.3500 - Acer Incorporated)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dolby Advanced Audio v2 (HKLM-x32\...\{B9E70C7A-9F85-4A39-A4A3-BFA3C3BF7613}) (Version: 7.2.7000.7 - Dolby Laboratories Inc)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)
ETDWare PS/2-X64 8.0.6.3_WHQL (HKLM\...\Elantech) (Version: 8.0.6.3 - ELAN Microelectronic Corp.)
Evernote v. 4.5.1 (HKLM-x32\...\{28921580-E4BB-11E0-9FD7-1CC1DEF07CBE}) (Version: 4.5.1.5451 - Evernote Corp.)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
HP Deskjet 3520 series - Grundlegende Software für das Gerät (HKLM\...\{A9C5381E-F415-4EDC-95A2-9164218FEA8A}) (Version: 27.0.847.0 - Hewlett-Packard Co.)
HP Deskjet 3520 series Hilfe (HKLM-x32\...\{6B953497-169C-4929-9AA9-A9F510347468}) (Version: 27.0.0 - Hewlett Packard)
HP Deskjet 3520 series Setup Guide (HKLM-x32\...\{AEEDCEB7-00B8-4BE1-B492-AB04803D5F1E}) (Version: 27.0.0 - Hewlett Packard)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.3341 - HP Photo Creations Powered by RocketLife)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0000 - Microsoft) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2418 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1026 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.670 - Oracle)
Java 7 Update 7 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417007FF}) (Version: 7.0.70 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.7 - Acer Inc.)
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Mozilla Firefox 33.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 de)) (Version: 33.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.1.6 - )
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9002 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9002 - NTI Corporation) Hidden
NVIDIA Grafiktreiber 285.90 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 285.90 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.48.261 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.5.21 (Version: 1.5.21 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{B9DB4C76-01A4-46D5-8910-F7AA6376DBAF}) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Systemsteuerung 285.90 (Version: 285.90 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.5.21 - NVIDIA Corporation) Hidden
OpenOffice.org 3.4.1 (HKLM-x32\...\{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}) (Version: 3.41.9593 - Apache Software Foundation)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6438 - Realtek Semiconductor Corp.)
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
Symantec Endpoint Protection (HKLM\...\{DF8896B9-4582-487C-B3DE-DFB1B1F83930}) (Version: 12.1.1101.401 - Symantec Corporation)
VLC media player 2.0.2 (HKLM\...\VLC media player) (Version: 2.0.2 - VideoLAN)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3504 - Acer Incorporated)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-2583589074-1064548776-3707576087-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

27-09-2014 08:31:33 Installed Java 7 Update 67
30-09-2014 16:50:58 Windows Update
06-10-2014 07:03:18 Windows Update
10-10-2014 09:37:42 Windows Update
16-10-2014 04:56:39 Windows Update
19-10-2014 14:40:09 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {9F003F92-4D4B-4255-919D-7EA2BF9FDC0D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: {A75867C3-4401-4C40-8C23-C2F01327269F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-08-21] (Piriform Ltd)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2012-01-19 13:05 - 2011-06-10 19:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-04-24 04:29 - 2011-04-24 04:29 - 00465640 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2011-04-24 04:29 - 2011-04-24 04:29 - 01081664 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2011-04-24 04:29 - 2011-04-24 04:29 - 00125760 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2014-10-19 22:37 - 2014-10-19 22:37 - 00043008 _____ () c:\users\maria\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpxuk1so.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\Maria\AppData\Roaming\Dropbox\bin\libcef.dll
2014-10-19 21:27 - 2014-10-19 21:27 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\c152a64e30c5b94894d75ac86aa7aad2\IsdiInterop.ni.dll
2012-01-19 13:38 - 2011-04-30 10:28 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-10-19 21:59 - 2014-10-19 21:59 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SepMasterService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SmcService => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: BackupManagerTray => "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: Norton Online Backup => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe

========================= Accounts: ==========================

Administrator (S-1-5-21-2583589074-1064548776-3707576087-500 - Administrator - Disabled)
Gast (S-1-5-21-2583589074-1064548776-3707576087-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2583589074-1064548776-3707576087-1003 - Limited - Enabled)
Maria (S-1-5-21-2583589074-1064548776-3707576087-1001 - Administrator - Enabled) => C:\Users\Maria
UpdatusUser (S-1-5-21-2583589074-1064548776-3707576087-1000 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (10/21/2014 01:15:44 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Sicherheitsrisiko gefunden!WS.Reputation.1 in Datei: C:\Users\Maria\Downloads\AntiViren Schutzprogramm\FRST64.exe von: Auto-Protect-Scan.  Aktion: Isolieren erfolgreich : Zugriff verweigert.  Beschreibung der Aktion: Die Datei wurde erfolgreich isoliert.

Error: (10/21/2014 01:03:51 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Sicherheitsrisiko gefunden!WS.Reputation.1 in Datei: C:\Users\Maria\Downloads\AntiViren Schutzprogramm\FRST64.exe von: Auto-Protect-Scan.  Aktion: Isolieren erfolgreich : Zugriff verweigert.  Beschreibung der Aktion: Die Datei wurde erfolgreich isoliert.

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (10/21/2014 11:23:10 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (10/19/2014 10:41:23 PM) (Source: Service Control Manager) (EventID: 7022) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde nicht richtig gestartet.

Error: (10/19/2014 10:37:28 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (10/19/2014 10:37:28 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "Windows Search" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1073473535.

Error: (10/19/2014 09:41:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Search" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (10/19/2014 09:41:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NTI IScheduleSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (10/19/2014 09:41:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Intel(R) Management and Security Application Local Management Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (10/19/2014 09:41:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (10/19/2014 09:41:52 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (10/19/2014 09:41:52 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Dritek WMI Service" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 3000 Millisekunden durchgeführt: Neustart des Diensts.


Microsoft Office Sessions:
=========================
Error: (10/21/2014 01:15:44 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Sicherheitsrisiko gefunden!WS.Reputation.1 in Datei: C:\Users\Maria\Downloads\AntiViren Schutzprogramm\FRST64.exe von: Auto-Protect-Scan.  Aktion: Isolieren erfolgreich : Zugriff verweigert.  Beschreibung der Aktion: Die Datei wurde erfolgreich isoliert.

Error: (10/21/2014 01:03:51 PM) (Source: Symantec AntiVirus) (EventID: 51) (User: )
Description: Sicherheitsrisiko gefunden!WS.Reputation.1 in Datei: C:\Users\Maria\Downloads\AntiViren Schutzprogramm\FRST64.exe von: Auto-Protect-Scan.  Aktion: Isolieren erfolgreich : Zugriff verweigert.  Beschreibung der Aktion: Die Datei wurde erfolgreich isoliert.

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/19/2014 10:37:28 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt

Error: (10/19/2014 10:37:27 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
4700


CodeIntegrity Errors:
===================================
  Date: 2014-10-21 13:19:16.000
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 13:02:54.593
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 12:51:58.640
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 12:22:50.055
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-20 12:10:57.217
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-19 22:36:08.119
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-19 22:33:55.892
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-19 22:02:38.920
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-19 21:52:58.345
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-19 21:44:25.334
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\sysfer.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 54%
Total physical RAM: 3947.86 MB
Available physical RAM: 1812.31 MB
Total Pagefile: 8193.9 MB
Available Pagefile: 5623.79 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:279.99 GB) (Free:218.97 GB) NTFS
Drive g: () (Removable) (Total:7.4 GB) (Free:7.04 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: D09EF974)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=280 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7.4 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

Symantec
1. Proaktiver Bedrohungsschutz Systemprotokoll

Code:

ATTFilter

Ereignis,Computer,Benutzer,Protokolliert	von,Beschreibung,Datum	und	Uhrzeit
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","08.10.2014	10:24:41"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","09.10.2014	12:44:40"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","10.10.2014	11:32:34"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","11.10.2014	12:16:33"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","12.10.2014	07:56:51"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","13.10.2014	06:39:31"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","13.10.2014	07:08:56"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","14.10.2014	00:24:35"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","13.10.2014	17:22:49"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","15.10.2014	17:36:45"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","12.10.2014	17:48:23"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","13.10.2014	23:45:43"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","14.10.2014	19:09:09"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","16.10.2014	06:49:47"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","15.10.2014	19:18:23"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","16.10.2014	19:36:05"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","19.10.2014	16:35:37"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","19.10.2014	20:59:21"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","SYSTEM","SONAR","SONAR	wurde	aktiviert","19.10.2014	21:45:12"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","19.10.2014	22:37:06"
SONAR-Engine ist deaktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	deaktiviert","21.10.2014	13:26:48"
SONAR-Engine ist aktiviert,"MARIA-LAPTOP","Maria","SONAR","SONAR	wurde	aktiviert","21.10.2014	13:52:33"

2. Proaktiver Bedrohungsschutz Bedrohungsschutzprotokoll

Code:

ATTFilter

Dateiname,Risiko,Aktion,Risikotyp,Quelladresse,Computer,Benutzer,Status,Aktueller	Ablageort,Primäre	Aktion,Sekundäre	Aktion,Protokolliert	von,Aktionsbeschreibung,Datum	und	Uhrzeit	
regclean_soft_partner.exe,"RegCleanPro","Allgemeiner	Fehler","Anwendungsheuristik		Irreführende	Anwendung","C:\Users\Maria\AppData\Local\Temp\is-7PMUH.tmp\","MARIA-LAPTOP",??????,"Infiziert","C:\Users\Maria\AppData\Local\Temp\is-7PMUH.tmp\","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan",??????,"
regclean_soft_partner.exe,"RegCleanPro","Allgemeiner	Fehler","Anwendungsheuristik		Irreführende	Anwendung","C:\Users\Maria\AppData\Local\Temp\is-7PMUH.tmp\","MARIA-LAPTOP",??????,"Infiziert","C:\Users\Maria\AppData\Local\Temp\is-7PMUH.tmp\","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan",??????,"

3. Viren- und Spyware-Schutz Systemprotokoll

Code:

ATTFilter

Ereignis,Computer,Benutzer,Protokolliert	von,Beschreibung,Datum	und	Uhrzeit														
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","06.10.2014	08:57:19"										
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","07.10.2014	15:59:24"										
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","09.10.2014	12:44:42"										
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","08.10.2014	10:24:40"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","09.10.2014	12:58:44"
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","08.10.2014	11:44:19"
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","08.10.2014	12:39:50"												
Virendefinitionsdatei geladen,"MARIA-LAPTOP","Maria","System","Neue	Virendefinitionsdatei	gefunden.	Version:	141009001.","09.10.2014	20:45:53"												
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","06.10.2014	09:53:51"												
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","07.10.2014	18:48:27"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","10.10.2014	11:32:28"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","10.10.2014	13:10:41"
Virendefinitionsdatei geladen,"MARIA-LAPTOP","Maria","System","Neue	Virendefinitionsdatei	gefunden.	Version:	141010001.","10.10.2014	20:23:30"												
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","11.10.2014	01:44:50"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","11.10.2014	12:16:32"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","11.10.2014	14:57:52"
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","11.10.2014	15:48:34"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","13.10.2014	06:39:27"										
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","12.10.2014	07:56:52"										
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","13.10.2014	07:08:54"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","12.10.2014	08:16:04"
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","12.10.2014	15:53:12"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","12.10.2014	17:48:21"										
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","13.10.2014	07:16:45"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","13.10.2014	17:22:49"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","13.10.2014	19:27:51"
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","13.10.2014	23:45:37"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","14.10.2014	00:13:13"
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","14.10.2014	00:22:29"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","14.10.2014	00:24:32"										
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","14.10.2014	00:43:59"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","14.10.2014	19:08:51"										
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","15.10.2014	17:37:37"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","14.10.2014	19:24:34"
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","16.10.2014	06:49:10"										
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","15.10.2014	18:07:33"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","15.10.2014	19:17:42"										
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","14.10.2014	20:36:48"												
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","16.10.2014	06:59:02"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","16.10.2014	19:36:07"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","16.10.2014	19:55:28"
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","15.10.2014	19:36:21"
Virendefinitionsdatei geladen,"MARIA-LAPTOP","Maria","System","Neue	Virendefinitionsdatei	gefunden.	Version:	141016003.","16.10.2014	19:59:47"												
Zeitüberschreitung bei Bewertungsprüfung,"MARIA-LAPTOP","Maria","Start","Zeitüberschreitung	bei	Bewertungsprüfung	während	der	Evaluierung	nicht	eindeutiger	Dateien,	wahrscheinlich	aufgrund	von	Netzwerkverzögerungen.","15.10.2014	19:44:12"				
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","15.10.2014	20:03:39"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","19.10.2014	16:35:03"										
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","20.10.2014	00:06:59"
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","16.10.2014	23:00:35"												
Unterlassener Scan,"MARIA-LAPTOP","Maria","Start","1	Dateien	in	C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\Symantec_Endpoint_Protection_12.1.1_Win_x64\SEPx64\VDefs.zip	konnten	nicht	gescannt	werden,	da	die	Decomposer-Engines	Fehler	beim	Entpacken	festgestellt	haben.","12.10.2014	18:26:22"
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","19.10.2014	20:59:03"										
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","19.10.2014	21:42:34"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","19.10.2014	21:45:11"										
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","19.10.2014	22:33:59"												
Starten von Symantec Endpoint Protection,"MARIA-LAPTOP","Maria","System","Start	der	Symantec	Endpoint	Protection-Dienste	war	erfolgreich.","19.10.2014	22:36:48"										
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\Filesystem\RealTimeScan\OnOff'	von	1'	in	0'","21.10.2014	13:26:46"								
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\Filesystem\RealTimeScan\APEOff'	von	0'	in	1413890806'","21.10.2014	13:26:46"								
Symantec Endpoint Protection Auto-Protect deaktiviert,"MARIA-LAPTOP","Maria","System","Symantec	Endpoint	Protection	Auto-Protect	deaktiviert.","21.10.2014	13:26:47"												
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\InternetMail\RealTimeScan\OnOff'	von	1'	in	0'","21.10.2014	13:26:48"								
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\MicrosoftExchangeClient\RealTimeScan\OnOff'	von	1'	in	0'","21.10.2014	13:26:48"								
Virendefinitionsdatei geladen,"MARIA-LAPTOP","Maria","System","Neue	Virendefinitionsdatei	gefunden.	Version:	141012001.","12.10.2014	18:47:45"												
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Symantec	Endpoint	Protection	Internet-E-Mail	-0	Auto-Protect	deaktiviert","21.10.2014	13:26:49"										
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Symantec	Endpoint	Protection	Microsoft	Exchange-E-Mail	-0	Auto-Protect	deaktiviert","21.10.2014	13:26:49"									
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\Filesystem\RealTimeScan\OnOff'	von	0'	in	1'","21.10.2014	13:52:31"								
Beenden von Symantec Endpoint Protection,"MARIA-LAPTOP","SYSTEM","System","Symantec	Endpoint	Protection-Dienst	erfolgreich	beendet.","12.10.2014	21:39:41"												
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\Filesystem\RealTimeScan\APEOff'	von	1413890806'	in	0'","21.10.2014	13:52:31"								
Symantec Endpoint Protection Auto-Protect aktiviert,"MARIA-LAPTOP","Maria","System","Symantec	Endpoint	Protection	Auto-Protect	aktiviert.","21.10.2014	13:52:32"												
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\InternetMail\RealTimeScan\OnOff'	von	0'	in	1'","21.10.2014	13:52:33"								
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\MicrosoftExchangeClient\RealTimeScan\OnOff'	von	0'	in	1'","21.10.2014	13:52:33"								
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Symantec	Endpoint	Protection	Microsoft	Exchange-E-Mail	-0	Auto-Protect	aktiviert","21.10.2014	13:52:34"									
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Symantec	Endpoint	Protection	Internet-E-Mail	-0	Auto-Protect	aktiviert","21.10.2014	13:52:34"										
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\Filesystem\RealTimeScan\OnOff'	von	1'	in	0'","21.10.2014	13:52:45"								
Konfiguration verändert,"MARIA-LAPTOP","Maria","System","Geänderter	Wert:	HKLM\Software\Wow6432Node\Symantec\Symantec	Endpoint	Protection\AV\Storages\Filesystem\RealTimeScan\OnOff'	von	0'	in	1'","21.10.2014	13:52:45"

4. Viren- und Spyware-Schutz Risikoprotokoll

Code:

ATTFilter

Dateiname,Risiko,Aktion,Risikotyp,Quelladresse,Computer,Benutzer,Status,Aktueller	Ablageort,Primäre	Aktion,Sekundäre	Aktion,Protokolliert	von,Aktionsbeschreibung,Datum	und	Uhrzeit													
Microsoft%20Word.exe,"WS.Reputation.1","Isoliert","Insight-Netzwerkbedrohung","C:\Users\Maria\Downloads\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","12.10.2014	18:00:23"											
VOsrv.exe,"Trojan.Asprox.B","Neustart	wird	durchgeführt","Datei		Virus","C:\Users\Maria\AppData\Roaming\VOPackage\","MARIA-LAPTOP","Maria","Infiziert","C:\Users\Maria\AppData\Roaming\VOPackage\","Löschen","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan","Risikoverarbeitung	nach	Neustart	wurde	durchgeführt.","19.10.2014	16:36:23"							
commonshare_soft_partner.exe,"Trojan.Gen.2","Isoliert","Datei		Virus","C:\Users\Maria\AppData\Local\Temp\is-K4D83.tmp\","MARIA-LAPTOP","SYSTEM","Infiziert","Isolieren","Von	Sicherheitsrisiko	bereinigen","Isolieren","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","16.10.2014	20:02:31"										
VOsrv.exe,"Trojan.Asprox.B","Neustart	erforderlich	–Bereinigt	durch	Löschen","Datei		Virus","C:\Users\Maria\AppData\Roaming\VOPackage\","MARIA-LAPTOP","SYSTEM","Gelöscht","Gelöscht","Neustart	erforderlich	–Von	Sicherheitsrisiko	bereinigen","Neustart	erforderlich	–Isolieren","Auto-Protect-Scan","Neustart	erforderlich	–Die	Datei	wurde	erfolgreich	gelöscht.","16.10.2014	20:03:41"
FRST64.exe,"WS.Reputation.1","Isoliert","Insight-Netzwerkbedrohung","C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","21.10.2014	13:03:51"										
malwarebytes anti malware malware scanner - chip-installer.exe,"WS.Reputation.1","Isoliert","Insight-Netzwerkbedrohung","c:\users\maria\downloads\antiviren	schutzprogramm\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","19.10.2014	18:31:35"										
FRST64.exe,"WS.Reputation.1","Isoliert","Insight-Netzwerkbedrohung","C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","21.10.2014	13:15:44"										
FRST64.exe,"WS.Reputation.1","Wiederhergestellt","Insight-Netzwerkbedrohung","C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\","MARIA-LAPTOP","Maria","Infiziert","C:\Users\Maria\Downloads\AntiViren	Schutzprogramm\","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	wiederhergestellt.","21.10.2014	13:15:44"									
googledrivesync.exe,"WS.Reputation.1","Isoliert","Insight-Netzwerkbedrohung","c:\users\maria\downloads\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Isolieren","Nichts	unternehmen	(nur	protokollieren)","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","12.10.2014	18:32:55"											
ConvertAdSetup[1].exe,"Suspicious.Cloud.2","Isoliert","Datei		Heuristikvirus","C:\Users\Maria\AppData\Local\MICROSOFT\Windows\Temporary	Internet	Files\Content.IE5\D59319C7\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Von	Sicherheitsrisiko	bereinigen","Isolieren","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","12.10.2014	18:41:12"								
nszB853.tmp,"Suspicious.Cloud.2","Isoliert","Datei		Heuristikvirus","C:\Users\Maria\AppData\Local\Temp\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Von	Sicherheitsrisiko	bereinigen","Isolieren","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","12.10.2014	18:41:25"										
SupTab_v5.8.8.865_noblank.exe,"Trojan.Gen.2","Isoliert","Datei		Virus","C:\Users\Maria\AppData\Local\Temp\7E82590C-48C6-48BD-9DBB-BDCC68C3CBB8[i]\tmp\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Von	Sicherheitsrisiko	bereinigen","Isolieren","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","12.10.2014	18:41:57"										
AnyProtectSetup[1].exe,"Suspicious.Cloud.2","Isoliert","Datei		Heuristikvirus","C:\Users\Maria\AppData\Local\MICROSOFT\Windows\Temporary	Internet	Files\Content.IE5\25WO2BPE\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Von	Sicherheitsrisiko	bereinigen","Isolieren","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","12.10.2014	18:42:42"								
nsv3A45.tmp,"Suspicious.Cloud.2","Isoliert","Datei		Heuristikvirus","C:\Users\Maria\AppData\Local\Temp\","MARIA-LAPTOP","Maria","Infiziert","Isolieren","Von	Sicherheitsrisiko	bereinigen","Isolieren","Auto-Protect-Scan","Die	Datei	wurde	erfolgreich	isoliert.","12.10.2014	18:42:57"

Ich hoffe so ist es besser.

schrauber · 22.10.2014, 12:15

hi,

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

LordDampf · 23.10.2014, 21:27

1. MBAN:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 23.10.2014
Suchlauf-Zeit: 20:02:43
Logdatei: MBAM.txt
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.10.23.06
Rootkit Datenbank: v2014.10.22.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Maria

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 354649
Verstrichene Zeit: 23 Min, 48 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)

2. ADW Cleaner

Code:

ATTFilter

# AdwCleaner v4.000 - Bericht erstellt am 23/10/2014 um 21:26:40
# DB v201.20
# Aktualisiert 12/10/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Maria - MARIA-LAPTOP
# Gestartet von : C:\Users\Maria\Downloads\AntiViren Schutzprogramm\AdwCleaner_4.000.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\SecTaskMan

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Mozilla Firefox v33.0 (x86 de)


*************************

AdwCleaner[R0].txt - [4344 octets] - [19/10/2014 21:38:45]
AdwCleaner[R1].txt - [1137 octets] - [23/10/2014 21:24:19]
AdwCleaner[S0].txt - [4179 octets] - [19/10/2014 21:41:46]
AdwCleaner[S1].txt - [1005 octets] - [23/10/2014 21:26:40]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1065 octets] ##########

3. JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.3.3 (10.21.2014:1)
OS: Windows 7 Home Premium x64
Ran by Maria on 23.10.2014 at 21:46:05,80
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{62138DFD-0115-4013-BCF6-29AA28BCEF8C}



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{0BD6CB21-1437-4B5A-83E3-CC06111A4BD8}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{17E70110-8D08-4FCA-8AD1-827A47744801}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{27FA1681-351B-4511-9B5E-DF12D4CBE2D6}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{2B9AE8CC-BCC7-4CD3-88E0-32FEA6B64453}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{473FBDF8-559E-413B-81B2-7617A78D1DAE}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{4951FD44-1C18-41BE-9686-6ABFD627788D}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{807103E7-84DA-40A8-86A1-7AB853454F0B}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{96B56AE3-941A-4D22-827B-B5ECEABD7743}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{9BE6F398-FBE9-470A-844A-EE27C4AC97D0}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{ABCEAEE1-47AD-4D30-806F-B6226D1EDACD}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{CEC77AA9-A84A-4BBA-AC88-82E2D34F4D19}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{D810E78B-8DFE-4A3C-8220-8D7EA7D65E1A}
Successfully deleted: [Empty Folder] C:\Users\Maria\appdata\local\{E94342C2-9227-4D78-A603-19B0F7B9FD1F}



~~~ FireFox

Emptied folder: C:\Users\Maria\AppData\Roaming\mozilla\firefox\profiles\vp4up7io.default-1413748654774\minidumps [3 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 23.10.2014 at 21:51:09,90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4.Frst

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-10-2014
Ran by Maria (administrator) on MARIA-LAPTOP on 23-10-2014 22:01:35
Running from C:\Users\Maria\Downloads\AntiViren Schutzprogramm
Loaded Profiles: UpdatusUser & Maria (Available profiles: UpdatusUser & Maria)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Dropbox, Inc.) C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\ccSvcHst.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\ccSvcHst.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\Smc.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\SavUI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ETDCtrl] => C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-05] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12673128 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831016 2011-08-02] (Acer Incorporated)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1103440 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SEP-x32: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\WinLogoutNotifier.dll [X]
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2583589074-1064548776-3707576087-1001\...\Run: [HP Deskjet 3520 series (NET)] => C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe [2551656 2012-01-31] (Hewlett-Packard Co.)
HKU\S-1-5-21-2583589074-1064548776-3707576087-1001\...\MountPoints2: E - E:\LaunchU3.exe -a
HKU\S-1-5-18\...\RunOnce: [IsMyWinLockerReboot] => msiexec.exe /qn /x{voidguid}
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-09-05] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-09-05] (NVIDIA Corporation)
Startup: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Maria\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - .lnk
ShortcutTarget: Tintenwarnungen überwachen - .lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
BHO-x32: Symantec Intrusion Prevention -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\bin\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_189.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_189.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774\searchplugins\google-images.xml
FF SearchPlugin: C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774\searchplugins\google-maps.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: WOT - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2014-10-19]
FF Extension: Adblock Plus - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-19]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-10-19]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\IPSFF
FF Extension: Symantec Intrusion Prevention - C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\IPSFF [2013-10-03]
FF HKCU\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Maria\AppData\Roaming\Mozilla\Firefox\Profiles\vp4up7io.default-1413748654774\extensions\cliqz@cliqz.com

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 SepMasterService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\ccSvcHst.exe [137208 2012-09-07] (Symantec Corporation)
R3 SmcService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\Smc.exe [2601544 2012-09-07] (Symantec Corporation)
S3 SNAC; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\snac64.exe [325040 2012-09-07] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BHDrvx64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\BASHDefs\20141003.013\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-17] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-17] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\IPSDefs\20141022.002\IDSvia64.sys [525016 2014-05-13] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs\20141023.002\ENG64.SYS [129752 2014-08-22] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs\20141023.002\EX64.SYS [2137304 2014-08-22] (Symantec Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 SRTSP; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SRTSP64.SYS [678008 2012-09-07] (Symantec Corporation)
R1 SRTSPX; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SRTSPX64.SYS [39032 2012-09-07] (Symantec Corporation)
S3 SyDvCtrl; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\SyDvCtrl64.sys [29664 2012-09-07] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMDS64.SYS [451192 2012-09-07] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMEFA64.SYS [932472 2012-09-07] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-09-07] (Symantec Corporation)
R1 SymIRON; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\Ironx64.SYS [171128 2012-09-07] (Symantec Corporation)
R1 SYMNETS; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMNETS.SYS [386168 2012-09-07] (Symantec Corporation)
R1 SysPlant; C:\Windows\System32\Drivers\SysPlant.sys [119816 2012-09-07] (Symantec Corporation)
R1 Teefer2; C:\Windows\System32\DRIVERS\Teefer.sys [62672 2012-09-07] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 21:51 - 2014-10-23 21:51 - 00002297 _____ () C:\Users\Maria\Desktop\JRT.txt
2014-10-23 21:45 - 2014-10-23 21:45 - 00000000 ____D () C:\Windows\ERUNT
2014-10-23 21:33 - 2014-10-23 21:33 - 00001145 _____ () C:\Users\Maria\Desktop\AdwCleaner[S1].txt
2014-10-23 21:20 - 2014-10-23 21:20 - 00001201 _____ () C:\Users\Maria\Desktop\MBAM.txt
2014-10-23 09:12 - 2014-08-29 04:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-23 09:12 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-10-22 00:48 - 2014-10-22 00:49 - 05841248 _____ (Acer Incorporated) C:\Users\Maria\Downloads\Updaterhotfix.exe
2014-10-22 00:42 - 2014-10-22 00:42 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-10-22 00:42 - 2014-10-22 00:42 - 00000000 ____D () C:\Windows\system32\NV
2014-10-22 00:32 - 2013-05-10 07:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2014-10-22 00:32 - 2013-05-10 07:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2014-10-22 00:32 - 2013-05-10 06:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-10-22 00:32 - 2013-05-10 06:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-10-22 00:28 - 2014-10-23 15:02 - 01592784 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-10-22 00:24 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-10-22 00:24 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-10-22 00:24 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-10-22 00:24 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-10-22 00:24 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-10-22 00:24 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-22 00:24 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-10-22 00:24 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-10-22 00:24 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-10-22 00:24 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-10-22 00:24 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-10-22 00:24 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-10-22 00:24 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-22 00:24 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-22 00:24 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-10-22 00:24 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-22 00:24 - 2013-10-01 22:57 - 06578176 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-22 00:24 - 2013-10-01 22:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-22 00:20 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-10-22 00:20 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-10-22 00:20 - 2012-08-23 16:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2014-10-22 00:20 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-10-22 00:20 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-10-22 00:12 - 2012-07-26 05:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-10-22 00:12 - 2012-07-26 05:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-10-22 00:12 - 2012-07-26 05:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-10-22 00:12 - 2012-07-26 05:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-10-22 00:12 - 2012-07-26 05:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-10-22 00:12 - 2012-07-26 04:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-10-22 00:12 - 2012-07-26 04:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-10-22 00:12 - 2012-06-02 16:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-10-22 00:10 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-10-22 00:10 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-10-22 00:08 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-10-22 00:08 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-10-22 00:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-22 00:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-22 00:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-22 00:08 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-22 00:08 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-22 00:08 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-22 00:08 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-22 00:08 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-22 00:08 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-22 00:08 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-22 00:08 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-22 00:08 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-22 00:08 - 2014-01-28 04:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2014-10-22 00:08 - 2013-12-04 04:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-10-22 00:08 - 2013-12-04 04:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-10-22 00:08 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-10-22 00:08 - 2013-12-04 04:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-10-22 00:08 - 2013-12-04 04:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-10-22 00:08 - 2013-12-04 04:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-10-22 00:08 - 2013-12-04 04:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-10-22 00:08 - 2013-12-04 04:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-10-22 00:08 - 2013-12-04 04:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-10-22 00:08 - 2013-12-04 04:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-10-22 00:08 - 2013-12-04 04:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-10-22 00:08 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-10-22 00:08 - 2013-12-04 04:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-10-22 00:08 - 2013-12-04 04:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-10-22 00:08 - 2013-12-04 03:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-10-22 00:08 - 2013-12-04 03:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-10-22 00:08 - 2013-12-04 03:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-10-22 00:08 - 2013-12-04 03:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-10-22 00:08 - 2013-11-23 20:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-10-22 00:08 - 2013-11-23 19:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2014-10-22 00:08 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-10-22 00:08 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2014-10-22 00:08 - 2013-03-19 07:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2014-10-22 00:08 - 2012-10-03 19:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2014-10-22 00:08 - 2012-10-03 19:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2014-10-22 00:08 - 2012-10-03 19:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2014-10-22 00:08 - 2012-10-03 19:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2014-10-22 00:08 - 2012-10-03 19:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2014-10-22 00:08 - 2012-10-03 19:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-10-22 00:08 - 2012-10-03 18:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2014-10-22 00:08 - 2012-10-03 18:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2014-10-22 00:08 - 2012-10-03 18:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2014-10-22 00:08 - 2012-10-03 18:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-10-22 00:08 - 2012-01-13 09:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2014-10-22 00:07 - 2014-09-18 04:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-22 00:07 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-22 00:07 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-10-22 00:07 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-10-22 00:07 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-10-22 00:07 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-10-22 00:07 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-10-22 00:07 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-10-22 00:07 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-10-22 00:07 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-10-22 00:07 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-10-22 00:07 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-10-22 00:07 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-10-22 00:07 - 2013-10-04 04:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2014-10-22 00:07 - 2013-10-04 04:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2014-10-22 00:07 - 2013-10-04 03:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2014-10-22 00:07 - 2013-10-04 03:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2014-10-22 00:07 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2014-10-22 00:07 - 2013-07-04 14:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-10-22 00:07 - 2013-07-04 14:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-10-22 00:07 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-10-22 00:07 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-10-22 00:07 - 2013-07-04 12:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2014-10-22 00:07 - 2013-01-24 08:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2014-10-22 00:07 - 2012-12-07 15:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2014-10-22 00:07 - 2012-12-07 15:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2014-10-22 00:07 - 2012-12-07 14:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2014-10-22 00:07 - 2012-12-07 14:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2014-10-22 00:07 - 2012-12-07 13:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2014-10-22 00:07 - 2012-12-07 13:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2014-10-22 00:07 - 2012-12-07 13:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2014-10-22 00:07 - 2012-12-07 13:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2014-10-22 00:07 - 2012-12-07 13:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2014-10-22 00:07 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2014-10-22 00:07 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2014-10-22 00:07 - 2012-12-07 13:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2014-10-22 00:07 - 2012-12-07 13:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2014-10-22 00:07 - 2012-12-07 13:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2014-10-22 00:07 - 2012-12-07 13:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2014-10-22 00:07 - 2012-12-07 13:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2014-10-22 00:07 - 2012-12-07 13:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2014-10-22 00:07 - 2012-12-07 13:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2014-10-22 00:07 - 2012-12-07 12:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2014-10-22 00:07 - 2012-10-09 20:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2014-10-22 00:07 - 2012-10-09 20:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2014-10-22 00:07 - 2012-10-09 19:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2014-10-22 00:07 - 2012-10-09 19:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2014-10-22 00:07 - 2012-08-21 23:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2014-10-22 00:06 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-22 00:06 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-10-22 00:06 - 2014-02-04 04:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-10-22 00:06 - 2014-02-04 04:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-10-22 00:06 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-10-22 00:06 - 2013-10-30 04:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2014-10-22 00:06 - 2013-10-30 04:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2014-10-22 00:06 - 2013-08-28 03:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2014-10-22 00:06 - 2012-08-22 20:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2014-10-22 00:06 - 2012-07-04 22:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2014-10-21 23:54 - 2014-10-21 23:54 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\Oracle
2014-10-21 23:53 - 2014-10-21 23:53 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-21 23:53 - 2014-10-21 23:53 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-21 23:53 - 2014-10-21 23:53 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-21 23:53 - 2014-10-21 23:53 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-21 23:53 - 2014-10-21 23:53 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-21 23:36 - 2014-10-23 21:28 - 00001014 _____ () C:\Windows\PFRO.log
2014-10-21 22:31 - 2014-10-21 22:31 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Security Task Manager
2014-10-21 22:31 - 2014-10-21 22:31 - 00000000 ____D () C:\Program Files (x86)\Security Task Manager
2014-10-21 22:31 - 2011-05-13 12:16 - 00493056 _____ ( datenhaus GmbH) C:\Windows\SysWOW64\dhRichClient3.dll
2014-10-21 22:31 - 2011-03-25 20:42 - 00338432 _____ () C:\Windows\SysWOW64\sqlite36_engine.dll
2014-10-21 18:37 - 2014-10-21 18:37 - 00489128 _____ () C:\Windows\Minidump\102114-42791-01.dmp
2014-10-21 18:36 - 2014-10-21 18:36 - 4139845238 _____ () C:\Windows\MEMORY.DMP
2014-10-21 13:19 - 2014-10-23 22:01 - 00000000 ____D () C:\FRST
2014-10-21 13:05 - 2014-10-21 13:05 - 00000000 _____ () C:\Users\Maria\defogger_reenable
2014-10-19 22:36 - 2014-10-23 21:29 - 00000392 _____ () C:\Windows\setupact.log
2014-10-19 22:36 - 2014-10-19 22:36 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-19 22:10 - 2014-10-19 22:11 - 00000000 ____D () C:\Users\Maria\Documents\Sicherung Registry
2014-10-19 22:07 - 2014-10-19 22:07 - 00001278 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Absolute Uninstaller.lnk
2014-10-19 22:07 - 2014-10-19 22:07 - 00001266 _____ () C:\Users\Public\Desktop\Absolute Uninstaller.lnk
2014-10-19 22:07 - 2014-10-19 22:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glarysoft
2014-10-19 22:07 - 2014-10-19 22:07 - 00000000 ____D () C:\Program Files (x86)\Glarysoft
2014-10-19 21:59 - 2014-10-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-19 21:57 - 2014-10-19 21:57 - 00000000 ____D () C:\Users\Maria\Desktop\Alte Firefox-Daten
2014-10-19 21:37 - 2014-10-23 21:26 - 00000000 ____D () C:\AdwCleaner
2014-10-19 20:51 - 2014-10-21 17:30 - 00000000 ____D () C:\Users\Maria\Documents\Protkolle
2014-10-19 18:34 - 2014-10-23 20:02 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-19 18:33 - 2014-10-19 18:33 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-19 18:33 - 2014-10-19 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-19 18:33 - 2014-10-19 18:33 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-19 18:33 - 2014-10-19 18:33 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-19 18:33 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-19 18:33 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-10-19 18:33 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-10-16 19:48 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 19:48 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 19:47 - 2014-07-17 04:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 19:47 - 2014-07-17 04:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 19:47 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 19:47 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 19:47 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 19:47 - 2014-07-17 03:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 19:47 - 2014-07-17 03:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 19:47 - 2014-05-30 10:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-10-16 19:47 - 2014-05-30 10:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-10-16 19:47 - 2014-05-30 10:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-10-16 19:47 - 2014-05-30 10:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-10-16 19:47 - 2014-05-30 09:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-10-16 19:44 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 19:44 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 19:44 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 19:44 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 19:44 - 2014-09-19 03:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 19:44 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 19:44 - 2014-09-19 03:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 19:44 - 2014-09-19 03:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 19:44 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 19:44 - 2014-09-19 03:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 19:44 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 19:44 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 19:44 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 19:44 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 19:44 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 19:44 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 19:44 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 19:44 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 19:43 - 2014-10-07 04:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 19:43 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 19:43 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 19:43 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 19:43 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 19:43 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 19:43 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 19:43 - 2014-09-19 03:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 19:43 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 19:43 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 19:43 - 2014-09-19 03:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 19:43 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 19:43 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 19:43 - 2014-09-19 03:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 19:43 - 2014-09-19 03:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 19:43 - 2014-09-19 03:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 19:43 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 19:43 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 19:43 - 2014-09-19 03:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 19:43 - 2014-09-19 03:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 19:43 - 2014-09-19 03:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 19:43 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 19:43 - 2014-09-19 03:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 19:43 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 19:43 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 19:43 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 19:43 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 19:43 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 19:43 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 19:43 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 19:43 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 19:43 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 19:43 - 2014-09-19 02:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 19:43 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 19:43 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 19:43 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 19:43 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 19:43 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 19:43 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 19:43 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 19:39 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 19:39 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-13 18:04 - 2014-10-13 18:04 - 00252788 _____ () C:\Users\Maria\Documents\niere10.odt
2014-10-13 18:01 - 2014-10-13 18:01 - 00280783 _____ () C:\Users\Maria\Documents\niere 9.odt
2014-10-13 17:56 - 2014-10-13 17:56 - 00623667 _____ () C:\Users\Maria\Documents\niere 8.odt
2014-10-13 17:52 - 2014-10-13 17:52 - 00155395 _____ () C:\Users\Maria\Documents\niere 7.odt
2014-10-12 19:40 - 2014-10-12 19:40 - 00627560 _____ (CMI Limited) C:\Users\Maria\AppData\Local\nsg49A0.tmp
2014-10-12 19:40 - 2014-10-12 19:40 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\ap_movie
2014-10-12 18:43 - 2014-10-12 18:43 - 00301608 _____ (VuuPC Limited) C:\Users\Maria\AppData\Local\nsqCA34.tmp
2014-10-12 18:40 - 2014-10-12 18:40 - 00000000 ____D () C:\ProgramData\Xunlei
2014-10-12 18:40 - 2014-10-12 18:40 - 00000000 ____D () C:\ProgramData\Thunder Network
2014-10-12 18:31 - 2014-10-12 18:31 - 00000000 __SHD () C:\Users\Maria\AppData\Local\EmieUserList
2014-10-12 18:31 - 2014-10-12 18:31 - 00000000 __SHD () C:\Users\Maria\AppData\Local\EmieSiteList
2014-10-12 18:30 - 2014-10-12 18:30 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\QuickScan
2014-10-12 13:22 - 2014-10-12 15:52 - 00012178 _____ () C:\Users\Maria\Documents\nierenersatztherapie.odt
2014-10-12 11:02 - 2014-10-12 11:05 - 00029694 _____ () C:\Users\Maria\Documents\skills bilder.odt
2014-10-11 13:05 - 2014-10-13 18:26 - 00024072 _____ () C:\Users\Maria\Documents\embryonal.odt
2014-10-11 00:56 - 2014-10-13 19:30 - 00017654 _____ () C:\Users\Maria\Documents\inhalt.odt
2014-10-10 22:59 - 2014-10-13 21:17 - 00019336 _____ () C:\Users\Maria\Documents\sterben.odt
2014-10-10 21:07 - 2014-10-11 15:46 - 00018393 _____ () C:\Users\Maria\Documents\waldeck 2.odt
2014-10-10 19:29 - 2014-10-11 15:26 - 00021063 _____ () C:\Users\Maria\Documents\Aids.odt
2014-10-10 16:25 - 2014-10-13 18:28 - 00023647 _____ () C:\Users\Maria\Documents\blutspende.odt
2014-10-10 15:57 - 2014-10-10 15:57 - 00019713 _____ () C:\Users\Maria\Documents\psych 4.odt
2014-10-10 14:57 - 2014-10-13 17:50 - 00025151 _____ () C:\Users\Maria\Documents\psycho.odt
2014-10-10 12:55 - 2014-10-10 12:55 - 00168602 _____ () C:\Users\Maria\Documents\geburtshaus 4.odt
2014-10-10 12:53 - 2014-10-10 12:53 - 00362557 _____ () C:\Users\Maria\Documents\geburtshaus 3.odt
2014-10-10 12:47 - 2014-10-10 12:47 - 00221659 _____ () C:\Users\Maria\Documents\kopie geburtshaus 2.odt
2014-10-10 12:37 - 2014-10-10 12:37 - 00364298 _____ () C:\Users\Maria\Documents\kopie geburtshaus.odt
2014-10-08 12:15 - 2014-10-08 12:15 - 00023688 _____ () C:\Users\Maria\Documents\waldeck.odt
2014-10-08 11:58 - 2014-10-10 13:24 - 00204216 _____ () C:\Users\Maria\Documents\geburtshauds.odt
2014-10-07 16:30 - 2014-10-11 15:17 - 00028080 _____ () C:\Users\Maria\Documents\klärwerk.odt
2014-10-06 09:18 - 2014-10-13 17:41 - 00019092 _____ () C:\Users\Maria\Documents\forensik.odt
2014-10-06 09:18 - 2014-10-12 10:49 - 00017853 _____ () C:\Users\Maria\Documents\skills quellen.odt
2014-09-27 10:33 - 2014-09-27 10:33 - 00004715 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_67-b01.log

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 22:01 - 2012-09-07 19:23 - 00000000 ____D () C:\Users\Maria\Downloads\AntiViren Schutzprogramm
2014-10-23 21:48 - 2012-03-21 12:34 - 01513627 _____ () C:\Windows\WindowsUpdate.log
2014-10-23 21:40 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-23 21:40 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-23 21:38 - 2012-03-21 21:26 - 00698926 _____ () C:\Windows\system32\perfh007.dat
2014-10-23 21:38 - 2012-03-21 21:26 - 00149034 _____ () C:\Windows\system32\perfc007.dat
2014-10-23 21:38 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-23 21:32 - 2013-11-18 20:11 - 00000000 ___RD () C:\Users\Maria\Dropbox
2014-10-23 21:32 - 2013-11-18 20:06 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\Dropbox
2014-10-23 21:30 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-23 21:05 - 2013-01-27 19:50 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-23 12:33 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-10-22 00:44 - 2012-09-07 16:39 - 00066832 _____ () C:\Users\Maria\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-22 00:43 - 2009-07-14 06:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-10-22 00:42 - 2012-03-21 12:45 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-22 00:42 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-22 00:39 - 2009-07-14 06:45 - 00290648 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-22 00:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-10-22 00:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-10-22 00:34 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-10-22 00:18 - 2012-03-21 12:45 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-10-22 00:18 - 2012-03-21 12:45 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-10-21 23:54 - 2014-01-25 20:54 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-21 23:49 - 2013-01-27 19:50 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-10-21 23:49 - 2012-09-16 14:06 - 00000000 ____D () C:\Users\Maria\AppData\Local\Adobe
2014-10-21 23:49 - 2012-09-07 20:05 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-10-21 23:49 - 2012-01-19 14:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-10-21 23:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PLA
2014-10-21 18:37 - 2013-01-20 16:19 - 00000000 ____D () C:\Windows\Minidump
2014-10-21 13:54 - 2014-09-22 20:55 - 00000995 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-21 13:05 - 2012-09-07 16:39 - 00000000 ____D () C:\Users\Maria
2014-10-19 22:35 - 2012-11-24 23:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-10-19 21:53 - 2012-09-30 20:45 - 00000000 ____D () C:\Users\Maria\AppData\Roaming\Skype
2014-10-19 20:57 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2014-10-19 17:10 - 2013-08-15 09:28 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-19 16:53 - 2012-09-07 18:49 - 00001150 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-10-19 16:53 - 2012-09-07 18:49 - 00001138 _____ () C:\Users\Public\Desktop\i can has le internetz.lnk
2014-10-19 16:53 - 2012-09-07 16:42 - 00001429 _____ () C:\Users\Maria\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-19 16:41 - 2012-09-07 21:24 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-02 15:53 - 2010-11-21 05:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-30 18:54 - 2014-08-24 18:46 - 00021912 _____ () C:\Users\Maria\Documents\al med.odt

Some content of TEMP:
====================
C:\Users\Maria\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmkkhs7.dll
C:\Users\Maria\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Maria\AppData\Local\Temp\Quarantine.exe
C:\Users\Maria\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Maria\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-19 19:10

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 24.10.2014, 16:39

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Windows 7: Sweet Page Virus durch falsche Microsoft%20Word.exe

Log-Analyse und Auswertung: Windows 7: Sweet Page Virus durch falsche Microsoft%20Word.exe