| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat ReaderWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.01.2015, 13:01
| #1 |
 |  Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Ein eigenartiges Phänomen: ich habe auf meinem Windows 7-Laptop Acrobat Reader (11.0.10) neu installiert (Download von get.adobe.com/de/reader/?promoid=KLXME). Die Datei war "install_reader11_de_mssd_aaa_aih.exe" heruntergeladen im Google Chrome. Nach der Installation waren sämtliche *.lnk-Dateien mit dem Acrobat Reader verknüpft: sowohl auf dem Desktop, als auch in allen Verweisen im Startmenü. Statt einer Ausführung eines angeklickten Programmes wird nun der Acrobat Reader gestartet, der die geforderte Datei natürlich nicht ausführen kann. Um einen Virusbefall auszuschließen, habe ich den ESET-Online-Scanner durchlaufen lassen: kein Befund (Protokoll ist nicht gespeichert). Und auch eine Installation von MalwarebytesAntiMalware.org gab kein weiteres Ergebnis. Um nun die falsche Verknüpfung zurückzusetzen habe ich das Programm regedit.exe als Administrator gestartet und den Schlüssel nach Anleitung von Microsoft (support.microsoft.com/kb/172053/de) händisch neu gesetzt. Nach Neustart war alles wie gehabt: Alle Verknüpfungen verweisen auf den Acrobat Reader. Vermutung: da ist eine Malware verantwortlich, die GDATA übersehen hat? Anhänge: defogger-disable.txt, Frst.txt, Additions.txt, gmer.txt, Mbam.txt |
|
02.01.2015, 13:59
| #2 |
| /// the machine /// TB-Ausbilder    | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Hi,
__________________Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen. Ich kann auf Arbeit keine Anhänge öffnen, danke.  So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
02.01.2015, 14:18
| #3 |
| | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader OK. Hier kommt der Code
__________________FRST.txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-01-2015
Ran by ***** (administrator) on *****-PC on 02-01-2015 14:04:32
Running from C:\Users\*****\Desktop
Loaded Profile: ***** (Available profiles: ***** & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(WiseCleaner.com) C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
() C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVK.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [184632 2013-10-18] (Motorola Solutions, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-24] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7659736 2014-11-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.)
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174856 2014-11-13] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [156840 2014-11-13] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-11-13] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4134469327-3428918013-2508645811-1000 -> {9C4FF0DA-599C-4FD5-9193-E34F8C206E7E} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Hosts: 127.0.0.1 activate.adobe.com
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\doz791p9.default
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Edge - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\doz791p9.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-01-02]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-10-30]
FF HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> "https://www.google.de/"
CHR Profile: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-27]
CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-27]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-27]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-27]
CHR Extension: (AdBlock) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-02]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-27]
CHR HKLM-x32\...\Chrome\Extension: [lmgddjncmooacfihfmikfohkldcjjgml] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe [151552 2010-10-01] (Atheros) [File not signed]
R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [53920 2010-12-17] (Atheros Commnucations) [File not signed]
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [2231616 2010-07-19] ()
S4 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2014-04-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-06-16] ()
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2014-09-04] (Realtek Semiconductor)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580648 2012-07-17] (WiseCleaner.com) [File not signed]
S2 HPSLPSVC; C:\Users\*****\AppData\Local\Temp\7zS0188\hpslpsvc64.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1408824 2013-10-18] (Motorola Solutions, Inc.)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-03] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-10-22] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-08-15] (G Data Software AG)
S3 GdNetMon; C:\Windows\system32\drivers\GdNetMon64.sys [31448 2011-08-01] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-03] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64512 2014-10-22] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-22] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-03] (G Data Software AG)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-24] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300352 2014-11-13] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
S3 WiseHDInfo; C:\Program Files (x86)\Wise\Wise Care 365\WiseHDInfo64.dll [11304 2014-06-04] (wisecleaner.com)
S3 btmaux; system32\DRIVERS\btmaux.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 14:04 - 2015-01-02 14:04 - 00023634 _____ () C:\Users\*****\Desktop\FRST.txt
2015-01-02 13:55 - 2015-01-02 13:55 - 917980558 _____ () C:\Windows\MEMORY.DMP
2015-01-02 13:55 - 2015-01-02 13:55 - 00442624 _____ () C:\Windows\Minidump\010215-28532-01.dmp
2015-01-02 12:10 - 2015-01-02 12:10 - 01057488 _____ (Adobe) C:\Users\*****\Downloads\install_reader11_de_mssd_aaa_aih.exe
2015-01-02 12:00 - 2015-01-02 12:00 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-02 12:00 - 2015-01-02 12:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-02 11:59 - 2015-01-02 11:59 - 00638888 _____ (Oracle Corporation) C:\Users\*****\Downloads\chromeinstall-8u25.exe
2015-01-02 11:33 - 2015-01-02 14:04 - 00000000 ____D () C:\FRST
2015-01-02 11:31 - 2015-01-02 11:31 - 00380416 _____ () C:\Users\*****\Desktop\gmer.exe
2015-01-02 11:30 - 2015-01-02 11:30 - 02123264 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2015-01-02 11:22 - 2015-01-02 11:22 - 00156416 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-02 11:21 - 2015-01-02 14:01 - 00000336 _____ () C:\Windows\setupact.log
2015-01-02 11:21 - 2015-01-02 11:21 - 05077656 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-02 11:21 - 2015-01-02 11:21 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-02 11:20 - 2015-01-02 11:20 - 00000358 _____ () C:\Windows\PFRO.log
2015-01-02 11:18 - 2014-12-09 10:04 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2015-01-02 10:54 - 2015-01-02 10:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-02 10:52 - 2015-01-02 10:52 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-02 10:30 - 2015-01-02 10:36 - 00001793 _____ () C:\Users\*****\Desktop\Google Chrome.lnk
2015-01-02 10:27 - 2015-01-02 13:32 - 00000000 ____D () C:\Users\*****\Desktop\dewitz
2015-01-02 10:24 - 2015-01-02 10:24 - 02347384 _____ (ESET) C:\Users\*****\Downloads\esetsmartinstaller_deu.exe
2015-01-02 09:58 - 2015-01-02 09:58 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-02 09:51 - 2015-01-02 09:51 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-01-02 09:51 - 2015-01-02 09:51 - 00002026 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2015-01-01 12:53 - 2015-01-02 14:04 - 00122348 _____ () C:\Windows\WindowsUpdate.log
2014-12-28 12:37 - 2014-12-28 12:37 - 00001241 _____ () C:\Users\*****\Downloads\Zipfolder_fix.zip
2014-12-27 15:36 - 2014-12-27 15:36 - 29491712 _____ () C:\Users\*****\Documents\Angela.pub 3.pub
2014-12-27 15:33 - 2014-12-27 15:33 - 33947648 _____ () C:\Users\*****\Documents\Angela.pub 2.pub
2014-12-27 12:33 - 2014-12-27 12:34 - 76313280 _____ (Adobe Systems Incorporated) C:\Users\*****\Downloads\AdbeRdr11010_de_DE.exe
2014-12-26 16:07 - 2014-12-26 16:07 - 00000000 ____D () C:\Users\*****\Sterne
2014-12-23 15:53 - 2014-12-23 15:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-22 10:38 - 2014-12-22 10:38 - 00001358 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-12-22 10:38 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-12-22 10:38 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-12-22 10:36 - 2014-12-22 10:36 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-12-22 10:36 - 2014-12-22 10:36 - 00000000 ____D () C:\Windows\system32\NV
2014-12-22 10:36 - 2014-11-12 21:46 - 00615624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-12-22 10:34 - 2014-11-13 01:20 - 31893136 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 24557712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 20986592 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 19966344 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 18514616 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 16884632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 14032984 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 13944952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 13213512 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-12-22 10:34 - 2014-11-13 01:20 - 11397744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 11336432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 04292416 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 04011208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 02874456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434475.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 01540424 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434475.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00964928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00923792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00900928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00871648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00300352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvkflt.sys
2014-12-22 10:34 - 2014-11-13 01:20 - 00031560 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2014-12-22 10:31 - 2014-08-27 07:10 - 00942808 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2014-12-22 10:31 - 2014-08-27 07:10 - 00073800 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2014-12-22 10:25 - 2014-12-22 10:25 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-12-22 10:25 - 2014-12-22 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Audio
2014-12-22 10:25 - 2014-12-22 10:25 - 00000000 ____D () C:\Program Files\Realtek
2014-12-22 10:24 - 2014-12-03 13:51 - 00960728 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2014-12-22 10:24 - 2014-12-03 11:41 - 04290520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-12-22 10:24 - 2014-12-03 10:15 - 01485163 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2014-12-22 10:24 - 2014-12-02 11:42 - 03218800 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-12-22 10:24 - 2014-12-02 09:33 - 02000640 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO264.dll
2014-12-22 10:24 - 2014-12-02 09:33 - 01728768 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO232.dll
2014-12-22 10:24 - 2014-11-27 10:06 - 72823296 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCORES64.dat
2014-12-22 10:24 - 2014-11-27 08:31 - 02823024 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll
2014-12-22 10:24 - 2014-11-19 08:42 - 01289944 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-12-22 10:24 - 2014-11-11 06:44 - 00631000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2014-12-22 10:24 - 2014-08-06 06:43 - 02860760 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-12-22 10:24 - 2014-04-10 05:19 - 02041432 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2014-12-22 10:24 - 2014-03-06 09:35 - 01959128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-12-22 10:24 - 2014-02-18 10:04 - 02770976 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-12-22 10:24 - 2014-01-08 08:25 - 00397592 _____ (Creative Technology Ltd.) C:\Windows\system32\MBWrp64.dll
2014-12-22 10:24 - 2013-08-14 08:36 - 00662784 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2014-12-22 10:24 - 2013-08-14 08:35 - 00663296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2014-12-22 10:24 - 2013-01-11 09:27 - 00628504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBTHX64.dll
2014-12-22 10:24 - 2013-01-11 09:27 - 00563992 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBTHX32.dll
2014-12-22 10:24 - 2012-06-08 09:21 - 00897152 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO64.dll
2014-12-22 10:24 - 2012-06-08 09:21 - 00753280 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO32.dll
2014-12-22 10:24 - 2011-12-20 08:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-12-22 10:24 - 2011-12-16 07:57 - 00065112 _____ (Creative Technology Ltd.) C:\Windows\system32\MBppld64.dll
2014-12-22 10:24 - 2011-11-22 09:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2014-12-22 10:24 - 2011-05-31 02:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-12-22 10:24 - 2010-11-03 11:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-12-22 10:24 - 2010-09-27 02:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2014-12-22 10:24 - 2009-11-18 00:13 - 00060504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBPPCn64.dll
2014-12-22 10:23 - 2014-06-09 03:59 - 00560328 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-12-22 10:23 - 2013-10-11 05:47 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2014-12-22 10:23 - 2012-03-08 04:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2014-12-19 16:58 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-19 16:58 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-14 15:37 - 2014-12-14 15:37 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-14 13:36 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-14 13:36 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-14 11:53 - 2014-12-14 11:53 - 03981488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-12-14 10:29 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-14 10:29 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-14 10:29 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-14 10:29 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-14 10:29 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-14 10:29 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-14 10:29 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-14 10:29 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-14 10:29 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-14 10:29 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-14 10:29 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-14 10:29 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-14 10:29 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-14 10:29 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-14 10:29 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-14 10:29 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-14 10:29 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-14 10:29 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-14 10:29 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-14 10:29 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-14 10:29 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-14 10:29 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-14 10:29 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-14 10:29 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-14 10:29 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-14 10:29 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-14 10:29 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-14 10:29 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-14 10:29 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-14 10:29 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-14 10:29 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-14 10:29 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-14 10:29 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-14 10:29 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-14 10:29 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-14 10:29 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-14 10:29 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-14 10:29 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-14 10:29 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-14 10:29 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-14 10:29 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-14 10:29 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-14 10:29 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-14 10:29 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-14 10:29 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-14 10:29 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-14 10:29 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-14 10:29 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-14 10:29 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-14 10:29 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-14 10:29 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-14 10:29 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-14 10:29 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-14 10:29 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-14 10:29 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-14 10:29 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-14 10:29 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-14 10:29 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-14 10:29 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-14 10:29 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-14 10:28 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-14 10:28 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-14 10:28 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-14 10:28 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-14 10:28 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-14 10:28 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-14 10:28 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-14 10:28 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-14 10:28 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-14 10:28 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-14 10:28 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-14 10:28 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-14 10:28 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-14 10:28 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-09 17:07 - 2014-12-09 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2014-12-03 12:15 - 2014-12-03 12:15 - 00016282 _____ () C:\Users\*****\Documents\Fwd neues Video in YouTube.html
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 14:03 - 2014-11-05 13:43 - 00006463 _____ () C:\Windows\SysWOW64\Gms.log
2015-01-02 14:01 - 2013-04-22 15:08 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Wise Care 365
2015-01-02 14:00 - 2014-10-26 10:44 - 00000000 ___RD () C:\Users\*****\iCloudDrive
2015-01-02 14:00 - 2013-10-21 09:40 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-02 14:00 - 2013-08-22 13:54 - 00000438 _____ () C:\Windows\Tasks\Wise Care 365.job
2015-01-02 13:59 - 2011-08-01 12:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-02 13:59 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-02 13:55 - 2011-08-03 14:59 - 00000000 ____D () C:\Windows\Minidump
2015-01-02 13:30 - 2013-04-27 12:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-02 13:20 - 2011-08-01 10:37 - 00000000 ____D () C:\Users\*****
2015-01-02 13:19 - 2011-08-01 14:40 - 00000000 ____D () C:\Users\*****\AppData\Local\G DATA
2015-01-02 12:00 - 2014-06-21 12:23 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-02 12:00 - 2011-08-23 14:09 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-02 11:32 - 2009-07-14 18:58 - 00700736 _____ () C:\Windows\system32\perfh007.dat
2015-01-02 11:32 - 2009-07-14 18:58 - 00150342 _____ () C:\Windows\system32\perfc007.dat
2015-01-02 11:32 - 2009-07-14 06:13 - 01624178 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-02 11:27 - 2009-07-14 05:45 - 00026128 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-02 11:27 - 2009-07-14 05:45 - 00026128 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-02 11:12 - 2011-08-23 15:23 - 00009440 _____ () C:\freefallprotection.log
2015-01-02 11:07 - 2012-09-18 16:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Genius Professional Edition
2015-01-02 11:07 - 2011-08-01 11:44 - 00000000 ____D () C:\Users\*****\Desktop\Tools
2015-01-02 10:07 - 2011-08-01 11:23 - 00002048 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-02 09:52 - 2011-08-01 11:34 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2015-01-02 09:51 - 2011-08-01 11:34 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-02 09:51 - 2011-08-01 11:34 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-12-29 12:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-27 10:51 - 2014-10-25 20:50 - 00000000 ____D () C:\Users\*****\Documents\Outlook-Dateien
2014-12-27 10:50 - 2014-10-26 16:31 - 00000000 ____D () C:\Users\*****\AppData\Local\7153AFC5-C070-4465-9E9C-129527797883.aplzod
2014-12-27 10:00 - 2013-04-27 09:16 - 00000418 _____ () C:\Windows\Tasks\Wise Turbo Checker.job
2014-12-27 08:28 - 2011-08-01 11:34 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Adobe
2014-12-27 08:13 - 2011-08-01 13:34 - 00000000 ____D () C:\Users\*****\Desktop\Anwendungen
2014-12-26 18:15 - 2012-05-13 16:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-22 10:45 - 2014-11-26 16:17 - 00000000 ____D () C:\Users\*****\AppData\Roaming\HpUpdate
2014-12-22 10:37 - 2012-09-18 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-12-22 10:37 - 2011-08-01 12:10 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-12-22 10:31 - 2011-08-01 10:58 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-12-22 10:25 - 2012-09-18 17:44 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-12-22 10:23 - 2011-08-01 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-21 15:35 - 2014-05-02 11:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\TeamViewer
2014-12-21 14:41 - 2014-06-21 12:26 - 00000000 ____D () C:\Users\*****\AppData\Roaming\WiseUpdate
2014-12-14 15:37 - 2014-05-02 09:49 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-14 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-14 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-14 13:45 - 2014-02-11 14:17 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-14 13:44 - 2013-08-06 15:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-14 13:38 - 2011-08-01 11:38 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-14 11:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-14 10:32 - 2013-04-27 12:10 - 00002182 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-12-14 10:31 - 2014-02-11 14:17 - 00000000 ____D () C:\Users\*****\AppData\Local\Microsoft Help
2014-12-13 01:12 - 2014-07-31 18:42 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-12-13 01:12 - 2014-07-31 18:42 - 01291464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-12-13 01:12 - 2014-02-11 17:06 - 02824504 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-12-13 01:12 - 2014-02-11 17:06 - 02210040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-12-09 17:23 - 2011-08-01 16:26 - 00000000 ____D () C:\Users\*****\Documents\Anschriften
2014-12-03 15:48 - 2011-08-01 13:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T-Online
2014-12-03 12:14 - 2014-11-22 09:57 - 00022528 ___SH () C:\Users\*****\Documents\Thumbs.db
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-27 09:50
==================== End Of Log ============================
--- --- --- Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-01-2015
Ran by ***** at 2015-01-02 14:05:24
Running from C:\Users\*****\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: G DATA INTERNET SECURITY (Disabled - Up to date) {545C8713-0744-B079-87F8-349A6D5C8CF0}
AS: G DATA INTERNET SECURITY (Disabled - Up to date) {EF3D66F7-217E-BFF7-BD48-0FE816DBC64D}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: G DATA Personal Firewall (Enabled) {6C670636-4D2B-B121-ACA7-9DAF938FCB8B}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Acronis*True*Image*Home 2011 (HKLM-x32\...\{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}) (Version: 14.0.6868 - Acronis)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bluetooth Win7 Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.2.0.45 - Atheros Communications)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden
C5300 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
Dell Driver Download Manager (HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1207.101.225 - ALPS ELECTRIC CO., LTD.)
Dell WLAN and Bluetooth Client Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 9.0 - Dell Inc.)
Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden
devolo dLAN Cockpit (HKLM-x32\...\dlancockpit) (Version: 1.0 - devolo AG)
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
dLAN Cockpit (x32 Version: 1.19.07 - devolo AG) Hidden
Firebird SQL Server - MAGIX Edition (HKLM-x32\...\{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}) (Version: 2.1.27.0 - MAGIX AG)
G DATA INTERNET SECURITY (HKLM-x32\...\{85203592-3610-4FB9-AA11-15B2255B5A12}) (Version: 25.0.2.3 - G DATA Software AG)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)
Google Earth (HKLM-x32\...\{96AD3B61-EAE2-11E2-9E72-B8AC6F98CCE3}) (Version: 7.1.1.1888 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart C5300 All-In-One Driver Software 13.0 Rel. 4 (HKLM\...\{6FA29B87-FED3-45A1-8A95-2FDEE0F6DD18}) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (HKLM\...\{A0E106D2-4815-4B7A-BAA7-7E21B530CFB4}) (Version: 1.1.0.0157 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{451A5ECC-C9A5-4944-B28D-23656C9E03D0}) (Version: 14.1.2000 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.9.4.1000 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.20 - Intel(R) Corporation) Hidden
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.36 - Irfan Skiljan)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
MAGIX Screenshare (HKLM-x32\...\{0BEB1F3E-D965-460B-B7D6-4E4B50A679A7}) (Version: 4.3.6.1987 - MAGIX AG)
MAGIX Speed burnR (MSI) (HKLM-x32\...\{842030D5-3615-43D1-A0CB-644C8D70E957}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Video deluxe 17 Premium Sonderedition Download-Version (HKLM-x32\...\MAGIX_MSI_Videodeluxe17_premium) (Version: 10.0.11.0 - MAGIX AG)
MAGIX Video deluxe 17 Premium Sonderedition Download-Version (x32 Version: 10.0.11.0 - MAGIX AG) Hidden
MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nero BurnExpress (HKLM-x32\...\{B6FA065F-E1FF-4391-8725-28FDE89B0009}) (Version: 10.0.11100 - Nero AG)
Nero BurnRights 10 (HKLM-x32\...\{943CFD7D-5336-47AF-9418-E02473A5A517}) (Version: 4.0.11200.14.100 - Nero AG)
Nero Express 10 (HKLM-x32\...\{70550193-1C22-445C-8FA4-564E155DB1A7}) (Version: 10.0.11700.18.100 - Nero AG)
Nero Update (HKLM-x32\...\{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}) (Version: 1.0.0018 - Nero AG)
Netzmanager (Version: 1.081 - Deutsche Telekom AG, Marmiko IT-Solutions GmbH) Hidden
NVIDIA 3D Vision Controller-Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.75 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
OpenOffice.org 3.3 (HKLM-x32\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
PS_AIO_04_C5300_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden
PxMergeModule (x32 Version: 1.00.0000 - Your Company Name) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.0.15 - Dell Inc.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.90.826.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7399 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30127 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.39.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.39.0 - Renesas Electronics Corporation) Hidden
Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden
Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer)
Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.340 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.340 - TuneUp Software) Hidden
TuneUp Utilities Language Pack (de-DE) (x32 Version: 13.0.4000.245 - TuneUp Software) Hidden
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden
Validity Sensors DDK (HKLM\...\{10AAF056-7792-497A-ACAF-3BF002196574}) (Version: 4.3.33.0 - Validity Sensors, Inc.)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden
WinRAR 4.00 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH)
Wise Care 365 version 2.05 (HKLM-x32\...\{E864A1C8-EEE1-47D0-A7F8-00CC86D26D5E}_is1) (Version: 3.3.5 - WiseCleaner.com, Inc.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
27-12-2014 08:25:38 Installed Adobe Reader XI - Deutsch.
27-12-2014 08:47:45 Removed Adobe Reader XI (11.0.10) - Deutsch.
27-12-2014 10:18:58 Installed Adobe Reader XI - Deutsch.
27-12-2014 10:37:02 Removed Adobe Reader XI (11.0.10) - Deutsch.
27-12-2014 12:13:16 Removed Adobe Reader XI (11.0.10) - Deutsch.
27-12-2014 12:34:56 Installed Adobe Reader XI - Deutsch.
27-12-2014 12:55:42 Removed Adobe Reader XI (11.0.10) - Deutsch.
28-12-2014 12:42:54 Installed Adobe Reader XI - Deutsch.
28-12-2014 12:45:04 Removed Adobe Reader XI (11.0.10) - Deutsch.
29-12-2014 13:11:54 Installed Adobe Reader XI - Deutsch.
29-12-2014 13:13:47 Removed Adobe Reader XI (11.0.10) - Deutsch.
01-01-2015 13:01:55 Windows Update
02-01-2015 11:10:45 Entfernt AccelerometerP11
02-01-2015 11:15:10 Removed Java 7 Update 25 (64-bit)
02-01-2015 11:15:47 Removed Java 7 Update 67
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2011-09-01 13:55 - 00000854 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 activate.adobe.com
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0529BB35-38E0-4B4C-8B53-1A3204DD1045} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {28E20713-6F6F-48DF-AD01-C550D15D4935} - System32\Tasks\Wise Care 365 PC Checkup Task => C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe [2014-12-18] (WiseCleaner.com)
Task: {329DF1A8-5F9B-4820-9CFC-800C1D94BD84} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-10-07] (Oracle Corporation)
Task: {41BADFC1-6C86-4C61-AD1C-3FD736BD5FCB} - System32\Tasks\{507228F1-4939-42D1-8573-5307509C8430} => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
Task: {42D34B1F-D472-408D-94D4-350360A0FB2E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {45F28D45-59FD-4AD3-8C2E-44A712B45BF7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-27] (Google Inc.)
Task: {51F7CDDE-6813-4A6E-A6B2-0D969EA3A1AF} - System32\Tasks\Wise Care 365 => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe [2014-10-28] (WiseCleaner.com)
Task: {56D51AC9-E6BC-4FF7-BBEA-F1F278F0EFCF} - System32\Tasks\{497CB313-A342-4F5A-A928-420FF337FDE0} => pcalua.exe -a D:\setup.exe -d D:\
Task: {75B11232-F5C7-4365-B8A7-0B6CBAA8004C} - System32\Tasks\{6FE3ED12-E100-4906-BA67-846F622C3123} => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
Task: {8DC6E674-D656-44A7-877A-CB8028F858FE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {8E3C774C-42EC-461E-B3B5-E3CE4A033C8E} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2014-07-16] (TuneUp Software)
Task: {986CA9DC-769A-442C-B45E-6DC8A383B15C} - System32\Tasks\AdobeAAMUpdater-1.0-*****-PC-***** => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-03-06] (Adobe Systems Incorporated)
Task: {9C98F3E1-CB55-4211-83B6-1993D1B021DD} - System32\Tasks\{02331FDB-A0B1-467B-83C1-814155B4DAD1} => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe
Task: {9DDC2482-9795-474E-A85E-682B85A91B57} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => C:\Program Files\Microsoft Security Client\MpCmdRun.exe
Task: {A7474C4F-1E7A-4931-92EA-0EFDEA30CBEB} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {ACEC1554-944F-472D-AB64-C701D9B7B1BB} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2014-12-01] (Apple Inc.)
Task: {C26F2DDB-46C9-41FA-BCE2-CF829A5391EF} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [2013-05-30] (Hewlett-Packard)
Task: {C48EECB6-3907-471E-89F1-BEE341482A01} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Device Center\ipoint.exe
Task: {C79EACE8-7FC4-4822-9E5B-5737C20CC66C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-27] (Google Inc.)
Task: {CFF691F3-E601-478B-AA84-ECF9D33C80F6} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => C:\Program Files\Microsoft Device Center\devicecenter.exe
Task: {D0E4A57F-E8DE-43E9-BC4F-C071E51ED987} - System32\Tasks\Wise Turbo Checker => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe [2014-06-23] (WiseCleaner.COM)
Task: {D2BBF81E-F63F-44A0-A1DA-52750AC1C2CD} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Device Center\itype.exe
Task: {E6FFB76D-F3B6-4B38-AFB2-3E7D1BC4A911} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {F098F821-6440-493B-8E66-DE0A1D1851A6} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Wise Care 365 PC Checkup Task.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseCare365.exe
Task: C:\Windows\Tasks\Wise Care 365.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
Task: C:\Windows\Tasks\Wise Turbo Checker.job => C:\Program Files (x86)\Wise\Wise Care 365\WiseTurbo.exe
==================== Loaded Modules (whitelisted) =============
2011-08-01 12:08 - 2014-11-13 01:20 - 00013120 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2012-09-18 17:53 - 2014-11-12 22:56 - 00118080 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-06-16 10:37 - 2011-06-16 10:37 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2010-07-19 18:57 - 2010-07-19 18:57 - 02231616 _____ () C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
2014-07-16 09:24 - 2014-07-16 09:24 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2014-05-20 02:38 - 2014-05-20 02:38 - 00340088 ____N () C:\Program Files (x86)\Common Files\G Data\AVKProxy\PktIcpt2x64.dll
2011-08-01 12:08 - 2014-11-13 01:20 - 00010952 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-10-11 12:06 - 2014-10-11 12:06 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-12-14 10:32 - 2014-12-06 02:50 - 01077064 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libglesv2.dll
2014-12-14 10:32 - 2014-12-06 02:50 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\libegl.dll
2014-12-14 10:32 - 2014-12-06 02:50 - 09009480 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\pdf.dll
2014-12-14 10:32 - 2014-12-06 02:50 - 01677128 _____ () C:\Program Files (x86)\Google\Chrome\Application\39.0.2171.95\ffmpegsumo.dll
2014-10-10 09:37 - 2014-10-10 09:37 - 01243936 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\*****\AppData\Local\k9nHX7IOmXqVR9:W4zePrRfZTOml8lpckElnsU4nR
AlternateDataStreams: C:\Users\*****\AppData\Local\Temp:TskgFdUCJ11cCfXUGTCO
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
MSCONFIG\startupfolder: C:^Users^*****^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Netzmanager.lnk => C:\Windows\pss\Netzmanager.lnk.Startup
MSCONFIG\startupreg: Acronis Scheduler2 Service => "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe"
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: AthBtTray => "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AthBtTray.exe"
MSCONFIG\startupreg: AtherosBtStack => "C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe"
MSCONFIG\startupreg: Browser Infrastructure Helper => C:\Users\*****\AppData\Local\Smartbar\Application\SnapDo.exe startup
MSCONFIG\startupreg: EPSON SX218 Series => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGDE.EXE /FU "C:\Windows\TEMP\E_SFED7.tmp" /EF "HKCU"
MSCONFIG\startupreg: FreeFallProtection => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
MSCONFIG\startupreg: IAStorIcon => "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" "C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" 60
MSCONFIG\startupreg: MSC => "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
MSCONFIG\startupreg: NUSB3MON => "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe"
MSCONFIG\startupreg: SAOB Monitor => C:\Program Files (x86)\Acronis\OnlineBackupStandalone\TrueImageMonitor.exe
MSCONFIG\startupreg: T-Online_Software_6 =>
MSCONFIG\startupreg: TrueImageMonitor.exe => "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe"
MSCONFIG\startupreg: Yontoo Desktop => "C:\Users\*****\AppData\Roaming\Yontoo\YontooDesktop.exe"
========================= Accounts: ==========================
Administrator (S-1-5-21-4134469327-3428918013-2508645811-500 - Administrator - Disabled)
Gast (S-1-5-21-4134469327-3428918013-2508645811-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-4134469327-3428918013-2508645811-1018 - Limited - Enabled)
***** (S-1-5-21-4134469327-3428918013-2508645811-1000 - Administrator - Enabled) => C:\Users\*****
==================== Faulty Device Manager Devices =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/02/2015 01:57:58 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -Embedding; Beschreibung = Configured Microsoft Office Professional 2010; Fehler = 0x8007043c).
Error: (01/02/2015 11:32:25 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (01/02/2015 11:32:25 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (01/02/2015 11:29:45 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (01/02/2015 11:29:44 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (01/02/2015 11:13:54 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI3796.tmp
Error: (01/02/2015 11:13:49 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSIAA54.tmp
Error: (01/02/2015 11:12:48 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI22EC.tmp
Error: (01/02/2015 11:12:38 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSIEDE6.tmp
Error: (01/02/2015 11:04:04 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
System errors:
=============
Error: (01/02/2015 02:03:58 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126
Error: (01/02/2015 02:03:28 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126
Error: (01/02/2015 02:03:22 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126
Error: (01/02/2015 02:01:51 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126
Error: (01/02/2015 02:01:51 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {10DA4F3C-CC99-4190-BE4D-58330754E882}
Error: (01/02/2015 02:01:21 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126
Error: (01/02/2015 01:57:58 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084MSIServer{000C101C-0000-0000-C000-000000000046}
Error: (01/02/2015 01:55:46 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/02/2015 01:55:46 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (01/02/2015 01:55:46 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Microsoft Office Sessions:
=========================
Error: (01/02/2015 01:57:58 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe Files (x86)\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingConfigured Microsoft Office Professional 20100x8007043c
Error: (01/02/2015 11:32:25 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
Error: (01/02/2015 11:32:25 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu (1).exe
Error: (01/02/2015 11:29:45 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu (1).exe
Error: (01/02/2015 11:29:44 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\*****\Downloads\esetsmartinstaller_deu.exe
Error: (01/02/2015 11:13:54 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI3796.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (01/02/2015 11:13:49 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSIAA54.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (01/02/2015 11:12:48 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationFailed, entry: InstallationFailed, library: C:\Windows\Installer\MSI22EC.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (01/02/2015 11:12:38 AM) (Source: MsiInstaller) (EventID: 11723) (User: *****-PC)
Description: Product: Snap.Do -- Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action InstallationStartUninstall, entry: InstallationStartUninstall, library: C:\Windows\Installer\MSIEDE6.tmp (NULL)(NULL)(NULL)(NULL)(NULL)
Error: (01/02/2015 11:04:04 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-2410M CPU @ 2.30GHz
Percentage of memory in use: 32%
Total physical RAM: 8106.17 MB
Available physical RAM: 5447.6 MB
Total Pagefile: 16210.52 MB
Available Pagefile: 13322.54 MB
Total Virtual: 8192 MB
Available Virtual: 8191.86 MB
==================== Drives ================================
Drive b: (Daten) (Fixed) (Total:356.84 GB) (Free:356.73 GB) NTFS
Drive c: (Windows) (Fixed) (Total:341.7 GB) (Free:269.76 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 698.6 GB) (Disk ID: 07F2837E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=341.7 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=356.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
02.01.2015, 14:23
| #4 |
| | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader gmer.log Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-02 14:13:19
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000007b WDC_____ rev.01.0 698,64GB
Running: gmer.exe; Driver: C:\Users\*****\AppData\Local\Temp\kgxyrpob.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960001a4300 7 bytes [00, A1, F3, FF, 41, B4, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff960001a4308 3 bytes [00, 07, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000779da400 7 bytes JMP 000000016fff0228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000779e3f20 5 bytes JMP 000000016fff0180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000779fffb0 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077a0f2e0 5 bytes JMP 000000016fff0110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077a39a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077a494c0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077a687e0 7 bytes JMP 000000016fff01f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[1572] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000779da400 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000779e3f20 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000779fffb0 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077a0f2e0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077a39a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077a494c0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077a687e0 7 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1604] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef8d2dc88 5 bytes JMP 000007fff8b200d8
.text C:\Windows\system32\Dwm.exe[1908] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef8d2de10 5 bytes JMP 000007fff8b20110
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000779da400 7 bytes JMP 000000016fff0228
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000779e3f20 5 bytes JMP 000000016fff0180
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000779fffb0 5 bytes JMP 000000016fff01b8
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077a0f2e0 5 bytes JMP 000000016fff0110
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077a39a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077a494c0 5 bytes JMP 000000016fff0148
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077a687e0 7 bytes JMP 000000016fff01f0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GdBgInx64.exe[2372] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\Common Files\G DATA\AVKProxy\GDKBFltExe32.exe[2716] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3028] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000779da400 7 bytes JMP 000000016fff0228
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000779e3f20 5 bytes JMP 000000016fff0180
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000779fffb0 5 bytes JMP 000000016fff01b8
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077a0f2e0 5 bytes JMP 000000016fff0110
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077a39a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077a494c0 5 bytes JMP 000000016fff0148
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077a687e0 7 bytes JMP 000000016fff01f0
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe[2224] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000779da400 7 bytes JMP 000000016fff0228
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000779e3f20 5 bytes JMP 000000016fff0180
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000779fffb0 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077a0f2e0 5 bytes JMP 000000016fff0110
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077a39a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077a494c0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077a687e0 7 bytes JMP 000000016fff01f0
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2284] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe[2472] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe[2564] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076101401 2 bytes JMP 768eb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076101419 2 bytes JMP 768eb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076101431 2 bytes JMP 76968ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007610144a 2 bytes CALL 768c48ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000761014dd 2 bytes JMP 769687a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000761014f5 2 bytes JMP 76968978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007610150d 2 bytes JMP 76968698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076101525 2 bytes JMP 76968a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007610153d 2 bytes JMP 768dfca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076101555 2 bytes JMP 768e68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007610156d 2 bytes JMP 76968f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076101585 2 bytes JMP 76968ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007610159d 2 bytes JMP 7696865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000761015b5 2 bytes JMP 768dfd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000761015cd 2 bytes JMP 768eb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000761016b2 2 bytes JMP 76968e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000761016bd 2 bytes JMP 769685f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[2800] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076101401 2 bytes JMP 768eb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076101419 2 bytes JMP 768eb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076101431 2 bytes JMP 76968ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007610144a 2 bytes CALL 768c48ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000761014dd 2 bytes JMP 769687a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000761014f5 2 bytes JMP 76968978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007610150d 2 bytes JMP 76968698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076101525 2 bytes JMP 76968a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007610153d 2 bytes JMP 768dfca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076101555 2 bytes JMP 768e68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007610156d 2 bytes JMP 76968f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076101585 2 bytes JMP 76968ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007610159d 2 bytes JMP 7696865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000761015b5 2 bytes JMP 768dfd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000761015cd 2 bytes JMP 768eb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000761016b2 2 bytes JMP 76968e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe[2300] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000761016bd 2 bytes JMP 769685f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000779da400 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000779e3f20 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000779fffb0 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077a0f2e0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077a39a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077a494c0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077a687e0 7 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3124] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe[3196] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3216] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Windows\system32\taskeng.exe[3416] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Windows\system32\taskeng.exe[3728] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3752] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3752] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3752] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3752] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3752] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3752] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3956] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3956] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3956] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[3956] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000076101401 2 bytes JMP 768eb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000076101419 2 bytes JMP 768eb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000076101431 2 bytes JMP 76968ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007610144a 2 bytes CALL 768c48ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000761014dd 2 bytes JMP 769687a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000761014f5 2 bytes JMP 76968978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007610150d 2 bytes JMP 76968698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000076101525 2 bytes JMP 76968a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007610153d 2 bytes JMP 768dfca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000076101555 2 bytes JMP 768e68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007610156d 2 bytes JMP 76968f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000076101585 2 bytes JMP 76968ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007610159d 2 bytes JMP 7696865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000761015b5 2 bytes JMP 768dfd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000761015cd 2 bytes JMP 768eb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000761016b2 2 bytes JMP 76968e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[4416] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000761016bd 2 bytes JMP 769685f1 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Windows\System32\mobsync.exe[4928] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe[5612] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000779da400 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000779e3f20 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000779fffb0 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077a0f2e0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077a39a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077a494c0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077a687e0 7 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdb82db0 5 bytes JMP 000007fffdb70180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdb837d0 7 bytes JMP 000007fffdb700d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdb88ef0 6 bytes JMP 000007fffdb70148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdb9af60 5 bytes JMP 000007fffdb70110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe887490 11 bytes JMP 000007fffdb70228
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe89bf00 7 bytes JMP 000007fffdb70260
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefea789f0 8 bytes JMP 000007fffdb701f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefea7be50 8 bytes JMP 000007fffdb701b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\d3d9.dll!Direct3DCreate9Ex 000007feecd82460 5 bytes JMP 000007fefdb702d0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[6020] C:\Windows\system32\d3d9.dll!Direct3DCreate9 000007feecdb96b0 6 bytes JMP 000007fefdb70298
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[6072] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe[6992] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe[7052] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000075fb5ea5 5 bytes JMP 0000000172963a00
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe[7096] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000075fe9d0b 5 bytes JMP 0000000172963990
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076101401 2 bytes JMP 768eb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076101419 2 bytes JMP 768eb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076101431 2 bytes JMP 76968ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007610144a 2 bytes CALL 768c48ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000761014dd 2 bytes JMP 769687a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000761014f5 2 bytes JMP 76968978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007610150d 2 bytes JMP 76968698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076101525 2 bytes JMP 76968a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007610153d 2 bytes JMP 768dfca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076101555 2 bytes JMP 768e68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007610156d 2 bytes JMP 76968f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076101585 2 bytes JMP 76968ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007610159d 2 bytes JMP 7696865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000761015b5 2 bytes JMP 768dfd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000761015cd 2 bytes JMP 768eb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000761016b2 2 bytes JMP 76968e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5724] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000761016bd 2 bytes JMP 769685f1 C:\Windows\syswow64\kernel32.dll
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 00000000768c1f0e 7 bytes JMP 0000000172964b10
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 00000000768c5bad 7 bytes JMP 00000001729654b0
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000768d1409 7 bytes JMP 0000000172964e50
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 00000000768dea45 7 bytes JMP 0000000172964b00
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076968e24 7 bytes JMP 00000001729645c0
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076968ea9 5 bytes JMP 0000000172964670
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000769691ff 5 bytes JMP 00000001729645d0
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075ce1d29 5 bytes JMP 0000000172964580
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075ce1dd7 5 bytes JMP 0000000172964540
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075ce2ab1 5 bytes JMP 0000000172964680
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075ce2d17 5 bytes JMP 0000000172964360
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007780e96b 5 bytes JMP 0000000172963b60
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007780eba5 5 bytes JMP 0000000172963b80
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000075d88a29 5 bytes JMP 0000000172963a40
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075d94572 5 bytes JMP 00000001729642e0
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000075dae567 5 bytes JMP 0000000172964350
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW 0000000075dd07d7 5 bytes JMP 0000000172963850
.text C:\Users\*****\Desktop\gmer.exe[2272] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000075de7a5c 5 bytes JMP 00000001729642d0
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3752:4620] 000007fef24af5f8
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3752:4628] 000007fef234bc60
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [3956:3016] 000007fef234bc60
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ac72891869c3
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ac72891869c3 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 02.01.2015 Scan Time: 13:33:30 Logfile: mbam.txt Administrator: Yes Version: 2.00.4.1028 Malware Database: v2015.01.02.04 Rootkit Database: v2014.12.30.01 License: Free Malware Protection: Disabled Malicious Website Protection: Disabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: ***** Scan Type: Threat Scan Result: Completed Objects Scanned: 423795 Time Elapsed: 8 min, 50 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Disabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 4 PUP.Optional.LyricsAd.Gen, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{b739efab-2db0-44d3-a933-95072e08c995}, , [415b17dbf495eb4b9941444554b147b9], PUP.Optional.LyricsAd.Gen, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{B739EFAB-2DB0-44D3-A933-95072E08C995}, , [415b17dbf495eb4b9941444554b147b9], PUP.Optional.LyricsAd.Gen, HKU\S-1-5-21-4134469327-3428918013-2508645811-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{B739EFAB-2DB0-44D3-A933-95072E08C995}, , [415b17dbf495eb4b9941444554b147b9], PUP.Optional.LyricsAd.Gen, HKU\S-1-5-21-4134469327-3428918013-2508645811-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{B739EFAB-2DB0-44D3-A933-95072E08C995}, , [415b17dbf495eb4b9941444554b147b9], Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 1 PUP.Optional.SnapDo.A, C:\Windows\Installer\bec56.msi, , [e8b422d0028769cd25fd72327a8729d7], Physical Sectors: 0 (No malicious items detected) (end) Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:27 on 02/01/2015 (*****)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
|
|
02.01.2015, 15:27
| #5 | |
| /// the machine /// TB-Ausbilder | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat ReaderZitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
02.01.2015, 15:46
| #6 |
| | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader OK. Das Programm Adobe Reader habe ich deinstalliert. Ich habe die Datei c:\windows\System32\drivers\etc hosts bearbeitet und den Link herausgeworfen. Nach Neustart erneuter Durchlauf mit FRST: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-01-2015
Ran by ***** (administrator) on *****-PC on 02-01-2015 15:54:16
Running from C:\Users\*****\Desktop
Loaded Profile: ***** (Available profiles: ***** & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Validity Sensors, Inc.) C:\Windows\System32\vcsFPService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GdBgInx64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\GDKBFltExe32.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(WiseCleaner.com) C:\Program Files (x86)\Wise\Wise Care 365\WiseTray.exe
(Atheros) C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Atheros Commnucations) C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
() C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(G Data Software AG) C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(G Data Software AG) C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKBap64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [BLEServicesCtrl] => C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [184632 2013-10-18] (Motorola Solutions, Inc.)
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-24] (Intel Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7659736 2014-11-26] (Realtek Semiconductor)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [GDFirewallTray] => C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFirewallTray.exe [1756792 2014-05-20] (G Data Software AG)
HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files (x86)\G Data\InternetSecurity\AVKTray\AVKTray.exe,c:\program files (x86)\g data\internetsecurity\avkkid\avkcks.exe,
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-20\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Run: [iCloudDrive] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudDrive.exe [43816 2014-10-20] (Apple Inc.)
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [43816 2014-11-21] (Apple Inc.)
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Policies\Explorer: [NoLowDiskSpaceChecks] 1
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
HKU\S-1-5-18\...\Winlogon: [Shell] C:\Windows\explorer.exe [2871808 2011-02-25] (Microsoft Corporation) <==== ATTENTION
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174856 2014-11-13] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [156840 2014-11-13] (NVIDIA Corporation)
AppInit_DLLs-x32: , C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-11-13] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-4134469327-3428918013-2508645811-1000 -> {9C4FF0DA-599C-4FD5-9193-E34F8C206E7E} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\doz791p9.default
FF Homepage: hxxp://www.t-online.de/
FF Plugin: @java.com/DTPlugin,version=10.25.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Extension: Adblock Edge - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\doz791p9.default\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2015-01-02]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-10-30]
FF HKU\S-1-5-21-4134469327-3428918013-2508645811-1000\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> "https://www.google.de/"
CHR Profile: C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-27]
CHR Extension: (Google Drive) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-27]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-13]
CHR Extension: (YouTube) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-27]
CHR Extension: (Google-Suche) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-27]
CHR Extension: (AdBlock) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2015-01-02]
CHR Extension: (Google Wallet) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Google Mail) - C:\Users\*****\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-27]
CHR HKLM-x32\...\Chrome\Extension: [lmgddjncmooacfihfmikfohkldcjjgml] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S4 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Dell Wireless\Ath_CoexAgent.exe [151552 2010-10-01] (Atheros) [File not signed]
R2 AtherosSvc; C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\adminservice.exe [53920 2010-12-17] (Atheros Commnucations) [File not signed]
R2 AVKProxy; C:\Program Files (x86)\Common Files\G Data\AVKProxy\AVKProxy.exe [2250360 2014-10-14] (G Data Software AG)
R2 AVKService; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKService.exe [914552 2013-12-19] (G Data Software AG)
R2 AVKWCtl; C:\Program Files (x86)\G Data\InternetSecurity\AVK\AVKWCtlx64.exe [2683760 2014-05-20] (G Data Software AG)
R2 DevoloNetworkService; C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe [2231616 2010-07-19] ()
S4 Fabs; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [1253376 2009-08-27] (MAGIX AG) [File not signed]
S4 FirebirdServerMAGIXInstance; C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [3276800 2008-08-07] (MAGIX®) [File not signed]
R3 GDFwSvc; C:\Program Files (x86)\G Data\InternetSecurity\Firewall\GDFwSvcx64.exe [3228136 2014-08-21] (G Data Software AG)
R3 GDScan; C:\Program Files (x86)\Common Files\G Data\GDScan\GDScan.exe [700536 2014-05-20] (G Data Software AG)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2014-04-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [731648 2013-02-13] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [820184 2013-02-13] (Intel(R) Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-06-16] ()
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [292568 2014-09-04] (Realtek Semiconductor)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2014-07-16] (TuneUp Software)
S2 WiseBootAssistant; C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe [580648 2012-07-17] (WiseCleaner.com) [File not signed]
S2 HPSLPSVC; C:\Users\*****\AppData\Local\Temp\7zS0188\hpslpsvc64.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [1408824 2013-10-18] (Motorola Solutions, Inc.)
R0 GDBehave; C:\Windows\System32\drivers\GDBehave.sys [55808 2014-07-03] (G Data Software AG)
R1 GDKBFlt; C:\Windows\system32\drivers\GDKBFlt64.sys [20992 2014-10-22] (G Data Software AG)
R1 GDMnIcpt; C:\Windows\system32\drivers\MiniIcpt.sys [142336 2014-08-15] (G Data Software AG)
S3 GdNetMon; C:\Windows\system32\drivers\GdNetMon64.sys [31448 2011-08-01] (G Data Software AG)
R3 GDPkIcpt; C:\Windows\system32\drivers\PktIcpt.sys [64000 2014-07-03] (G Data Software AG)
R1 gdwfpcd; C:\Windows\System32\drivers\gdwfpcd64.sys [64512 2014-10-22] (G Data Software AG)
R1 GRD; C:\Windows\system32\drivers\GRD.sys [106272 2014-05-22] (G Data Software)
R1 HookCentre; C:\Windows\system32\drivers\HookCentre.sys [61440 2014-07-03] (G Data Software AG)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-24] (Intel Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)
R2 NPF_devolo; C:\Windows\sysWOW64\drivers\npf_devolo.sys [34048 2010-06-10] (CACE Technologies)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300352 2014-11-13] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [14112 2013-08-21] (TuneUp Software)
S3 WiseHDInfo; C:\Program Files (x86)\Wise\Wise Care 365\WiseHDInfo64.dll [11304 2014-06-04] (wisecleaner.com)
S3 btmaux; system32\DRIVERS\btmaux.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 15:54 - 2015-01-02 15:54 - 00023342 _____ () C:\Users\*****\Desktop\FRST.txt
2015-01-02 15:41 - 2015-01-02 15:41 - 00000822 _____ () C:\Users\*****\Documents\hosts.txt
2015-01-02 14:29 - 2015-01-02 14:29 - 00001125 _____ () C:\Users\*****\Desktop\Anwendungen.lnk
2015-01-02 14:29 - 2015-01-02 14:29 - 00001067 _____ () C:\Users\*****\Desktop\Tools.lnk
2015-01-02 13:55 - 2015-01-02 13:55 - 917980558 _____ () C:\Windows\MEMORY.DMP
2015-01-02 13:55 - 2015-01-02 13:55 - 00442624 _____ () C:\Windows\Minidump\010215-28532-01.dmp
2015-01-02 12:10 - 2015-01-02 12:10 - 01057488 _____ (Adobe) C:\Users\*****\Downloads\install_reader11_de_mssd_aaa_aih.exe
2015-01-02 12:00 - 2015-01-02 12:00 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-01-02 12:00 - 2015-01-02 12:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-01-02 11:59 - 2015-01-02 11:59 - 00638888 _____ (Oracle Corporation) C:\Users\*****\Downloads\chromeinstall-8u25.exe
2015-01-02 11:33 - 2015-01-02 15:54 - 00000000 ____D () C:\FRST
2015-01-02 11:31 - 2015-01-02 11:31 - 00380416 _____ () C:\Users\*****\Desktop\gmer.exe
2015-01-02 11:30 - 2015-01-02 11:30 - 02123264 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe
2015-01-02 11:22 - 2015-01-02 11:22 - 00156416 _____ () C:\Users\*****\AppData\Local\GDIPFONTCACHEV1.DAT
2015-01-02 11:21 - 2015-01-02 15:50 - 00000504 _____ () C:\Windows\setupact.log
2015-01-02 11:21 - 2015-01-02 11:21 - 05077656 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-01-02 11:21 - 2015-01-02 11:21 - 00000000 _____ () C:\Windows\setuperr.log
2015-01-02 11:20 - 2015-01-02 15:49 - 00001124 _____ () C:\Windows\PFRO.log
2015-01-02 11:18 - 2014-12-09 10:04 - 00050477 _____ () C:\Users\*****\Desktop\Defogger.exe
2015-01-02 10:54 - 2015-01-02 10:54 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-02 10:52 - 2015-01-02 10:52 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\*****\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-02 10:30 - 2015-01-02 10:36 - 00001793 _____ () C:\Users\*****\Desktop\Google Chrome.lnk
2015-01-02 10:27 - 2015-01-02 14:25 - 00000000 ____D () C:\Users\*****\Desktop\dewitz
2015-01-02 10:24 - 2015-01-02 10:24 - 02347384 _____ (ESET) C:\Users\*****\Downloads\esetsmartinstaller_deu.exe
2015-01-02 09:58 - 2015-01-02 09:58 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-01 12:53 - 2015-01-02 15:48 - 00129196 _____ () C:\Windows\WindowsUpdate.log
2014-12-28 12:37 - 2014-12-28 12:37 - 00001241 _____ () C:\Users\*****\Downloads\Zipfolder_fix.zip
2014-12-27 15:36 - 2014-12-27 15:36 - 29491712 _____ () C:\Users\*****\Documents\Angela.pub 3.pub
2014-12-27 15:33 - 2014-12-27 15:33 - 33947648 _____ () C:\Users\*****\Documents\Angela.pub 2.pub
2014-12-27 12:33 - 2014-12-27 12:34 - 76313280 _____ (Adobe Systems Incorporated) C:\Users\*****\Downloads\AdbeRdr11010_de_DE.exe
2014-12-26 16:07 - 2014-12-26 16:07 - 00000000 ____D () C:\Users\*****\Sterne
2014-12-23 15:53 - 2014-12-23 15:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-12-22 10:38 - 2014-12-22 10:38 - 00001358 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2014-12-22 10:38 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2014-12-22 10:38 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2014-12-22 10:36 - 2014-12-22 10:36 - 00000000 ____D () C:\Windows\SysWOW64\NV
2014-12-22 10:36 - 2014-12-22 10:36 - 00000000 ____D () C:\Windows\system32\NV
2014-12-22 10:36 - 2014-11-12 21:46 - 00615624 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2014-12-22 10:34 - 2014-11-13 01:20 - 31893136 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 24557712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 20986592 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 20922512 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 19966344 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 18514616 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 17259664 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 16884632 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 14032984 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 13944952 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 13213512 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-12-22 10:34 - 2014-11-13 01:20 - 11397744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 11336432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 04292416 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 04011208 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 02874456 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 01876296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434475.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 01540424 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434475.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00964928 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00935240 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00923792 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00900928 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00871648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00352016 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00303600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2014-12-22 10:34 - 2014-11-13 01:20 - 00300352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvkflt.sys
2014-12-22 10:34 - 2014-11-13 01:20 - 00031560 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys
2014-12-22 10:31 - 2014-08-27 07:10 - 00942808 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2014-12-22 10:31 - 2014-08-27 07:10 - 00073800 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2014-12-22 10:25 - 2014-12-22 10:25 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2014-12-22 10:25 - 2014-12-22 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Audio
2014-12-22 10:25 - 2014-12-22 10:25 - 00000000 ____D () C:\Program Files\Realtek
2014-12-22 10:24 - 2014-12-03 13:51 - 00960728 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2014-12-22 10:24 - 2014-12-03 11:41 - 04290520 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2014-12-22 10:24 - 2014-12-03 10:15 - 01485163 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2014-12-22 10:24 - 2014-12-02 11:42 - 03218800 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2014-12-22 10:24 - 2014-12-02 09:33 - 02000640 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO264.dll
2014-12-22 10:24 - 2014-12-02 09:33 - 01728768 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO232.dll
2014-12-22 10:24 - 2014-11-27 10:06 - 72823296 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCORES64.dat
2014-12-22 10:24 - 2014-11-27 08:31 - 02823024 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll
2014-12-22 10:24 - 2014-11-19 08:42 - 01289944 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2014-12-22 10:24 - 2014-11-11 06:44 - 00631000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2014-12-22 10:24 - 2014-08-06 06:43 - 02860760 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2014-12-22 10:24 - 2014-04-10 05:19 - 02041432 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2014-12-22 10:24 - 2014-03-06 09:35 - 01959128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2014-12-22 10:24 - 2014-02-18 10:04 - 02770976 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2014-12-22 10:24 - 2014-01-08 08:25 - 00397592 _____ (Creative Technology Ltd.) C:\Windows\system32\MBWrp64.dll
2014-12-22 10:24 - 2013-08-14 08:36 - 00662784 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2014-12-22 10:24 - 2013-08-14 08:35 - 00663296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2014-12-22 10:24 - 2013-01-11 09:27 - 00628504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBTHX64.dll
2014-12-22 10:24 - 2013-01-11 09:27 - 00563992 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBTHX32.dll
2014-12-22 10:24 - 2012-06-08 09:21 - 00897152 _____ (Creative Technology Ltd.) C:\Windows\system32\MBAPO64.dll
2014-12-22 10:24 - 2012-06-08 09:21 - 00753280 _____ (Creative Technology Ltd.) C:\Windows\SysWOW64\MBAPO32.dll
2014-12-22 10:24 - 2011-12-20 08:32 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2014-12-22 10:24 - 2011-12-16 07:57 - 00065112 _____ (Creative Technology Ltd.) C:\Windows\system32\MBppld64.dll
2014-12-22 10:24 - 2011-11-22 09:28 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2014-12-22 10:24 - 2011-05-31 02:42 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2014-12-22 10:24 - 2010-11-08 00:31 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2014-12-22 10:24 - 2010-11-03 11:30 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2014-12-22 10:24 - 2010-09-27 02:34 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00518896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSX64.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00211184 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSTSH64.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00198896 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSHP64.dll
2014-12-22 10:24 - 2009-11-24 02:55 - 00155888 _____ (SRS Labs, Inc.) C:\Windows\system32\SRSWOW64.dll
2014-12-22 10:24 - 2009-11-18 00:13 - 00060504 _____ (Creative Technology Ltd.) C:\Windows\system32\MBPPCn64.dll
2014-12-22 10:23 - 2014-06-09 03:59 - 00560328 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2014-12-22 10:23 - 2013-10-11 05:47 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2014-12-22 10:23 - 2012-03-08 04:47 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2014-12-22 10:23 - 2011-05-31 02:42 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2014-12-19 16:58 - 2014-12-13 06:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-12-19 16:58 - 2014-12-13 04:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-12-14 15:37 - 2014-12-14 15:37 - 00000000 ____D () C:\Windows\system32\appraiser
2014-12-14 13:36 - 2014-10-18 03:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2014-12-14 13:36 - 2014-10-18 02:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2014-12-14 11:53 - 2014-12-14 11:53 - 03981488 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-12-14 10:29 - 2014-12-04 03:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-12-14 10:29 - 2014-12-04 03:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-12-14 10:29 - 2014-12-04 03:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-12-14 10:29 - 2014-12-02 00:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2014-12-14 10:29 - 2014-11-27 02:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-12-14 10:29 - 2014-11-27 02:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-12-14 10:29 - 2014-11-22 04:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-12-14 10:29 - 2014-11-22 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-12-14 10:29 - 2014-11-22 04:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-12-14 10:29 - 2014-11-22 03:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-12-14 10:29 - 2014-11-22 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-12-14 10:29 - 2014-11-22 03:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-12-14 10:29 - 2014-11-22 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-12-14 10:29 - 2014-11-22 03:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-12-14 10:29 - 2014-11-22 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-12-14 10:29 - 2014-11-22 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-12-14 10:29 - 2014-11-22 03:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-12-14 10:29 - 2014-11-22 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-12-14 10:29 - 2014-11-22 03:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-12-14 10:29 - 2014-11-22 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-12-14 10:29 - 2014-11-22 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-12-14 10:29 - 2014-11-22 03:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-12-14 10:29 - 2014-11-22 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-12-14 10:29 - 2014-11-22 03:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-12-14 10:29 - 2014-11-22 03:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-12-14 10:29 - 2014-11-22 03:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-12-14 10:29 - 2014-11-22 03:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-12-14 10:29 - 2014-11-22 03:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-12-14 10:29 - 2014-11-22 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-12-14 10:29 - 2014-11-22 03:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-12-14 10:29 - 2014-11-22 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-12-14 10:29 - 2014-11-22 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-12-14 10:29 - 2014-11-22 03:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-12-14 10:29 - 2014-11-22 02:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-12-14 10:29 - 2014-11-22 02:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-12-14 10:29 - 2014-11-22 02:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-12-14 10:29 - 2014-11-22 02:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-12-14 10:29 - 2014-11-22 02:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-12-14 10:29 - 2014-11-22 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-12-14 10:29 - 2014-11-22 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-12-14 10:29 - 2014-11-22 02:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-12-14 10:29 - 2014-11-22 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-12-14 10:29 - 2014-11-22 02:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-12-14 10:29 - 2014-11-22 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-12-14 10:29 - 2014-11-22 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-12-14 10:29 - 2014-11-22 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-12-14 10:29 - 2014-11-22 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-12-14 10:29 - 2014-11-22 02:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-12-14 10:29 - 2014-11-22 02:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-12-14 10:29 - 2014-11-22 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-12-14 10:29 - 2014-11-22 02:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-12-14 10:29 - 2014-11-22 02:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-12-14 10:29 - 2014-11-22 02:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-12-14 10:29 - 2014-11-22 02:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-12-14 10:29 - 2014-11-22 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-12-14 10:29 - 2014-11-22 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-12-14 10:29 - 2014-11-22 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-12-14 10:29 - 2014-11-22 01:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-12-14 10:29 - 2014-11-11 04:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2014-12-14 10:29 - 2014-11-11 03:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2014-12-14 10:29 - 2014-11-11 02:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys
2014-12-14 10:28 - 2014-11-08 04:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-12-14 10:28 - 2014-11-08 03:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-12-14 10:28 - 2014-10-30 03:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe
2014-12-14 10:28 - 2014-10-30 02:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe
2014-12-14 10:28 - 2014-10-03 03:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll
2014-12-14 10:28 - 2014-10-03 03:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll
2014-12-14 10:28 - 2014-10-03 03:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll
2014-12-14 10:28 - 2014-10-03 03:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll
2014-12-14 10:28 - 2014-10-03 03:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe
2014-12-14 10:28 - 2014-10-03 02:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll
2014-12-14 10:28 - 2014-10-03 02:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll
2014-12-14 10:28 - 2014-10-03 02:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll
2014-12-14 10:28 - 2014-10-03 02:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll
2014-12-14 10:28 - 2014-10-03 02:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe
2014-12-09 17:07 - 2014-12-09 17:07 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2014-12-03 12:15 - 2014-12-03 12:15 - 00016282 _____ () C:\Users\*****\Documents\Fwd neues Video in YouTube.html
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-02 15:53 - 2014-11-05 13:43 - 00006463 _____ () C:\Windows\SysWOW64\Gms.log
2015-01-02 15:51 - 2013-04-22 15:08 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Wise Care 365
2015-01-02 15:50 - 2014-10-26 10:44 - 00000000 ___RD () C:\Users\*****\iCloudDrive
2015-01-02 15:50 - 2013-10-21 09:40 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-01-02 15:50 - 2013-08-22 13:54 - 00000438 _____ () C:\Windows\Tasks\Wise Care 365.job
2015-01-02 15:49 - 2011-08-01 12:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-02 15:49 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-02 15:37 - 2011-08-01 11:34 - 00000000 ____D () C:\ProgramData\Adobe
2015-01-02 15:37 - 2011-08-01 11:34 - 00000000 ____D () C:\Program Files (x86)\Adobe
2015-01-02 15:31 - 2013-04-27 12:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-01-02 15:12 - 2011-08-23 14:22 - 00000000 ____D () C:\Users\*****\AppData\Local\Deployment
2015-01-02 14:08 - 2009-07-14 05:45 - 00026128 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-02 14:08 - 2009-07-14 05:45 - 00026128 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-02 13:55 - 2011-08-03 14:59 - 00000000 ____D () C:\Windows\Minidump
2015-01-02 13:20 - 2011-08-01 10:37 - 00000000 ____D () C:\Users\*****
2015-01-02 13:19 - 2011-08-01 14:40 - 00000000 ____D () C:\Users\*****\AppData\Local\G DATA
2015-01-02 12:00 - 2014-06-21 12:23 - 00000000 ____D () C:\ProgramData\Oracle
2015-01-02 12:00 - 2011-08-23 14:09 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-02 11:32 - 2009-07-14 18:58 - 00700736 _____ () C:\Windows\system32\perfh007.dat
2015-01-02 11:32 - 2009-07-14 18:58 - 00150342 _____ () C:\Windows\system32\perfc007.dat
2015-01-02 11:32 - 2009-07-14 06:13 - 01624178 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-01-02 11:12 - 2011-08-23 15:23 - 00009440 _____ () C:\freefallprotection.log
2015-01-02 11:07 - 2012-09-18 16:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Genius Professional Edition
2015-01-02 11:07 - 2011-08-01 11:44 - 00000000 ____D () C:\Users\*****\Downloads\Tools
2015-01-02 10:07 - 2011-08-01 11:23 - 00002048 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-01-02 09:52 - 2011-08-01 11:34 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2014-12-29 12:39 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-12-27 10:51 - 2014-10-25 20:50 - 00000000 ____D () C:\Users\*****\Documents\Outlook-Dateien
2014-12-27 10:50 - 2014-10-26 16:31 - 00000000 ____D () C:\Users\*****\AppData\Local\7153AFC5-C070-4465-9E9C-129527797883.aplzod
2014-12-27 10:00 - 2013-04-27 09:16 - 00000418 _____ () C:\Windows\Tasks\Wise Turbo Checker.job
2014-12-27 08:28 - 2011-08-01 11:34 - 00000000 ____D () C:\Users\*****\AppData\Roaming\Adobe
2014-12-27 08:13 - 2011-08-01 13:34 - 00000000 ____D () C:\Users\*****\Downloads\Anwendungen
2014-12-26 18:15 - 2012-05-13 16:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-12-22 10:45 - 2014-11-26 16:17 - 00000000 ____D () C:\Users\*****\AppData\Roaming\HpUpdate
2014-12-22 10:37 - 2012-09-18 17:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2014-12-22 10:37 - 2011-08-01 12:10 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-12-22 10:31 - 2011-08-01 10:58 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-12-22 10:25 - 2012-09-18 17:44 - 00000000 ___HD () C:\Program Files (x86)\Temp
2014-12-22 10:23 - 2011-08-01 10:58 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-12-21 15:35 - 2014-05-02 11:47 - 00000000 ____D () C:\Users\*****\AppData\Roaming\TeamViewer
2014-12-21 14:41 - 2014-06-21 12:26 - 00000000 ____D () C:\Users\*****\AppData\Roaming\WiseUpdate
2014-12-14 15:37 - 2014-05-02 09:49 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-12-14 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-12-14 15:37 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\AppCompat
2014-12-14 13:45 - 2014-02-11 14:17 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-12-14 13:44 - 2013-08-06 15:52 - 00000000 ____D () C:\Windows\system32\MRT
2014-12-14 13:38 - 2011-08-01 11:38 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-12-14 11:35 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-12-14 10:31 - 2014-02-11 14:17 - 00000000 ____D () C:\Users\*****\AppData\Local\Microsoft Help
2014-12-13 01:12 - 2014-07-31 18:42 - 01715224 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2014-12-13 01:12 - 2014-07-31 18:42 - 01291464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2014-12-13 01:12 - 2014-02-11 17:06 - 02824504 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2014-12-13 01:12 - 2014-02-11 17:06 - 02210040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2014-12-09 17:23 - 2011-08-01 16:26 - 00000000 ____D () C:\Users\*****\Documents\Anschriften
2014-12-03 15:48 - 2011-08-01 13:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T-Online
2014-12-03 12:14 - 2014-11-22 09:57 - 00022528 ___SH () C:\Users\*****\Documents\Thumbs.db
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\Quarantine.exe
C:\Users\*****\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-12-27 09:50
==================== End Of Log ============================
Geändert von stkolibri (02.01.2015 um 16:13 Uhr) |
|
02.01.2015, 17:56
| #7 |
| /// the machine /// TB-Ausbilder | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Kopiere den Text in der Codebox in deinen Editor (z.B. Notepad) und speichere es unter dem Namen regfix.reg (bei Dateityp bitte "alle Dateien" wählen) Code:
ATTFilter Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\.lnk]
@="lnkfile"
[HKEY_CLASSES_ROOT\.lnk\ShellEx]
[HKEY_CLASSES_ROOT\.lnk\ShellEx\{000214EE-0000-0000-C000-000000000046}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT\.lnk\ShellEx\{000214F9-0000-0000-C000-000000000046}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT\.lnk\ShellEx\{00021500-0000-0000-C000-000000000046}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT\.lnk\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT\.lnk\ShellNew]
"Handler"="{ceefea1b-3e29-4ef1-b34c-fec79c4f70af}"
"IconPath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,73,\
00,68,00,65,00,6c,00,6c,00,33,00,32,00,2e,00,64,00,6c,00,6c,00,2c,00,2d,00,\
31,00,36,00,37,00,36,00,39,00,00,00
"ItemName"="@shell32.dll,-30397"
"MenuText"="@shell32.dll,-30318"
"NullFile"=""
"Command"=-
[HKEY_CLASSES_ROOT\.lnk\ShellNew\Config]
"DontRename"=""
[HKEY_CLASSES_ROOT\lnkfile]
@="Shortcut"
"EditFlags"=dword:00000001
"FriendlyTypeName"="@shell32.dll,-4153"
"NeverShowExt"=""
"IsShortcut"=""
[HKEY_CLASSES_ROOT\lnkfile\CLSID]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT\lnkfile\shellex]
[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers]
[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu]
@="{37ea3a21-7493-4208-a011-7f9ea79ce9f5}"
[HKEY_CLASSES_ROOT\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046}]
@=""
[HKEY_CLASSES_ROOT\lnkfile\shellex\DropHandler]
@="{00021401-0000-0000-C000-000000000046}"
[HKEY_CLASSES_ROOT\lnkfile\shellex\IconHandler]
@="{00021401-0000-0000-C000-000000000046}"
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.lnk\UserChoice]
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.01.2015, 08:57
| #8 |
| | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Die Aktion meldet "Schlüssel und Daten wurden erfolgreich [...] eingetragen." Danach Ausschalten des Laptop und nach 30 sec wieder hochgefahren. Weitere Aktionen? (ich war am WE nicht an meinem PC) Gruß stkolibri |
|
05.01.2015, 13:27
| #9 | |
| /// the machine /// TB-Ausbilder | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat ReaderZitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.01.2015, 15:52
| #10 |
| | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Ich  habe das Laptop neu gestartet.Alle *.lnk-Dateien sind wieder normal und verweisen nicht mehr auf den Acrobat Reader, sondern zu den jeweilig zugehörigen Programmen. Ich habe dann schon mal Acrobat Reader erneut von Adobe heruntergeladen und "frisch" installiert: auch dann blieben alle *.lnk-Dateien normal. Soweit alles gut! (Wieso findet GDATA so einen Schädling nicht?) |
|
05.01.2015, 17:29
| #11 |
| /// the machine /// TB-Ausbilder | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Weil das kein Schädling war.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.01.2015, 18:17
| #12 |
| | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Sondern es war was? Ich hätte da noch einiges anzubieten, das ich inzwischen mit anderen Tools gefunden und bekämpft (respektive gelöscht) habe, weil es mir entweder nicht bekannt oder einfach suspekt war: drivergenius, Iminent, Yontoo, Ask, Delta,Smartbar, Systweak, Babylon, Yahoo! Companion, distromatic, AccellerometerP11, Java 7-25, Java 7-67, WiseCare 365, TuneUp Utilities 2014, Snap Do, T-Online WLAN-Finder |
|
05.01.2015, 20:03
| #13 |
| /// the machine /// TB-Ausbilder | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Weil Adobe Reader das zerballert hat. Irgend ein Murks bei der Installation. Hat nix mit der von dir erwähnten Adware zu tun.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.01.2015, 17:45
| #14 |
| | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader OK. Dann können wir das Thema ja schließen. Vielen Dank für die Bereitstellung der Lösung! |
|
06.01.2015, 19:41
| #15 |
| /// the machine /// TB-Ausbilder | Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader Gern Geschehen 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Windows 7: Nach Installation von Acrobat Reader verweisen alle *.lnk-Dateien auf Acrobat Reader |
| acrobat update, administrator, anleitung, ausführung, fehlercode 22, fehlercode 28, fehlercode windows, gestartet, installation, lnk endungen, microsoft, neustart, phänomen, protokoll, pup.optional.lyricsad.gen, pup.optional.snapdo.a, regedit.exe, sämtliche, the drivers for this device are not installed. (code 28), this device is disabled. (code 22), verweisen, windows 7, windows7 |
Linear-Darstellung
