Hallo!
Ich habe in den letzten Tagen sehr häufige bleuscreens spontan oder beim Runterfqahren von Windows. Des weiteren hat TDSSkiller zwei suspekre Dateein gefunden. Die bluescreens scheinen mit einem USB Problem zutun zu haben?! Aber hier mal die logs. Ich hoffe Ihr könnt mir helfen. Im Voraus jedenfalls vielen Dank...

bluescreen:


defogger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:30 on 11/02/2015 (Holger)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-02-2015 02
Ran by Holger (administrator) on HOLGER-QUADCORE on 11-02-2015 22:33:38
Running from C:\Users\Holger\Desktop
Loaded Profiles: Holger (Available profiles: Holger & Administrator)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sandboxie Holdings, LLC) G:\Program Files\Sandboxie\SbieSvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(CyberLink) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
() G:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
(Star Finanz-Software Entwicklung und Vertriebs GmbH) G:\Program Files (x86)\StarMoney9.0\ouservice\StarMoneyOnlineUpdate.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\pg_ctl.exe
(UltraVNC) G:\Program Files\UltraVNC\winvnc.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(UltraVNC) G:\Program Files\UltraVNC\winvnc.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
() G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe
() G:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(VMware, Inc.) G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(CyberLink Corp.) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
() C:\Windows\SysWOW64\UMonit.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
(Deutsche Post AG) G:\Program Files (x86)\STAMPIT\Binary\STRAY.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Sandboxie Holdings, LLC) G:\Program Files\Sandboxie\SbieCtrl.exe
(RagTime GmbH) G:\Program Files (x86)\RagTime Privat\Konni\KonniSymbol.exe
(Flexera Software, Inc.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
() G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe
() G:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
(Acronis) G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Space Sciences Laboratory) G:\Program Files (x86)\BOINC\boincmgr.exe
(Space Sciences Laboratory) G:\Program Files (x86)\BOINC\boinctray.exe
(VMware, Inc.) G:\Program Files (x86)\VMware\VMware Player\hqtray.exe
(CyberLink) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
(CyberLink Corp.) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe
(Elaborate Bytes AG) G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Space Sciences Laboratory) G:\Program Files (x86)\BOINC\boinc.exe
(Apple Inc.) G:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Piriform Ltd) G:\Program Files (x86)\CCleaner\CCleaner64.exe
(BitLeader) G:\Program Files (x86)\lg_fwupdate\fwupdate.exe
() G:\Program Files\Core Temp\Core Temp.exe
() C:\Windows\System32\spool\drivers\x64\3\ssy3cpi.exe
(VideoLAN) G:\Program Files (x86)\VideoLAN\VLC\vlc.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Hola Networks Ltd.) C:\Users\Holger\AppData\Local\Hola\firefox\app\hola_plugin.exe
(Sun Microsystems, Inc.) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
Failed to access process -> CDAS2PC.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [391296 2010-09-08] (Acronis)
HKLM\...\Run: [UMonit] => C:\Windows\SysWOW64\UMonit.exe [200704 2006-12-29] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10081312 2010-02-22] (Realtek Semiconductor)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [TrueImageMonitor.exe] => G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5514296 2010-09-08] (Acronis)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [boincmgr] => G:\Program Files (x86)\BOINC\boincmgr.exe [4793088 2009-11-06] (Space Sciences Laboratory)
HKLM-x32\...\Run: [boinctray] => G:\Program Files (x86)\BOINC\boinctray.exe [58112 2009-11-06] (Space Sciences Laboratory)
HKLM-x32\...\Run: [LGODDFU] => G:\Program Files (x86)\lg_fwupdate\lgfw.exe [27760 2012-08-11] (Bitleader)
HKLM-x32\...\Run: [VMware hqtray] => G:\Program Files (x86)\VMware\VMware Player\hqtray.exe [64112 2010-11-11] (VMware, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [PowerDVD12DMREngine] => G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [505872 2012-09-19] (CyberLink)
HKLM-x32\...\Run: [PowerDVD12Agent] => G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe [374560 2012-09-19] (CyberLink Corp.)
HKLM-x32\...\Run: [VirtualCloneDrive] => G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [OmniPage Preload] => G:\Program Files (x86)\Nuance\OmniPage18\OmniPage18.exe [2987880 2011-07-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Nuance OmniPage 18-reminder] => G:\Program Files (x86)\Nuance\OmniPage18\Ereg\Ereg.exe [333088 2011-05-16] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => G:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)
HKLM-x32\...\Run: [iTunesHelper] => G:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [Remote Control Editor] => C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1689088 2010-06-09] (Elgato Systems)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [STAMPIT-Tray] => G:\Program Files (x86)\STAMPIT\Binary\Stray.exe [83336 2010-06-11] (Deutsche Post AG)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2011-06-20] (Hewlett-Packard Company)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [SandboxieControl] => G:\Program Files\Sandboxie\SbieCtrl.exe [784904 2014-10-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [Konni Symbol Autostart] => G:\Program Files (x86)\RagTime Privat\Konni\KonniSymbol.exe [53248 2003-02-06] (RagTime GmbH)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [Personal ID] => G:\coolspot AG\Personal ID\pid.exe [1134008 2009-03-04] (coolspot AG, Düsseldorf)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [OpAgent] => "OpAgent.exe" /agent
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [324976 2010-05-21] (Flexera Software, Inc.)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [ecoprint] => G:\Program Files (x86)\applord GmbH\ecoDMS - Client\runcon.bat [95 2013-12-21] ()
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [CCleaner Monitoring] => G:\Program Files (x86)\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [FileHippo.com] => G:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\MountPoints2: {b0c0aea2-36ae-11df-b355-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\ubcd\website\index.html
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
Startup: C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp (2).lnk
ShortcutTarget: Core Temp (2).lnk -> G:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
ShortcutTarget: Versandhelfer.lnk -> C:\Program Files (x86)\Versandhelfer\Versandhelfer.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2149552335-4145356072-959976354-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2149552335-4145356072-959976354-1000 -> {47F43F50-68E2-4F28-B949-26EE0EC9C505} URL = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN
SearchScopes: HKU\S-1-5-21-2149552335-4145356072-959976354-1000 -> {65C238F8-3FA6-4AEC-914D-8CD376F70CC6} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> G:\Program Files (x86)\SnagIT\DLLx64\SnagitBHO64.dll (TechSmith Corporation)
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security\Engine64\22.1.0.9\coIEPlg.dll (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> G:\Program Files (x86)\SnagIT\SnagitBHO.dll (TechSmith Corporation)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\coIEPlg.dll (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Preispiraten -> {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} -> G:\Program Files (x86)\Preispiraten6\IEButtonPPInterface.dll ()
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - G:\Program Files (x86)\SnagIT\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine64\22.1.0.9\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
Toolbar: HKLM-x32 - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - G:\Program Files (x86)\SnagIT\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\coIEPlg.dll (Symantec Corporation)
Toolbar: HKU\S-1-5-21-2149552335-4145356072-959976354-1000 -> No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} -  No File
DPF: HKLM-x32 {62415890-4985-0825-2508-23487C2A845F} hxxp://192.168.178.130/en/cab/ipcamera.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{5F13DFFA-CEB5-450C-8AC0-7FB7FA277C11}: [NameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o
FF Homepage: about:home
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin: synology.com/SurveillancePlugin_x86_64 -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.565\npSurveillancePlugin_x86_64.dll (Synology)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> G:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @qnap.com/MonitorPlayer -> C:\Program Files (x86)\QNAP\VioStorMonitor\npMonHost.dll ( QNAP System, Inc)
FF Plugin-x32: @videolan.org/vlc,version=0.9.9 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: synology.com/SurveillancePlugin -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.565\npSurveillancePlugin.dll (Synology)
FF Plugin HKU\S-1-5-21-2149552335-4145356072-959976354-1000: @hola.org/vlc,version=1.6.584 -> C:\Users\Holger\AppData\Local\Hola\firefox\app\vlc ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\searchplugins\firefox-add-ons.xml
FF SearchPlugin: C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\searchplugins\ixquick-https.xml
FF Extension: German Dictionary - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\de-DE@dictionaries.addons.mozilla.org [2014-06-08]
FF Extension: FoxyProxy Standard - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\foxyproxy@eric.h.jung [2015-02-06]
FF Extension: Hola Better Internet - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\jid1-4P0kohSJxU1qGg@jetpack [2015-02-11]
FF Extension: KeeFox - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\keefox@chris.tomlinson [2015-01-17]
FF Extension: npIpcam - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\npapi@n.com [2013-07-01]
FF Extension: Flashblock - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-12-12]
FF Extension: Buyertools - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{411F2F11-830F-4AB5-B7F0-FBC77B870B5A} [2012-03-07]
FF Extension: WOT - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-12-03]
FF Extension: Preispiraten4 - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{A86278FF-6B63-446C-B109-DD4E1BAAC868} [2010-01-24]
FF Extension: Biet-O-Matic Firefox Erweiterung - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{B0D70E72-2FC1-4b9f-A3D4-5921C854D906} [2010-03-07]
FF Extension: Preispiraten 4 Kontextmenü - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{D2A8BC29-8CA3-4C0A-A206-631C44E9620F} [2009-12-08]
FF Extension: PassIFox - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\passifox@hanhuy.com.xpi [2014-08-17]
FF Extension: TrashMail.com - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\spam@trashmail.net.xpi [2011-03-27]
FF Extension: Password Exporter - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2014-08-17]
FF Extension: Adblock Plus - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-03-27]
FF Extension: DownThemAll! - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2011-05-17]
FF Extension: QuickJava - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi [2015-02-07]
FF Extension: MyKey Interface - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{FACC66B7-E49F-49ed-997E-66A221FD956D}.xpi [2011-04-01]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{2E6861CA-9A88-4B7B-B935-F810DE84D259} [2015-01-27]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB} [2015-01-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-02]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.1.0.9\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.1.0.9\coFFPlgn [2015-02-10]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\Exts\Chrome.crx [2015-01-24]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\Exts\Chrome.crx [2015-01-24]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [506288 2011-02-08] (REINER SCT)
R2 CLHNServiceForPowerDVD12; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [90640 2012-09-19] (CyberLink Corp.)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [78352 2012-09-19] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [295440 2012-09-19] (CyberLink)
R2 DirMngr; G:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-10-07] () [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1876816 2015-02-07] (SurfRight B.V.)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-06-20] (Hewlett-Packard Company) [File not signed]
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-03-26] (Nitro PDF Software)
R2 NS; C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe [282528 2014-12-10] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [508464 2013-07-01] (Samsung Electronics Co., Ltd.)
S3 SandraAgentSrv; G:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\RpcAgentSrv.exe [68760 2008-09-05] (SiSoftware) [File not signed]
R2 SbieSvc; G:\Program Files\Sandboxie\SbieSvc.exe [174600 2014-10-14] (Sandboxie Holdings, LLC)
R2 StarMoney 9.0 OnlineUpdate; G:\Program Files (x86)\StarMoney9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
R2 SyncThru Admin 6; G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe [204800 2013-05-03] () [File not signed]
R2 SynoDrService; G:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [404480 2010-03-24] () [File not signed]
S3 ufad-ws60; G:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe [191024 2010-08-19] (VMware, Inc.)
R2 uvnc_service; G:\Program Files\UltraVNC\WinVNC.exe [1793976 2009-12-07] (UltraVNC)
R2 VMAuthdService; G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe [113264 2010-11-11] (VMware, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 SyncThru Admin 6 Database; G:/Program Files (x86)/Samsung Network Printer Utilities/SyncThru Admin 6/UniThruTargetPlatform/PostgreSQL/engine/bin/pg_ctl.exe runservice -N "SyncThru Admin 6 Database" -D "G:/Program Files (x86)/Samsung Network Printer Utilities/SyncThru Admin 6/UniThruTargetPlatform/PostgreSQL/database"  -o "-p 5432" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AVXBAR; C:\Windows\System32\DRIVERS\88xAXbar.sys [20544 2009-11-05] (DTV-DVB Technology, Inc.)
R3 BDATUNE; C:\Windows\System32\DRIVERS\88xBdaTune.sys [60096 2009-11-05] (DTV-DVB Technology, Inc.)
R1 BHDrvx64; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\BASHDefs\20150203.001\BHDrvx64.sys [1622744 2015-02-03] (Symantec Corporation)
R1 ccSet_NS; C:\Windows\system32\drivers\NSx64\1601000.009\ccSetx64.sys [165080 2014-09-09] (Symantec Corporation)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2009-12-18] ()
R3 CX23880; C:\Windows\System32\DRIVERS\88xAStream.sys [200896 2009-11-05] (DTV-DVB Technology, Inc.)
R3 CX88IR; C:\Windows\System32\DRIVERS\88xBdaIr.sys [28224 2009-11-05] (DTV-DVB Technology, Inc.)
R3 CXAVSTS; C:\Windows\System32\DRIVERS\88xBdaCap.sys [35648 2009-11-05] (DTV-DVB Technology, Inc.)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-11-25] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-11-25] (Symantec Corporation)
S3 FIXUSTOR; C:\Windows\System32\DRIVERS\fixustor.sys [18568 2006-11-28] (Genesys Logic)
S3 FIXUSTOR; C:\Windows\SysWOW64\DRIVERS\fixustor.sys [18568 2006-11-28] (Genesys Logic)
R2 hmpalert; C:\Windows\System32\drivers\hmpalert.sys [93144 2015-02-07] ()
R0 hotcore3; C:\Windows\SysWow64\drivers\hotcore3.sys [35096 2008-02-14] (Paragon Software Group)
R1 IDSVia64; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\IPSDefs\20150210.001\IDSvia64.sys [669400 2015-02-06] (Symantec Corporation)
S3 MEMSWEEP2; C:\Windows\system32\FF9A.tmp [6144 2010-05-26] (Sophos Plc) [File not signed]
R3 NAVENG; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\VirusDefs\20150211.001\ENG64.SYS [129752 2014-11-15] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\VirusDefs\20150211.001\EX64.SYS [2137304 2014-11-15] (Symantec Corporation)
R2 ntk_PowerDVD12; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [83704 2012-06-20] (Cyberlink Corp.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 RemoteControl-USBLAN; C:\Windows\System32\DRIVERS\rcblan.sys [46616 2007-01-24] (Belcarra Technologies)
S3 RTCore64; G:\Program Files (x86)\EVGA Precision X\RTCore64.sys [15176 2013-07-18] ()
S3 SANDRA; G:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R3 SbieDrv; G:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-10-14] (Sandboxie Holdings, LLC)
R1 SRTSP; C:\Windows\system32\drivers\NSx64\1601000.009\SRTSP64.SYS [914648 2014-12-02] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NSx64\1601000.009\SRTSPX64.SYS [42200 2014-12-02] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NSx64\1601000.009\SYMDS64.SYS [490712 2014-09-09] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NSx64\1601000.009\SYMEFA64.SYS [1151704 2014-09-09] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [102616 2015-01-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NSx64\1601000.009\Ironx64.SYS [271576 2014-09-09] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NSx64\1601000.009\SYMNETS.SYS [565464 2014-09-09] (Symantec Corporation)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-13] (The OpenVPN Project) [File not signed]
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project)
R1 UGURU; C:\Windows\System32\drivers\uGuru.sys [22064 2006-09-20] (ABIT)
U5 UnlockerDriver5; G:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 usbser64; C:\Windows\System32\DRIVERS\usbser.sys [33280 2013-08-29] (Microsoft Corporation)
R2 vstor2-ws60; G:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\NavFilter\000.fcl [147704 2012-09-19] (CyberLink Corp.)
R3 ALSysIO; \??\C:\Users\Holger\AppData\Local\Temp\ALSysIO64.sys [X]
S3 EST_BusEnum; system32\DRIVERS\GenBus.sys [X]
S3 NUS_Bus; system32\DRIVERS\NUS_Bus.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-11 22:33 - 2015-02-11 22:34 - 00035594 _____ () C:\Users\Holger\Desktop\FRST.txt
2015-02-11 22:33 - 2015-02-11 22:33 - 00000000 ____D () C:\FRST
2015-02-11 22:32 - 2015-02-11 22:32 - 02134016 _____ (Farbar) C:\Users\Holger\Desktop\frst64.exe
2015-02-11 22:30 - 2015-02-11 22:30 - 00000474 _____ () C:\Users\Holger\Desktop\defogger_disable.log
2015-02-11 22:30 - 2015-02-11 22:30 - 00000000 _____ () C:\Users\Holger\defogger_reenable
2015-02-11 22:26 - 2015-02-11 22:27 - 00000000 ____D () C:\Users\Holger\Desktop\Virus
2015-02-11 22:23 - 2015-02-11 22:24 - 00380416 _____ () C:\Users\Holger\Desktop\Gmer-19357.exe
2015-02-11 22:22 - 2015-02-11 22:22 - 00050477 _____ () C:\Users\Holger\Desktop\Defogger.exe
2015-02-11 20:34 - 2015-02-11 20:35 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Holger\Desktop\tdsskiller.exe
2015-02-11 20:30 - 2015-02-11 20:33 - 00000335 _____ () C:\local.conf
2015-02-11 20:30 - 2015-02-11 20:33 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-02-11 20:29 - 2015-02-11 20:33 - 00000000 ____D () C:\Users\Holger\Desktop\mbar-1.08.3.1004
2015-02-11 20:27 - 2015-02-11 20:27 - 16466552 _____ (Malwarebytes Corp.) C:\Users\Holger\Desktop\mbar-1.08.3.1004.exe
2015-02-10 17:15 - 2015-02-10 17:15 - 00000022 _____ () C:\Windows\S.dirmngr
2015-02-09 17:19 - 2015-02-09 17:19 - 00005398 _____ () C:\Users\Holger\Downloads\LAN24TB_20150209.dss
2015-02-08 19:42 - 2015-02-08 19:42 - 00000000 ____D () C:\Users\Holger\Downloads\qd560w550bger
2015-02-08 19:39 - 2015-02-08 19:40 - 03067440 _____ () C:\Users\Holger\Downloads\qd560w550bger.exe
2015-02-08 01:00 - 2015-02-10 19:33 - 00281068 _____ () C:\Windows\setupact.log
2015-02-08 01:00 - 2015-02-08 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-07 19:34 - 2015-02-07 19:34 - 00000000 ____D () C:\Users\Holger\Downloads\Hola
2015-02-07 15:54 - 2015-02-07 15:54 - 00037970 _____ () C:\Users\Holger\Documents\cc_20150207_155358.reg
2015-02-07 15:54 - 2015-02-07 15:54 - 00024290 _____ () C:\Users\Holger\Documents\cc_20150207_155444.reg
2015-02-07 15:50 - 2015-02-07 15:50 - 05325208 _____ (Piriform Ltd) C:\Users\Holger\Downloads\ccsetup502.exe
2015-02-07 15:48 - 2015-02-07 15:48 - 00000000 ____D () C:\ProgramData\HitmanPro.Alert
2015-02-07 15:47 - 2015-02-11 21:27 - 00000000 ____D () C:\Windows\CryptoGuard
2015-02-07 15:47 - 2015-02-09 15:32 - 00000000 ____D () C:\Program Files (x86)\HitmanPro.Alert
2015-02-07 15:47 - 2015-02-07 19:34 - 00548424 _____ (SurfRight) C:\Windows\system32\hmpalert.dll
2015-02-07 15:47 - 2015-02-07 19:34 - 00477008 _____ (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2015-02-07 15:47 - 2015-02-07 19:34 - 00093144 _____ () C:\Windows\system32\Drivers\hmpalert.sys
2015-02-07 15:47 - 2015-02-07 15:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro.Alert
2015-02-07 15:46 - 2015-02-07 15:46 - 01889616 _____ (SurfRight B.V.) C:\Users\Holger\Downloads\hmpalert.exe
2015-02-07 15:45 - 2015-02-07 15:45 - 00000913 _____ () C:\Users\Holger\Desktop\FileHippo App Manager.lnk
2015-02-07 15:45 - 2015-02-07 15:45 - 00000913 _____ () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk
2015-02-07 15:45 - 2015-02-07 15:45 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-02-07 15:41 - 2015-02-07 15:41 - 00849352 _____ () C:\Users\Holger\Downloads\AppManagerSetup_1.47.exe
2015-02-07 14:17 - 2015-02-07 14:17 - 00000000 ____D () C:\Windows\en
2015-02-07 14:16 - 2015-02-07 14:16 - 00001313 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-02-07 14:16 - 2015-02-07 14:16 - 00000000 ____D () C:\Windows\de
2015-02-07 14:15 - 2015-02-07 14:15 - 00001382 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-02-07 14:11 - 2014-03-31 21:06 - 00058056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2015-02-07 14:08 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-02-07 14:08 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-02-07 14:08 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-02-07 14:08 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-02-07 14:08 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-02-07 14:08 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-02-07 14:04 - 2015-02-07 14:04 - 00002212 _____ () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-02-07 14:04 - 2015-02-07 14:04 - 00002128 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-02-07 14:04 - 2015-02-07 14:04 - 00002128 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-02-07 14:04 - 2015-02-07 14:04 - 00000000 ___RD () C:\Users\Holger\OneDrive
2015-02-07 14:04 - 2015-02-07 14:04 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-02-07 14:04 - 2015-02-07 14:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2015-02-07 13:55 - 2015-02-07 13:56 - 01239752 _____ (Microsoft Corporation) C:\Users\Holger\Downloads\wlsetup-web(1).exe
2015-02-07 12:42 - 2015-02-07 12:42 - 00003206 _____ () C:\Windows\System32\Tasks\{00751C2C-0DE5-4235-8359-A01ADA1506E1}
2015-02-07 12:42 - 2015-02-07 12:42 - 00000093 _____ () C:\Windows\SysWOW64\FTCD2XXUN.ini
2015-02-07 12:42 - 2015-02-07 12:42 - 00000065 _____ () C:\Windows\SysWOW64\FTD2XXUN.ini
2015-02-07 12:42 - 2015-02-07 12:40 - 00420864 _____ (FTDI Ltd.) C:\Windows\SysWOW64\FTDIUNIN.exe
2015-02-07 12:39 - 2015-02-07 12:39 - 00000000 ____D () C:\Users\Holger\Downloads\FTClean
2015-02-07 12:36 - 2015-02-07 12:36 - 00452958 _____ () C:\Users\Holger\Downloads\FTClean.zip
2015-02-07 11:49 - 2015-02-07 11:49 - 156896601 _____ () C:\Users\Holger\Downloads\Wohnzimmer20150206-222956-1423258196.mp4
2015-02-07 11:48 - 2015-02-07 11:48 - 58965039 _____ () C:\Users\Holger\Downloads\Wohnzimmer20150206-222421-1423257861.mp4
2015-02-07 11:48 - 2015-02-07 11:48 - 169651682 _____ () C:\Users\Holger\Downloads\Wohnzimmer20150206-220453-1423256693.mp4
2015-02-07 11:09 - 2015-02-07 11:09 - 00000000 ____D () C:\Program Files (x86)\Synology
2015-02-07 09:50 - 2015-02-07 09:50 - 17465344 _____ () C:\Users\Holger\Downloads\SurveillancePlugin(1).msi
2015-02-06 20:43 - 2015-02-07 13:07 - 00000634 _____ () C:\Users\Holger\Desktop\SANUK Control 3.0.lnk
2015-02-06 20:43 - 2015-02-06 20:43 - 00000634 _____ () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\SANUK Control 3.0.lnk
2015-02-06 20:43 - 2015-02-06 20:43 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SANUK CyberControl 3.0
2015-02-06 20:42 - 2015-02-06 20:43 - 15209658 _____ () C:\Users\Holger\Downloads\scc_30_install(2).exe
2015-02-06 19:54 - 2015-02-06 19:55 - 15209658 _____ () C:\Users\Holger\Downloads\scc_30_install(1).exe
2015-02-05 07:07 - 2015-02-05 07:07 - 00004398 _____ () C:\Users\Holger\Desktop\eset.txt
2015-02-04 17:14 - 2015-02-04 17:14 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-04 15:56 - 2015-02-04 15:57 - 00001227 _____ () C:\DelFix.txt
2015-02-04 15:09 - 2015-02-04 15:09 - 00000331 _____ () C:\Users\Holger\Downloads\regfix(1).zip
2015-02-02 18:48 - 2015-02-02 18:48 - 00000000 ____D () C:\Users\Holger\Downloads\regfix
2015-02-02 18:47 - 2015-02-02 18:47 - 00000605 _____ () C:\Users\Holger\Downloads\regfix.zip
2015-02-01 14:17 - 2015-02-01 14:17 - 15209658 _____ () C:\Users\Holger\Downloads\scc_30_install.exe
2015-01-28 20:14 - 2015-01-28 20:14 - 00000000 ____D () C:\Users\Holger\AppData\Local\Hola
2015-01-28 19:19 - 2015-01-28 19:19 - 00000000 ____D () C:\Windows\system32\IO
2015-01-27 16:09 - 2015-01-28 20:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 21:10 - 2015-02-11 20:30 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-25 21:10 - 2015-02-11 20:30 - 00097496 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-25 21:10 - 2015-01-25 21:10 - 00000793 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-25 21:10 - 2015-01-25 21:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-25 21:10 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-25 21:10 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-24 15:09 - 2015-01-24 15:09 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Security
2015-01-24 15:06 - 2015-01-24 15:06 - 00003214 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2015-01-24 15:05 - 2015-01-24 15:05 - 00102616 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2015-01-24 15:05 - 2015-01-24 15:05 - 00008214 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2015-01-24 15:05 - 2015-01-24 15:05 - 00002457 _____ () C:\Users\Public\Desktop\Norton Security.lnk
2015-01-24 15:03 - 2015-01-24 15:05 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security
2015-01-24 15:03 - 2015-01-24 15:03 - 00000000 ____D () C:\Program Files (x86)\Norton Security
2015-01-24 14:48 - 2015-01-24 14:49 - 08742712 _____ (Symantec Corporation) C:\Users\Holger\Desktop\NRnR.exe
2015-01-24 14:22 - 2015-01-09 23:27 - 00621200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-01-24 14:17 - 2015-01-13 05:15 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-01-24 14:17 - 2015-01-13 05:15 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-01-24 14:17 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00994712 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00877488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 00164568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-01-14 10:20 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 10:20 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 10:20 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 10:20 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 10:20 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 10:20 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 10:20 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 10:20 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 10:20 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 10:20 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 10:20 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 10:20 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 10:20 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-11 22:30 - 2010-03-23 20:08 - 00000000 ____D () C:\Users\Holger
2015-02-11 22:29 - 2013-03-16 17:33 - 00000032 _____ () C:\Users\Holger\AppData\Roaming\Network Meter_Usage.ini
2015-02-11 22:25 - 2010-03-23 20:26 - 02033073 _____ () C:\Windows\WindowsUpdate.log
2015-02-11 22:00 - 2013-03-13 14:51 - 00642325 _____ () C:\Users\Holger\Network_Meter_Data.js
2015-02-11 21:43 - 2012-04-06 20:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-11 20:27 - 2014-08-17 14:37 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\KeePass
2015-02-11 20:07 - 2010-03-23 21:24 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{424B6B76-676E-4BCF-A3EB-94365BADB9E1}
2015-02-10 19:36 - 2009-07-14 18:58 - 00752936 _____ () C:\Windows\system32\perfh007.dat
2015-02-10 19:36 - 2009-07-14 18:58 - 00171984 _____ () C:\Windows\system32\perfc007.dat
2015-02-10 19:36 - 2009-07-14 06:13 - 01759042 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-10 19:33 - 2010-09-29 12:52 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\vlc
2015-02-10 19:33 - 2010-07-28 14:02 - 00000000 ____D () C:\ProgramData\Temp
2015-02-10 18:55 - 2013-02-22 17:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2015-02-10 17:48 - 2011-02-09 19:51 - 00000000 ____D () C:\Users\Holger\AppData\Local\CrashDumps
2015-02-10 17:47 - 2013-02-22 21:37 - 00000000 ____D () C:\Users\Holger\Documents\Scan
2015-02-10 17:23 - 2010-03-23 20:06 - 00016784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-10 17:23 - 2010-03-23 20:06 - 00016784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-10 17:22 - 2013-10-15 19:17 - 00009011 _____ () C:\Users\Holger\IP_Log_Data.js
2015-02-10 17:22 - 2010-07-29 15:06 - 00000372 _____ () C:\Windows\lgfwup.ini
2015-02-10 17:16 - 2010-10-21 14:11 - 00000000 ____D () C:\ProgramData\VMware
2015-02-10 17:15 - 2013-10-12 10:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-10 17:15 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-09 15:56 - 2013-09-03 15:06 - 00000000 ____D () C:\Users\Administrator
2015-02-09 15:41 - 2012-09-25 19:42 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\Nitro PDF
2015-02-09 15:32 - 2012-10-19 11:35 - 00350776 ____N () C:\Windows\Minidump\020915-120312-01.dmp
2015-02-09 15:32 - 2010-06-12 16:24 - 00000000 ____D () C:\Windows\Minidump
2015-02-07 17:36 - 2011-02-26 20:56 - 00001824 _____ () C:\Windows\Sandboxie.ini
2015-02-07 15:52 - 2010-09-26 16:40 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\FileZilla
2015-02-07 15:51 - 2010-11-20 18:49 - 00000730 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-02-07 14:16 - 2010-10-27 17:21 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-02-07 14:14 - 2010-10-27 17:24 - 00001466 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-02-07 14:13 - 2010-10-27 17:24 - 00002494 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-02-07 14:12 - 2010-10-27 17:21 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-02-07 14:11 - 2010-10-27 17:21 - 00000000 ____D () C:\Program Files\Windows Live
2015-02-07 14:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-02-06 20:31 - 2009-12-07 16:59 - 00000778 _____ () C:\Windows\HBCIKRNL.INI
2015-02-06 19:58 - 2010-10-09 12:23 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\TeamViewer
2015-02-05 00:43 - 2012-04-06 20:12 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 00:43 - 2012-04-06 20:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 00:43 - 2011-05-17 16:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-29 17:52 - 2010-03-20 14:36 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-28 20:08 - 2012-05-03 18:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-28 13:16 - 2014-11-20 17:32 - 00000000 ____D () C:\Program Files (x86)\Versandhelfer
2015-01-26 15:17 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-01-25 21:10 - 2010-09-22 16:36 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\Malwarebytes
2015-01-25 21:10 - 2010-09-22 16:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-24 15:05 - 2011-02-01 17:13 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2015-01-24 15:03 - 2011-02-01 17:12 - 00000000 ____D () C:\ProgramData\Norton
2015-01-24 14:23 - 2010-07-29 15:06 - 00000000 ____D () C:\Temp
2015-01-24 14:22 - 2013-10-12 11:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-15 03:19 - 2013-08-16 02:02 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 03:01 - 2010-04-14 15:32 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-13 05:15 - 2013-10-25 15:47 - 01540240 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll

==================== Files in the root of some directories =======

2012-11-22 17:29 - 2012-11-22 17:29 - 0000545 _____ () C:\Users\Holger\AppData\Roaming\All CPU MeterV3_Settings.ini
2011-07-14 15:45 - 2012-01-27 18:51 - 0000412 _____ () C:\Users\Holger\AppData\Roaming\All CPU Meter_Settings.ini
2014-11-20 17:31 - 2014-11-20 17:31 - 0000353 _____ () C:\Users\Holger\AppData\Roaming\dpdhl.versandhelfer_state.xml
2012-03-04 17:31 - 2013-03-02 20:42 - 0000841 _____ () C:\Users\Holger\AppData\Roaming\Drives Meter_Settings.ini
2009-06-08 16:32 - 2012-02-04 12:35 - 0099384 _____ () C:\Users\Holger\AppData\Roaming\inst.exe
2011-07-14 15:47 - 2013-11-04 19:51 - 0001389 _____ () C:\Users\Holger\AppData\Roaming\Network Meter_Settings.ini
2013-03-16 17:33 - 2015-02-11 22:29 - 0000032 _____ () C:\Users\Holger\AppData\Roaming\Network Meter_Usage.ini
2009-06-08 16:32 - 2012-02-04 12:35 - 0007859 _____ () C:\Users\Holger\AppData\Roaming\pcouffin.cat
2009-06-08 16:32 - 2012-02-04 12:35 - 0001167 _____ () C:\Users\Holger\AppData\Roaming\pcouffin.inf
2009-06-08 16:33 - 2012-02-04 12:35 - 0000033 _____ () C:\Users\Holger\AppData\Roaming\pcouffin.log
2009-06-08 16:32 - 2012-02-04 12:35 - 0082816 _____ (VSO Software) C:\Users\Holger\AppData\Roaming\pcouffin.sys
2012-10-23 16:01 - 2012-10-27 17:16 - 11718656 _____ () C:\Users\Holger\AppData\Roaming\Sandra.mdb
2013-09-30 15:29 - 2013-10-05 15:10 - 0000676 _____ () C:\Users\Holger\AppData\Roaming\sqlite3Explorer.xml
2011-03-13 14:09 - 2013-12-12 17:22 - 0042744 _____ () C:\Users\Holger\AppData\Roaming\UserTile.png
2010-09-15 16:45 - 2014-07-27 16:49 - 0006144 _____ () C:\Users\Holger\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-09-27 14:58 - 2012-04-21 19:23 - 0000600 _____ () C:\Users\Holger\AppData\Local\PUTTY.RND
2013-10-29 12:39 - 2013-10-29 12:39 - 0001706 _____ () C:\Users\Holger\AppData\Local\recently-used.xbel
2010-04-07 14:59 - 2011-02-06 20:38 - 0007605 _____ () C:\Users\Holger\AppData\Local\resmon.resmoncfg
2012-02-04 11:43 - 2012-11-29 16:31 - 0000040 ___SH () C:\ProgramData\.zreglib
2013-02-15 17:00 - 2013-03-13 14:41 - 0017571 _____ () C:\ProgramData\Network_Meter_Data.csv
2010-08-25 14:35 - 2010-08-25 14:35 - 0000000 _____ () C:\ProgramData\xml6380.tmp
2010-11-19 19:25 - 2010-11-19 19:25 - 0013869 _____ () C:\ProgramData\xmlC2E1.tmp
2010-06-19 15:09 - 2010-11-19 19:25 - 0005975 _____ () C:\ProgramData\xmlD137.tmp
2010-06-19 15:09 - 2010-08-25 14:35 - 0000000 _____ () C:\ProgramData\xmlD927.tmp
2010-06-19 15:09 - 2010-11-19 19:25 - 0001629 _____ () C:\ProgramData\xmlDA32.tmp

Files to move or delete:
====================
C:\Users\Holger\IP_Log_Data.js
C:\Users\Holger\Network_Meter_Data.js


Some content of TEMP:
====================
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.434.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.463.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.467.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.485.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.520.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.536.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.540.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.555.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.584.exe
C:\Users\Holger\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-03 00:21

==================== End Of Log ============================
         

Adittion:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-02-2015 02
Ran by Holger at 2015-02-11 22:34:54
Running from C:\Users\Holger\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.34 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0934-000001000000}) (Version: 9.34.00.0 - Igor Pavlov)
Acronis True Image Home 2011 (HKLM-x32\...\{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}) (Version: 14.0.5519 - Acronis)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advanced Archive Password Recovery (HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Advanced Archive Password Recovery) (Version: 4.53 - ElcomSoft Co. Ltd.)
Advanced Renamer (HKLM-x32\...\Advanced Renamer_is1) (Version: 3.64 - Hulubulu Software)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Biet-O-Matic v2.12.7 (HKLM-x32\...\Biet-O-Matic v2.12.7) (Version: Biet-O-Matic v2.12.7 - BOM Development Team)
BOINC (HKLM-x32\...\{4D12D805-50B2-4287-B3B9-AD4D74F85693}) (Version: 6.10.18 - Space Sciences Laboratory, U.C. Berkeley)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother P-touch Address Book 1.1 (HKLM-x32\...\{B2023017-DEE4-44F7-8A71-CA6084BF534C}) (Version: 1.1.2201 - Brother Industries, Ltd.)
Brother P-touch Editor 5.1 (HKLM-x32\...\{39270390-A851-4E4B-94A9-D5C468216ED3}) (Version: 5.1.0200 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Einzelhandel [DEU] (HKLM-x32\...\{DF776DAE-575D-4E1B-A436-158549FD65E4}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Event-Planung [DEU] (HKLM-x32\...\{2B540B0C-8AC4-42BE-A597-FDD1A788A0F5}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Feier [DEU] (HKLM-x32\...\{0BE7832F-D842-4C1F-B910-E99790416EDA}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Geburtstag [DEU] (HKLM-x32\...\{B6D72A3F-B3C9-4C2E-B98C-A22F06529B8C}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Paketversand [DEU] (HKLM-x32\...\{5EFFE155-E75B-4816-82BB-67C76A7E2C09}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Warnung [DEU] (HKLM-x32\...\{6CEBCCA3-0F3F-4B1C-B0E9-4E6E14546651}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Update Software (HKLM-x32\...\{08BAC163-A5E8-4838-90A9-8C9343400579}) (Version: 1.0.0030 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5000 - CDBurnerXP)
Cinergy S PCI V1.00.02.09c (HKLM-x32\...\Cinergy S PCI) (Version: 1.00.02.09c - )
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Core Temp version 0.99.7 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 0.99.7 - Arthur Liberman)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.9.10 - REINER SCT)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2118a.57 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DreamBoxEdit -- The one and only settings editor for your Dreambox (HKLM-x32\...\DreamBoxEdit) (Version:  - )
DVDFab 9.0.7.2 (18/10/2013) (HKLM-x32\...\DVDFab 9_is1) (Version:  - Fengtao Software Inc.)
Easy RAR Recovery (HKLM-x32\...\Easy RAR Recovery) (Version: 2.0 - MunSoft)
EasyBCD 2.0 (HKLM-x32\...\EasyBCD) (Version: 2.0 - NeoSmart Technologies)
ecoDMS - Client (HKLM-x32\...\87CC2334-DF2E-4860-9651-8644F8C05DFC) (Version: 12.05 - applord GmbH)
ecoDMS - Printer (HKLM-x32\...\8A53B176-7CB8-49F8-AD87-F8A1625DDF01) (Version: 12.05 - applord gmbh)
ecoDMSOfficePlugin (HKLM-x32\...\{A0B706BC-10A3-4B35-8DE6-73AF8DBDE71F}) (Version: 1.9.5 - applord GmbH)
ecoDMSOfficePlugin (HKLM-x32\...\{A0B706BC-10A3-4B35-8DE6-73AF8DBDE72C}) (Version: 1.9.8 - applord GmbH)
ecoICE - Image Correction Editor (HKLM-x32\...\CA64A6D5-EDF0-4997-80E5-F9678C1AFCFB) (Version: 12.05 - applord GmbH)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
EVGA Precision X 4.2.1 (HKLM-x32\...\PrecisionX) (Version: 4.2.1 - EVGA Corporation)
ffdshow [rev 1723] [2007-12-24] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - )
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
FileZilla Client 3.9.0.5 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Free Disc Burner version 3.0.8.221 (HKLM-x32\...\Free Disc Burner_is1) (Version: 3.0.8.221 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.2.6.430 (HKLM-x32\...\Free DVD Video Burner_is1) (Version: 3.2.6.430 - DVDVideoSoft Ltd.)
Free Studio version 4.3 (HKLM-x32\...\Free Studio_is1) (Version:  - DVDVideoSoft Limited.)
Free Video Dub version 2.0.8.504 (HKLM-x32\...\Free Video Dub_is1) (Version: 2.0.8.504 - DVDVideoSoft Ltd.)
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{A79408B0-345D-42E8-8EB6-00597320B9E0}) (Version: 1.0.3 - AVM Berlin)
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 2.4.0.5 - Genesys Logic)
Gpg4win (2.2.1) (HKLM-x32\...\GPG4Win) (Version: 2.2.1 - The Gpg4win Project)
HELI-X 3.0 Demo (HKLM-x32\...\{7AEF3482-B7B7-4B94-AF63-B249B9BA9D7F}_is1) (Version:  - Michael Schreiner)
HitmanPro.Alert (HKLM\...\HitmanPro.Alert) (Version: 2.6.5.77 - SurfRight B.V.)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
IPCamSetup (HKLM-x32\...\{02C39DE9-B03A-4FE7-89F9-61E224FE65CC}) (Version: 1.00.0000 - FOSCAM)
IPCMonitor_en version 1.0.1.4 (HKLM-x32\...\{8EC13308-5065-43FA-A5E8-E225F18DAB89}_is1) (Version: 1.0.1.4 - IPCMonitor, Inc.)
iPhoneBrowser (HKLM-x32\...\{C1FCDCA1-2759-4E5E-84EE-3A665BB2F513}) (Version: 1.9.3 - Cranium Consulting and Custom Software)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
IsoBuster 2.8.5 (HKLM-x32\...\IsoBuster_is1) (Version: 2.8.5 - Smart Projects)
iSpy (HKLM-x32\...\{4D1DD276-902C-4665-ABBD-13EC01BAFC0E}) (Version: 4.7.7 - iSpy)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
JMB36X Raid Configurer (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.00.0000 - JMICRON Technology Corp.)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
KeePass Password Safe 2.28 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.28 - Dominik Reichl)
LG Tool Kit (HKLM-x32\...\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )
LightScribe System Software (HKLM-x32\...\{2FA75B40-17C9-4D22-88CA-80A5D52FAB13}) (Version: 1.18.24.1 - LightScribe)
Logitech Harmony Remote Software 7 (HKLM-x32\...\{5C6F884D-680C-448B-B4C9-22296EE1B206}) (Version: 7.7.0.0 - Logitech)
MakeMKV v1.8.13 (HKLM-x32\...\MakeMKV) (Version: v1.8.13 - GuinpinSoft inc)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Add-ons für Acronis True Image Home 2011 (HKLM-x32\...\{9A5509EE-5579-46C1-B566-5065545547F9}) (Version: 14.0.5519 - Acronis)
MediaInfo 0.7.69 (HKLM\...\MediaInfo) (Version: 0.7.69 - MediaArea.net)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access database engine 2010 (German) (HKLM-x32\...\{90140000-00D1-0407-0000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{9634d50a-0c4d-4f52-8a9f-894a2baae370}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{307a22b8-8353-4c5e-b67b-2404c5734558}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.1.177.0 - Microsoft Corporation)
MKVToolNix 6.8.0 (32bit) (HKLM-x32\...\MKVtoolnix) (Version: 6.8.0 - Moritz Bunkus)
MobileMe Control Panel (HKLM\...\{41BC9E31-0D39-462E-8E4C-767B21A3B1C3}) (Version: 3.1.8.0 - Apple Inc.)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSXML 4.0 SP2 (KB941833) (HKLM-x32\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neato Updater Tool v2 (HKLM-x32\...\{292156D3-43B5-4C96-B79A-94E40F8D8991}) (Version: 3.0 - Neato Robotics, Inc)
Nitro Reader 3 (HKLM\...\{4436B9BD-CA66-4D69-9091-2D2EB62F09AD}) (Version: 3.5.2.10 - Nitro)
Norton Security (HKLM-x32\...\NS) (Version: 22.1.0.9 - Symantec Corporation)
Nuance OmniPage 18 (HKLM-x32\...\{560C6F9C-8D5E-4EAF-B408-98850E5DF49C}) (Version: 18.1.0000 - Nuance Communications, Inc.)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.25 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Paragon Hard Disk Manager 2008 Professional (HKLM-x32\...\{E9E4BB29-FA98-401B-9EDE-9906906E33DE}) (Version:  - Paragon Software Group)
Parallels runtime modules (x32 Version: 1.00.0000 - Parallels) Hidden
Parallels USB Driver (x32 Version: 6.00.15055 - Parallels) Hidden
PDF Split And Merge Basic (HKLM\...\{C91B24F6-1629-11E2-B696-21676188709B}) (Version: 2.2.2 - Andrea Vacondio)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
PhoenixRC (HKLM-x32\...\{6D44070C-86F9-424A-B514-6907E4335BCE}) (Version: 3.00.16 - Ihr Firmenname)
PINs 4 (HKLM-x32\...\PINs 4) (Version: 4.50.0.86 - Mirek Wojtowicz)
Preispilot für Firefox (HKLM-x32\...\{0D8E6567-7082-48DB-A305-293873AC8B39}_is1) (Version: 2.0 - Preispilot)
Preispiraten (HKLM-x32\...\{5384EA8A-FECA-4D6E-B7B4-3D4D9D47E5DF}) (Version: 6 - metaspinner net GmbH)
PSPad editor (HKLM-x32\...\PSPad editor_is1) (Version:  - Jan Fiala)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QNAP Finder (HKLM-x32\...\QNAP_FINDER) (Version:  - )
QNAP Web Monitor Component (HKLM-x32\...\QNAPVioStorMonitor) (Version: 3.6.0.22010 - QNAP Systems, Inc.)
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
RagTime Privat (HKLM-x32\...\RagTime Privat) (Version:  - )
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6050 - Realtek Semiconductor Corp.)
Remote Control USB Driver (HKLM-x32\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )
RivaTuner Statistics Server 5.2.0 (HKLM-x32\...\RTSS) (Version: 5.2.0 - Unwinder)
Samsung CLX-6260 Series (HKLM-x32\...\Samsung CLX-6260 Series) (Version: 1.05 (16.10.2012) - Samsung Electronics Co., Ltd.)
Samsung Easy Color Manager (HKLM-x32\...\{778EACF8-06C1-47AA-9284-91550E9BAD39}) (Version: 3.02.04 - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.05.78 (28.06.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.03.58.00(17.07.2013) - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.10.11 (01.07.2013) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.00.05 (10.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.01.08.00 - Samsung Electronics Co., Ltd.) Hidden
Sandboxie 4.14 (64-bit) (HKLM\...\Sandboxie) (Version: 4.14 - Sandboxie Holdings, LLC)
SANUK CyberControl 3.0 (HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\SANUK CyberControl 3.0) (Version:  - )
ScanSnap (x32 Version: 5.1.30.19 - PFU Limited) Hidden
SDFormatter (HKLM-x32\...\{5A347920-4AFC-11D5-9FB0-800649886934}) (Version:  - )
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) (HKLM-x32\...\SLABCOMM&10C4&EA60) (Version:  - Silicon Laboratories)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{5C3C3D8E-9C3F-4E44-95FF-9458B12C09CD}) (Version: 6.4 - Silicon Laboratories, Inc.)
SiSoftware Sandra Lite 2012.SP5c (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 18.74.2012.10 - SiSoftware)
Snagit 9.1.3 (HKLM-x32\...\{5C47C8B6-77FF-4FC7-A388-66FCF9CFC24C}) (Version: 9.1.3.16 - TechSmith Corporation)
SnapAPI (x32 Version: 3.0.306 - Acronis) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Sophos Anti-Rootkit 1.5.4 (HKLM-x32\...\Sophos-AntiRootkit) (Version: 1.5.4 - Sophos Plc)
Stampit Home (HKLM-x32\...\{B83AAFD3-D8DE-46CE-9351-70C21AC6704E}) (Version: 3.3 - Deutsche Post AG)
StarMoney (x32 Version: 2.0 - StarFinanz) Hidden
StarMoney (x32 Version: 3.0.1.31 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 9.0 apoEdition (HKLM-x32\...\{D34405B6-6480-4228-B811-4181F38411F8}) (Version: 9.0 - Star Finanz GmbH)
SurveillancePlugin (HKLM-x32\...\{970AE435-8AAE-4F5E-A754-880DAC8968C5}) (Version: 1.0.0.565 - Synology)
SyncThru Admin 6.0.2.319 (HKLM\...\SyncThru Admin) (Version: 6.0.2.319 - Samsung Electronics Co., Ltd.)
Synology Assistant (HKLM-x32\...\{C59ADB1C-0403-4A11-8930-9F81ABC71908}) (Version: 1.0.0.0 - Synology Inc.)
Synology Data Replicator  3 (HKLM-x32\...\{8E310838-457C-4269-B177-3EFB300CBDDC}) (Version: 1.0.0.0 - Synology Inc.)
Synology Download Redirector (HKLM-x32\...\{B1E9B7ED-8187-433a-9EAE-20DF1A8968B1}) (Version: 1.0.0.0 - Synology Inc.)
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version:  - )
System Requirements Lab for Intel (HKLM-x32\...\{F7FC9307-374E-4017-8E9D-DE1154780480}) (Version: 4.1.66.0 - Husdawg, LLC)
Tag&Rename 3.8.3 (HKLM-x32\...\Tag&Rename_is1) (Version: 3.8.3 - Softpointer Inc)
TagScanner 5.1.655 (HKLM-x32\...\TagScanner_is1) (Version:  - Sergey Serkov)
Tera Term 4.76 (HKLM-x32\...\Tera Term_is1) (Version:  - )
Tera Term Pro (HKLM-x32\...\Tera Term Pro) (Version:  - )
TerraTec Home Cinema (HKLM-x32\...\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}) (Version: 6.15.11 - )
theRenamer 7.58 (HKLM-x32\...\{55B6344C-AE4F-4DA8-BF32-D7AE0CB4D2BE}_is1) (Version:  - theRenamer)
Tinypic 3.15 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.15 - E. Fiedler)
Total Commander (Remove or Repair) (HKLM-x32\...\Totalcmd) (Version: 7.55 - Ghisler Software GmbH)
TotalPDFConverter (HKLM-x32\...\Total PDF Converter_is1) (Version: 2.8 - Softplicity, Inc.)
Trainingssoftware (HKLM-x32\...\{7C33F907-7A81-48B8-BD2D-D851C5FA9EFC}) (Version: 1.0.0 - IKE Software Solutions)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
UltraVNC 1.0.8.2 (HKLM\...\Ultravnc2_is1) (Version: 1.0.8.2 - 1.0.8.2)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Unlocker 1.9.0-x64 (HKLM\...\Unlocker) (Version: 1.9.0-x64 - Cedrick Collomb)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden
Versandhelfer (HKLM-x32\...\dpdhl.versandhelfer) (Version: 1.6 - Deutsche Post AG)
Versandhelfer (x32 Version: 1.6 - Deutsche Post AG) Hidden
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 3.1.3.14951 - VMware, Inc)
VMware Player (x32 Version: 3.1.3.14951 - VMware, Inc.) Hidden
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Installer Clean Up (HKLM-x32\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16422 - Microsoft Corporation)
Windows-Treiberpaket - Neato Robotics, Inc. (usbser64) Ports  (08/08/2009 1.0.0.0) (HKLM\...\02AF1A75FA8A484C4B36225C5CE9770ECD2C3F04) (Version: 08/08/2009 1.0.0.0 - Neato Robotics, Inc.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{5b55a44a-d008-49aa-9234-86fb7709bc0a}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{8235761D-4AF3-438A-B8E7-AFB83A927572}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\Windows Sidebar\Gadgets\NetGadget64.gadget\NETGAD~1.OCX (SystemGadgets.com)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

07-02-2015 09:51:04 Installed SurveillancePlugin
07-02-2015 11:08:46 Installed SurveillancePlugin
07-02-2015 12:53:01 Gerätetreiber-Paketinstallation: FTDI USB-Controller
07-02-2015 12:55:30 Gerätetreiber-Paketinstallation: FTDI Anschlüsse (COM & LPT)
07-02-2015 13:58:27 Windows Live Essentials
07-02-2015 14:05:25 DirectX wurde installiert
07-02-2015 14:06:42 DirectX wurde installiert
07-02-2015 14:07:29 DirectX wurde installiert
07-02-2015 14:10:35 WLSetup
08-02-2015 19:01:42 Windows-Sicherung
10-02-2015 12:12:38 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 13:34 - 2013-03-02 20:52 - 00000914 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.94.0.1	client.openvpn.net


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01F93C8D-72DA-4E57-B961-B204BCCA9656} - System32\Tasks\{4D54EC34-A114-47F5-952E-10F0E05BCF9B} => pcalua.exe -a C:\Users\Holger\AppData\Local\Temp\SIT39039.tmp\setup.exe -d C:\Users\Holger\Desktop -c /web /createdtemp /noremove
Task: {1091566D-A4E4-4995-B338-CCD34725840B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1326FA6F-AEF0-475A-BD26-83428EF7315A} - System32\Tasks\Norton Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\SymErr.exe [2014-12-03] (Symantec Corporation)
Task: {14E71595-B70E-41A3-BCC8-557806C68191} - System32\Tasks\{DDC1BE62-6BE1-4E05-A345-976F16016567} => \\LAN16TB\Qdownload\Software\AR-860\ar860_release_7.exe [2013-10-31] (Microsoft Corporation)
Task: {19555060-9BC6-488E-9FCF-3505C2DE4303} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe
Task: {1A35C5AC-FCDF-4B14-A0CD-4C6430DEF260} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {1EFD2C33-571F-49C0-BF65-0D99D16BD107} - System32\Tasks\Norton Security\Norton Error Processor => C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\SymErr.exe [2014-12-03] (Symantec Corporation)
Task: {2241343D-42F7-4E1A-A6A1-AE45B4F0E8B7} - System32\Tasks\{00751C2C-0DE5-4235-8359-A01ADA1506E1} => pcalua.exe -a C:\Users\Holger\Downloads\FTClean\FTClean\FTClean.exe -d C:\Users\Holger\Downloads\FTClean\FTClean
Task: {25E66A45-3C7C-4380-948E-2F963151A51F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {29CE379D-6D8C-4D45-A749-6D094CC6BA2E} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {3A4CF5D8-438A-45AA-A311-F5F360CDD04E} - System32\Tasks\{4651B321-CCC4-4970-8378-F93F9AFFA6A7} => pcalua.exe -a C:\Users\Holger\Downloads\dotnetfx3setup.exe -d C:\Users\Holger\Downloads
Task: {66320C1B-F4C4-43C2-8E69-3560AE031B7F} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {773BEDA6-C413-472C-83DE-8B2ECFAA5841} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {8A622EE7-C862-4228-B29A-41297518F34F} - System32\Tasks\Paragon Archive name arc_200109222223769 => G:\Program Files (x86)\Paragon Hard Disk Manager\program\scripts.exe [2008-02-14] ()
Task: {8A7B74F6-81F3-4A1A-850E-CF707CFBF6D7} - System32\Tasks\{4656EB54-7DAF-4357-8EE8-713BC2D315B2} => pcalua.exe -a C:\NVIDIA\DisplayDriver\197.45\WinVista_Win7_64\International\setup.exe -d C:\NVIDIA\DisplayDriver\197.45\WinVista_Win7_64\International
Task: {8B07DE4F-6A77-4E53-9015-0A13C293BE27} - System32\Tasks\{55B1856F-FB6C-4B5C-9041-8BFE0BBF347C} => pcalua.exe -a C:\Users\Holger\Downloads\Data_Replicator_0142\install\Setup.exe -d C:\Users\Holger\Downloads\Data_Replicator_0142\install
Task: {9AECA740-CCE5-42A4-A8C3-3D0B8A77595F} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {9D79E829-BC19-4C6F-905D-49CE821E1AE6} - System32\Tasks\CCleanerSkipUAC => G:\Program Files (x86)\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {A64118A4-86B1-44A8-A4F9-50773F0A5934} - System32\Tasks\{9D7A00A4-9EA3-473E-98B9-2E43F8A8AE39} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{579BA58C-F33D-4970-9953-B94B43768AC3}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {B989BDDD-24E8-47A5-A441-911C0A96D24F} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe
Task: {BEDAFA69-B89A-4FCD-AE9C-3FEB3CD707B3} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\WSCStub.exe [2014-12-10] (Symantec Corporation)
Task: {D99A0E12-1CED-42F2-B162-882C8021A86A} - System32\Tasks\{D0F106D5-7AE5-4C86-B881-DB7FD3469858} => pcalua.exe -a H:\Downloads\Graupner\REFLEX_SETUP_V5042DE.exe -d H:\Downloads\Graupner
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {FAF6E5EE-5005-409E-867E-D38D4431DCB1} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-01-29] (Microsoft)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Paragon Archive name arc_200109222223769.job => G:\Program Files (x86)\Paragon Hard Disk Manager\program\scripts.exe

==================== Loaded Modules (whitelisted) ==============

2013-10-12 10:39 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-02-25 17:56 - 2013-12-03 21:51 - 00036680 _____ () C:\Windows\System32\dirport64.dll
2013-02-22 17:51 - 2012-01-10 05:15 - 00034304 _____ () C:\Windows\System32\ssy3clm.dll
2013-10-07 15:54 - 2013-10-07 15:54 - 00218112 _____ () G:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2013-05-03 11:54 - 2013-05-03 11:54 - 00204800 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe
2010-03-24 17:29 - 2010-03-24 17:29 - 00404480 _____ () G:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe
2008-12-25 23:40 - 2006-12-29 06:37 - 00200704 ____R () C:\Windows\SysWOW64\UMonit.exe
2012-03-09 08:58 - 2012-03-09 08:58 - 00462712 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 08:58 - 2012-03-09 08:58 - 00057208 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2013-06-10 13:55 - 2013-06-10 13:55 - 00012520 _____ () C:\Users\Holger\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\CoreTempReader.dll
2013-06-10 13:55 - 2013-06-10 13:55 - 00015080 _____ () C:\Users\Holger\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\GetCoreTempInfoNET.dll
2013-06-10 13:55 - 2013-06-10 13:55 - 00014056 _____ () C:\Users\Holger\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\SystemInfo.dll
2013-02-25 17:50 - 2013-12-03 21:50 - 00712520 _____ () G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe
2015-01-27 13:18 - 2015-01-27 13:18 - 02926800 _____ () G:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
2015-01-21 03:06 - 2015-01-21 03:06 - 00057344 _____ () G:\Program Files (x86)\CCleaner\lang\lang-1031.dll
2012-11-22 17:27 - 2010-07-02 13:52 - 00530448 _____ () G:\Program Files\Core Temp\Core Temp.exe
2014-05-01 20:29 - 2014-05-01 20:29 - 00098304 _____ () G:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-04-30 00:40 - 2010-04-30 00:40 - 00013312 _____ () G:\Program Files\Unlocker\UnlockerCOM.dll
2013-05-30 11:52 - 2013-05-30 11:52 - 00295984 _____ () C:\windows\system32\spool\drivers\x64\3\ssy3cpi.exe
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-12-16 15:38 - 2007-05-31 07:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00221184 _____ () G:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-10-07 15:47 - 2013-10-07 15:47 - 00037888 _____ () G:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-10-07 15:44 - 2013-10-07 15:44 - 00050176 _____ () G:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00069632 _____ () G:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00628224 _____ () G:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2014-09-06 17:44 - 2014-09-06 17:44 - 00035328 _____ () G:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () G:\Program Files (x86)\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () G:\Program Files (x86)\FileZilla FTP Client\libstdc++-6.dll
2014-08-14 04:54 - 2011-01-13 11:44 - 00232800 _____ () G:\Program Files (x86)\StarMoney9.0\ouservice\PATCHW32.dll
2012-08-31 10:13 - 2012-08-31 10:13 - 00172032 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\LIBPQ.dll
2012-08-31 10:13 - 2012-08-31 10:13 - 00976384 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\libxml2.dll
2012-08-31 10:13 - 2012-08-31 10:13 - 00059904 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\zlib1.dll
2010-11-11 13:31 - 2010-11-11 13:31 - 00970352 _____ () G:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2010-11-11 13:31 - 2010-11-11 13:31 - 00068720 _____ () G:\Program Files (x86)\VMware\VMware Player\zlib1.dll
2008-12-25 23:40 - 2006-06-07 12:17 - 00151552 ____R () C:\Windows\SysWOW64\ustor.dll
2010-06-11 09:56 - 2010-06-11 09:56 - 00029576 _____ () G:\Program Files (x86)\STAMPIT\Binary\SDSERROR.DLL
2010-06-11 09:56 - 2010-06-11 09:56 - 00087432 _____ () G:\Program Files (x86)\STAMPIT\Binary\SDSEVENT.DLL
2011-06-17 11:46 - 2011-06-17 11:46 - 02408448 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2011-06-17 11:46 - 2011-06-17 11:46 - 08626176 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2011-06-17 11:46 - 2011-06-17 11:46 - 00212992 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2013-02-25 17:50 - 2013-12-03 21:50 - 00076616 _____ () G:\Program Files (x86)\applord GmbH\ecoDMS - Client\classifyclient.dll
2013-02-25 17:50 - 2013-12-03 21:50 - 00065352 _____ () G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecoarchiveclient.dll
2012-04-10 15:42 - 2011-08-24 03:39 - 00081920 _____ () G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\koan\_ctypes.pyd
2012-04-10 15:42 - 2011-08-24 03:39 - 00053248 _____ () G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\Koan\_socket.pyd
2012-04-10 15:42 - 2011-08-24 03:39 - 00655360 _____ () G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\Koan\_ssl.pyd
2009-08-18 11:02 - 2009-08-18 11:02 - 00061952 _____ () G:\Program Files (x86)\BOINC\zlib1.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00113171 _____ () G:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 02396691 _____ () G:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00268307 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdshow_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00027667 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libdirectsound_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00031251 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00066579 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirectdraw_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 02043411 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\liblibbluray_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00100371 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_bd_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00244243 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\libdvdnav_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00076307 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\libaccess_vdr_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00045587 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\libfilesystem_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00060947 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libsmooth_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00531475 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libhttplive_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00708627 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\libdash_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00114195 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\libzip_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00040467 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\access\libstream_filter_rar_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00014867 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\stream_filter\librecord_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00133139 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libplaylist_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01512467 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\meta_engine\libtaglib_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00296979 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\lua\liblua_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01248787 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\misc\libxml_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00054291 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\control\libhotkeys_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00038419 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\control\libglobalhotkeys_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 11148307 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\gui\libqt4_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00189971 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\demux\libmp4_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00292371 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libpng_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00017939 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libcdg_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01280019 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libschroedinger_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00018451 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libdts_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00336403 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libtheora_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00344595 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libfaad_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00198675 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libflac_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00027155 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libg711_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00015891 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaes3_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01393171 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblibass_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00146451 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspeex_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00022035 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liblpcm_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00733203 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libvorbis_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00018963 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libmpeg_audio_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00026131 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libaraw_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00171027 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libopus_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00019475 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\liba52_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00019987 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libspudec_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 10447379 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\codec\libavcodec_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00746515 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\text_renderer\libfreetype_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00026643 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_yuy2_sse2_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00019987 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_yuy2_mmx_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00587283 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libswscale_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00113683 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi420_rgb_sse2_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00027667 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\sse2\libi422_yuy2_sse2_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00019987 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi422_yuy2_mmx_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00053779 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\mmx\libi420_rgb_mmx_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00016915 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i422_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00015379 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libgrey_yuv_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00032275 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00018963 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi420_yuy2_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00020499 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00017427 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_yuy2_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00015379 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_chroma\libi422_i420_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00013843 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\audio_mixer\libfloat_mixer_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00015379 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00018963 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libscaletempo_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00013843 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_filter\libyuvp_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 01496083 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\audio_filter\libsamplerate_plugin.dll
2014-07-23 00:29 - 2014-07-23 00:29 - 00068115 _____ () G:\Program Files (x86)\VideoLAN\VLC\plugins\video_output\libdirect3d_plugin.dll
2015-01-27 16:09 - 2015-01-27 16:09 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-05-03 11:54 - 2013-05-03 11:54 - 00081920 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\wrapper.dll
2013-04-10 10:38 - 2013-04-10 10:38 - 00310272 _____ () C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\sslog.dll
2013-04-10 10:38 - 2013-04-10 10:38 - 00615424 _____ () C:\Program Files (x86)\Samsung\Easy Printer Manager\CDAS2PC\SAStyle.cjstyles
2012-03-09 08:58 - 2012-03-09 08:58 - 00056696 _____ () C:\Program Files (x86)\Common Files\Common Desktop Agent\CDASrvPS.dll
2013-04-10 10:50 - 2013-04-10 10:50 - 02560512 _____ () C:\Program Files (x86)\Samsung\Easy Printer Manager\sf.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:A303874F
AlternateDataStreams: C:\Users\Public\.DS_Store:AFP_AfpInfo

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2149552335-4145356072-959976354-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: IGDCTRL => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Launch LAN USB Utility.exe.lnk => C:\Windows\pss\Launch LAN USB Utility.exe.lnk.CommonStartup
MSCONFIG\startupreg: LAN USB Utility => "C:\Program Files (x86)\Sharkoon\LAN USB Utility\LAN USB Utility.exe" /h
MSCONFIG\startupreg: MyKey => G:\Program Files (x86)\CHIPDRIVE\CHIPDRIVE MyKey\MyKey\MyKey.exe

==================== Accounts: =============================

Administrator (S-1-5-21-2149552335-4145356072-959976354-500 - Administrator - Enabled) => C:\Users\Administrator
ASPNET (S-1-5-21-2149552335-4145356072-959976354-1002 - Limited - Enabled)
Gast (S-1-5-21-2149552335-4145356072-959976354-501 - Limited - Enabled)
Holger (S-1-5-21-2149552335-4145356072-959976354-1000 - Administrator - Enabled) => C:\Users\Holger
HomeGroupUser$ (S-1-5-21-2149552335-4145356072-959976354-1021 - Limited - Enabled)
Test (S-1-5-21-2149552335-4145356072-959976354-1009 - Limited - Enabled)
__vmware_user__ (S-1-5-21-2149552335-4145356072-959976354-1013 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/10/2015 05:47:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: thunderbird.exe, Version: 31.4.0.5487, Zeitstempel: 0x54b049e4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x1fcffafc
ID des fehlerhaften Prozesses: 0x6d8
Startzeit der fehlerhaften Anwendung: 0xthunderbird.exe0
Pfad der fehlerhaften Anwendung: thunderbird.exe1
Pfad des fehlerhaften Moduls: thunderbird.exe2
Berichtskennung: thunderbird.exe3

Error: (02/10/2015 05:32:00 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000008bd0fd8
ID des fehlerhaften Prozesses: 0x1bac
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (02/10/2015 05:16:41 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/10/2015 05:16:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (02/10/2015 05:16:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (02/10/2015 05:16:12 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (02/10/2015 03:02:00 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/10/2015 03:02:00 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/10/2015 03:02:00 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/10/2015 03:02:00 PM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command


System errors:
=============
Error: (02/11/2015 07:15:44 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/10/2015 05:18:51 PM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/10/2015 05:18:51 PM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/10/2015 05:18:51 PM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/10/2015 05:18:51 PM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/10/2015 05:17:04 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (02/10/2015 03:01:38 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {C3D84F57-9904-4F7D-8D79-1D72DAD51ADC}

Error: (02/10/2015 10:41:37 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {74944725-B65F-4E37-8633-BD4DDE193921}

Error: (02/09/2015 05:15:55 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR11 gefunden.

Error: (02/09/2015 05:15:54 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk2\DR11 gefunden.


Microsoft Office Sessions:
=========================
Error: (07/05/2011 07:11:54 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6557.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 45 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (01/03/2010 05:04:45 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4562 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2015-02-10 19:57:45.926
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-10 17:28:35.005
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-10 17:15:31.687
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-09 18:49:42.068
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-09 18:25:38.218
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-09 18:19:31.279
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-09 17:51:02.580
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-09 17:23:47.168
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-09 17:16:02.073
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-09 17:05:12.405
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Quad CPU Q9300 @ 2.50GHz
Percentage of memory in use: 61%
Total physical RAM: 4094.49 MB
Available physical RAM: 1557.89 MB
Total Pagefile: 12281.66 MB
Available Pagefile: 7989.62 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:194.22 GB) (Free:35.02 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (BOOT) (Fixed) (Total:74.53 GB) (Free:35.4 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Data XP) (Fixed) (Total:298.68 GB) (Free:81.98 GB) NTFS
Drive g: (DataWindows7) (Fixed) (Total:63.47 GB) (Free:34.11 GB) NTFS
Drive h: (Temporary2) (Fixed) (Total:673.82 GB) (Free:611.83 GB) NTFS
Drive i: (Disc) (CDROM) (Total:4.1 GB) (Free:0 GB) UDF
Drive l: (Temporary1) (Fixed) (Total:558.3 GB) (Free:546.64 GB) NTFS
Drive r: () (Network) (Total:1397.76 GB) (Free:1376.62 GB) 
Drive s: () (Network) (Total:1830.83 GB) (Free:1029.89 GB) 
Drive t: () (Network) (Total:1830.83 GB) (Free:421.09 GB) 
Drive v: () (Network) (Total:1397.76 GB) (Free:1376.62 GB) 
Drive w: () (Network) (Total:19223.53 GB) (Free:6427.75 GB) 
Drive x: () (Network) (Total:12927.97 GB) (Free:2353.64 GB) 
Drive y: () (Network) (Total:12927.97 GB) (Free:2353.64 GB) 
Drive z: () (Network) (Total:12927.97 GB) (Free:2353.64 GB) 

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: FAB30BFC)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298.7 GB) - (Type=05)
Partition 3: (Not Active) - (Size=558.3 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 853C4862)
Partition 1: (Active) - (Size=194.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=63.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=673.8 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

gmer:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-12 14:39:21
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-1 SAMSUNG_HD103SJ rev.1AJ10001 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Holger\AppData\Local\Temp\fwpiykog.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\nvvsvc.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                            0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\nvvsvc.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                                0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\nvvsvc.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                             00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\nvvsvc.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                         00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\System32\svchost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\System32\svchost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\System32\svchost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\System32\svchost.exe[1508] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\System32\svchost.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\System32\svchost.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\System32\svchost.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\System32\svchost.exe[1556] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\svchost.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\svchost.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\svchost.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\svchost.exe[1580] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\svchost.exe[1604] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\svchost.exe[1604] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\svchost.exe[1604] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\svchost.exe[1604] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\servicing\TrustedInstaller.exe[1812] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                 0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\servicing\TrustedInstaller.exe[1812] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                     0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\servicing\TrustedInstaller.exe[1812] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                  00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\servicing\TrustedInstaller.exe[1812] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                              00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\svchost.exe[1732] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\svchost.exe[1732] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\svchost.exe[1732] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\svchost.exe[1732] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\svchost.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\svchost.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\svchost.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\svchost.exe[2284] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                              00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                  00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2444] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                               00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe[2480] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                              00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe[2480] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                  00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe[2480] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                               00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                              00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                  00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                               00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Windows\SysWOW64\cjpcsc.exe[2844] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                                            00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Windows\SysWOW64\cjpcsc.exe[2844] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                                                00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Windows\SysWOW64\cjpcsc.exe[2844] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                                             00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe[2920] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                    00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe[2920] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                        00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe[2920] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                     00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                    00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                 00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                              00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                              00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                              00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                 00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                          00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                 00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                          00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                     00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                              00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                   00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                              00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                          00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2328] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                          00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe[2596] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                             00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe[2596] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                 00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe[2596] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                              00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\pg_ctl.exe[3340] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory          00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\pg_ctl.exe[3340] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory              00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\pg_ctl.exe[3340] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory           00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory        00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory            00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory         00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3488] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3640] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory        00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3640] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory            00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe[3640] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory         00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe[3700] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                   00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe[3700] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                       00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe[3700] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                    00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3804] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                   0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3804] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                       0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3804] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                    00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3804] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                00000000778217b2 3 bytes {JMP 0x15e890}
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                           00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                             00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                           00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                           00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                              00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                       00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                              00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                       00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                             00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                  00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                           00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                             00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                             00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                           00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                       00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                       00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                              00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                  00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                               00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                            00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                              00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                            00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                            00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                               00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                        00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                               00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                        00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                              00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                   00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                            00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                              00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                 00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                              00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                            00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                        00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3972] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                        00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                  00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                      00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                   00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                  00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                   00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                            00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                   00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                            00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                  00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                       00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                  00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                     00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                  00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                            00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\Tools\jre1.6.0_30\bin\java.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                            00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Windows\SysWOW64\vmnetdhcp.exe[3452] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                                         00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Windows\SysWOW64\vmnetdhcp.exe[3452] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                                             00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Windows\SysWOW64\vmnetdhcp.exe[3452] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                                          00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                  0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                      0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                   00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[5100] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                               00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\nvvsvc.exe[5112] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                            0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\nvvsvc.exe[5112] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                                0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\nvvsvc.exe[5112] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                             00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\nvvsvc.exe[5112] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                         00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\System32\svchost.exe[2112] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\System32\svchost.exe[2112] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\System32\svchost.exe[2112] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\System32\svchost.exe[2112] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\taskhost.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                          0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\taskhost.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                              0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\taskhost.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                           00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\taskhost.exe[5652] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                       00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5736] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5736] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5736] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5736] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\conhost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\conhost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\conhost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\conhost.exe[5744] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe[5772] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                             00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe[5772] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                 00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe[5772] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                              00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe[4796] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                 00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe[4796] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                     00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe[4796] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                  00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4232] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                       00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4232] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                           00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4232] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                        00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Windows\system32\Dwm.exe[4632] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                               0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\Dwm.exe[4632] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                                   0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\Dwm.exe[4632] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                                00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\Dwm.exe[4632] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                            00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\Explorer.EXE[5532] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                                   0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\Explorer.EXE[5532] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                                       0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\Explorer.EXE[5532] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                                    00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\Explorer.EXE[5532] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                                00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Windows\system32\SearchIndexer.exe[2280] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                     0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\system32\SearchIndexer.exe[2280] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                         0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\system32\SearchIndexer.exe[2280] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                      00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\system32\SearchIndexer.exe[2280] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                                  00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe[6352] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                        00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe[6352] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                            00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe[6352] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                         00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Windows\SysWOW64\UMonit.exe[6368] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                                            00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Windows\SysWOW64\UMonit.exe[6368] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                                                00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Windows\SysWOW64\UMonit.exe[6368] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                                             00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[6400] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                           0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[6400] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                               0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[6400] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                            00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[6400] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                        00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe[6420] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                             0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe[6420] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                 0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe[6420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                              00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe[6420] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                          00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Program Files\Windows Sidebar\sidebar.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                              0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Program Files\Windows Sidebar\sidebar.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                  0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Program Files\Windows Sidebar\sidebar.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                               00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Program Files\Windows Sidebar\sidebar.exe[6444] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                           00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                            00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                             00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                          00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                            00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                          00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                          00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                             00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                      00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                             00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                      00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                            00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                 00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                          00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                            00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                               00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                            00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                          00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                      00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe[6572] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                      00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[4132] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                              00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[4132] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                                  00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[4132] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                               00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                    00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                 00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                              00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                              00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                              00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                 00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                          00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                 00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                          00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                     00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                              00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                   00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                              00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                          00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe[6784] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                          00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe[6472] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                  0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe[6472] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                      0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe[6472] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                   00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe[6472] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                               00000000778217b2 3 bytes {JMP 0x15e890}
.text   G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe[6772] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                         00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe[6772] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                             00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe[6772] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                          00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\BOINC\boinctray.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                                00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\BOINC\boinctray.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                                    00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\BOINC\boinctray.exe[5352] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                                 00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\VMware\VMware Player\hqtray.exe[5360] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                    00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\VMware\VMware Player\hqtray.exe[5360] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                        00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\VMware\VMware Player\hqtray.exe[5360] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                     00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                 00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                     00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                  00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\KERNEL32.dll!SetUnhandledExceptionFilter                                          0000000075f78791 5 bytes JMP 0000000163171000
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                               00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                 00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                               00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                               00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                  00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                           00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                  00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                           00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                 00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                      00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                               00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                 00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                    00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                 00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                               00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                           00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe[6612] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                           00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                    00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                 00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\KERNEL32.dll!SetUnhandledExceptionFilter                                                         0000000075f78791 5 bytes JMP 0000000163171000
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                              00000000755f1401 2 bytes JMP 75f9b21b C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                00000000755f1419 2 bytes JMP 75f9b346 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                              00000000755f1431 2 bytes JMP 76018ea9 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                              00000000755f144a 2 bytes CALL 75f748ad C:\Windows\syswow64\KERNEL32.dll
.text   ...                                                                                                                                                                                                   * 9
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                 00000000755f14dd 2 bytes JMP 760187a2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                          00000000755f14f5 2 bytes JMP 76018978 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                 00000000755f150d 2 bytes JMP 76018698 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                          00000000755f1525 2 bytes JMP 76018a62 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                00000000755f153d 2 bytes JMP 75f8fca8 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                     00000000755f1555 2 bytes JMP 75f968ef C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                              00000000755f156d 2 bytes JMP 76018f61 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                00000000755f1585 2 bytes JMP 76018ac2 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                   00000000755f159d 2 bytes JMP 7601865c C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                00000000755f15b5 2 bytes JMP 75f8fd41 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                              00000000755f15cd 2 bytes JMP 75f9b2dc C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                          00000000755f16b2 2 bytes JMP 76018e24 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe[7072] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                          00000000755f16bd 2 bytes JMP 760185f1 C:\Windows\syswow64\KERNEL32.dll
.text   G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[6560] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                    00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[6560] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                        00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[6560] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                     00000000779d0038 5 bytes JMP 0000000175208d80
.text   G:\Program Files (x86)\iTunes\iTunesHelper.exe[7484] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                            00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   G:\Program Files (x86)\iTunes\iTunesHelper.exe[7484] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                                00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   G:\Program Files (x86)\iTunes\iTunesHelper.exe[7484] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                             00000000779d0038 5 bytes JMP 0000000175208d80
.text   C:\Program Files\iPod\bin\iPodService.exe[3092] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                                                                 0000000077821430 5 bytes JMP 0000000077980010
.text   C:\Program Files\iPod\bin\iPodService.exe[3092] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                                                     0000000077821490 5 bytes JMP 0000000077980028
.text   C:\Program Files\iPod\bin\iPodService.exe[3092] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                                                  00000000778217b0 1 byte JMP 0000000077980040
.text   C:\Program Files\iPod\bin\iPodService.exe[3092] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory + 2                                                                                              00000000778217b2 3 bytes {JMP 0x15e890}
.text   C:\Users\Holger\Desktop\Gmer-19357.exe[6720] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                                                                    00000000779cfac0 5 bytes JMP 0000000175208cf0
.text   C:\Users\Holger\Desktop\Gmer-19357.exe[6720] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                                                                        00000000779cfb58 5 bytes JMP 0000000175208ea0
.text   C:\Users\Holger\Desktop\Gmer-19357.exe[6720] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                                     00000000779d0038 5 bytes JMP 0000000175208d80
         

gmer (Teil2):

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\svchost.exe [1604:2092]                                                                                                                                                           000007fef9ba1e00
Thread  C:\Windows\system32\svchost.exe [1604:2104]                                                                                                                                                           000007fef9b01a50
Thread  C:\Windows\system32\svchost.exe [1604:2228]                                                                                                                                                           000007fefcc41a70
Thread  C:\Windows\system32\svchost.exe [1604:3864]                                                                                                                                                           000007fefcc41a70
Thread  C:\Windows\system32\svchost.exe [1604:3544]                                                                                                                                                           000007fef72c506c
Thread  C:\Windows\system32\svchost.exe [1604:3552]                                                                                                                                                           000007fef7361c20
Thread  C:\Windows\system32\svchost.exe [1604:3548]                                                                                                                                                           000007fef7361c20
Thread  C:\Windows\system32\svchost.exe [1604:4156]                                                                                                                                                           000007fef6fa1ab0
Thread  C:\Windows\system32\svchost.exe [1604:4504]                                                                                                                                                           000007fef66cc8ec
Thread  C:\Windows\system32\svchost.exe [1604:5676]                                                                                                                                                           000007fef97cce0c
Thread  C:\Windows\system32\svchost.exe [1604:3408]                                                                                                                                                           000007fef8e05124
Thread  C:\Windows\system32\svchost.exe [1604:7288]                                                                                                                                                           000007feef8b4164
Thread  C:\Windows\system32\svchost.exe [1604:8760]                                                                                                                                                           000007fef94b5170
Thread  C:\Windows\system32\svchost.exe [1604:8800]                                                                                                                                                           000007fef94b5170
Thread  C:\Windows\system32\svchost.exe [1604:8268]                                                                                                                                                           000007feec96e1c4
Thread  C:\Windows\system32\svchost.exe [1604:1716]                                                                                                                                                           000007feec96e1c4
Thread  C:\Windows\system32\svchost.exe [1604:4180]                                                                                                                                                           000007fef6b2a978
Thread  C:\Windows\system32\svchost.exe [1604:4380]                                                                                                                                                           000007fef6b2a978
Thread  C:\Windows\system32\svchost.exe [1604:9132]                                                                                                                                                           000007fefd722098
Thread  C:\Windows\system32\svchost.exe [1604:8868]                                                                                                                                                           000007fef79f17f8
Thread  C:\Windows\system32\svchost.exe [1604:8948]                                                                                                                                                           000007fef79f17f8
Thread  C:\Windows\System32\svchost.exe [2112:1832]                                                                                                                                                           000007fef75a9688
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [6028:6380]                                                                                                                           000007fef8794094
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [6028:7416]                                                                                                                           000007feee607c4c
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [6028:7748]                                                                                                                           000007fef8794094
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [6028:9204]                                                                                                                           000007feec3bc0d0
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [6028:6332]                                                                                                                           000007fef8794094
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [6036:6900]                                                                                                                            000007fef8794094
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [6036:4164]                                                                                                                            000007fef8794094
Thread  C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [6036:8636]                                                                                                                            000007feec3bc0d0
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6180:8556]                                                                                                                                        000007fefda40168
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6180:8744]                                                                                                                                        000007fefbbe2bf8
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6180:8956]                                                                                                                                        000007feeaf34830
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6180:9068]                                                                                                                                        000007feeaf34830
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6180:9212]                                                                                                                                        000007fef8e05124
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [6180:7660]                                                                                                                                        000007fefda40168

---- EOF - GMER 2.1 ----
         

Mbar:

Malwarebytes Anti-Rootkit BETA 1.08.3.1004



  main:    v0000.00.00.00
  rootkit: v0000.00.00.00

Windows 7 Service Pack 1 x64 NTFS
 11.0.9600.17501
Holger :: HOLGER-QUADCORE 

11.02.2015 20:31:10
mbar-log-2015-02-11 (20-31-10).txt

 
 
 
 4265
 2 , 17 

 0


 0


 0


 0


 0


 0


 0


 0
         

TDSS:

20:35:45.0299 0xc5bc  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
20:35:54.0724 0xc5bc  ============================================================
20:35:54.0724 0xc5bc  Current date / time: 2015/02/11 20:35:54.0724
20:35:54.0724 0xc5bc  SystemInfo:
20:35:54.0724 0xc5bc  
20:35:54.0724 0xc5bc  OS Version: 6.1.7601 ServicePack: 1.0
20:35:54.0724 0xc5bc  Product type: Workstation
20:35:54.0724 0xc5bc  ComputerName: HOLGER-QUADCORE
20:35:54.0724 0xc5bc  UserName: Holger
20:35:54.0724 0xc5bc  Windows directory: C:\Windows
20:35:54.0724 0xc5bc  System windows directory: C:\Windows
20:35:54.0724 0xc5bc  Running under WOW64
20:35:54.0724 0xc5bc  Processor architecture: Intel x64
20:35:54.0724 0xc5bc  Number of processors: 4
20:35:54.0724 0xc5bc  Page size: 0x1000
20:35:54.0725 0xc5bc  Boot type: Normal boot
20:35:54.0725 0xc5bc  ============================================================
20:35:58.0877 0xc5bc  KLMD registered as C:\Windows\system32\drivers\79882790.sys
20:36:02.0579 0xc5bc  System UUID: {5923FCEB-8EB9-9AE4-6C01-832809AFA6BC}
20:36:10.0550 0xc5bc  Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:36:10.0551 0xc5bc  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:36:10.0580 0xc5bc  ============================================================
20:36:10.0580 0xc5bc  \Device\Harddisk1\DR1:
20:36:10.0581 0xc5bc  MBR partitions:
20:36:10.0581 0xc5bc  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x1847164B
20:36:10.0581 0xc5bc  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x1847168A, BlocksNum 0x7EF2ADE
20:36:10.0581 0xc5bc  \Device\Harddisk1\DR1\Partition3: MBR, Type 0x7, StartLBA 0x20364168, BlocksNum 0x543A1859
20:36:10.0581 0xc5bc  \Device\Harddisk0\DR0:
20:36:10.0581 0xc5bc  MBR partitions:
20:36:10.0581 0xc5bc  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x950E482
20:36:10.0595 0xc5bc  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x950E500, BlocksNum 0x2555B68F
20:36:10.0595 0xc5bc  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x2EA6A000, BlocksNum 0x45C9C000
20:36:10.0595 0xc5bc  ============================================================
20:36:10.0614 0xc5bc  C: <-> \Device\Harddisk1\DR1\Partition1
20:36:10.0633 0xc5bc  D: <-> \Device\Harddisk0\DR0\Partition1
20:36:10.0655 0xc5bc  E: <-> \Device\Harddisk0\DR0\Partition2
20:36:10.0714 0xc5bc  G: <-> \Device\Harddisk1\DR1\Partition2
20:36:10.0750 0xc5bc  H: <-> \Device\Harddisk1\DR1\Partition3
20:36:10.0808 0xc5bc  L: <-> \Device\Harddisk0\DR0\Partition3
20:36:10.0868 0xc5bc  ============================================================
20:36:10.0868 0xc5bc  Initialize success
20:36:10.0868 0xc5bc  ============================================================
20:37:09.0047 0x7020  ============================================================
20:37:09.0047 0x7020  Scan started
20:37:09.0047 0x7020  Mode: Manual; SigCheck; TDLFS; 
20:37:09.0047 0x7020  ============================================================
20:37:09.0047 0x7020  KSN ping started
20:37:11.0776 0x7020  KSN ping finished: true
20:37:14.0581 0x7020  ================ Scan system memory ========================
20:37:14.0581 0x7020  System memory - ok
20:37:14.0581 0x7020  ================ Scan services =============================
20:37:14.0755 0x7020  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
20:37:15.0087 0x7020  1394ohci - ok
20:37:15.0160 0x7020  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
20:37:15.0184 0x7020  ACPI - ok
20:37:15.0203 0x7020  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
20:37:15.0336 0x7020  AcpiPmi - ok
20:37:15.0485 0x7020  [ 0786A8818B4AA3C2A6588633EAB11AB1, 73A6E444BF2F64A49637BE40D50A0BE8B494E224D5C95B89D1D0C08960ABFD0A ] AcrSch2Svc      C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
20:37:15.0526 0x7020  AcrSch2Svc - ok
20:37:15.0608 0x7020  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
20:37:15.0674 0x7020  AdobeARMservice - ok
20:37:15.0809 0x7020  [ 080255CDCB878813B481B8C348D47D8E, 75808821FBC732D0504795B8F85852E4C01D3B412989A1E597E1295CFF7B7A45 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:37:15.0831 0x7020  AdobeFlashPlayerUpdateSvc - ok
20:37:15.0873 0x7020  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
20:37:15.0898 0x7020  adp94xx - ok
20:37:15.0927 0x7020  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
20:37:15.0949 0x7020  adpahci - ok
20:37:15.0960 0x7020  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
20:37:15.0980 0x7020  adpu320 - ok
20:37:16.0007 0x7020  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
20:37:16.0234 0x7020  AeLookupSvc - ok
20:37:16.0270 0x7020  [ 3CB8A6BB25EB8B8D5E56123B52DF9412, 83DEAC0EE384C68A45B6AF059A2850E01CC683E2E1BF0D6D8059E491BBEB2D36 ] afcdp           C:\Windows\system32\DRIVERS\afcdp.sys
20:37:16.0294 0x7020  afcdp - ok
20:37:16.0406 0x7020  [ E6E182BDAAD59CEE0339F0474A558015, 7AF97DA7112215B50E1B202A6FC04BA5CB452C8AECDFDAF6ED573E22BBCAB38C ] afcdpsrv        C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
20:37:16.0514 0x7020  afcdpsrv - ok
20:37:16.0583 0x7020  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
20:37:16.0667 0x7020  AFD - ok
20:37:16.0719 0x7020  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
20:37:16.0754 0x7020  agp440 - ok
20:37:16.0785 0x7020  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
20:37:16.0868 0x7020  ALG - ok
20:37:16.0912 0x7020  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
20:37:16.0926 0x7020  aliide - ok
20:37:17.0047 0x7020  ALSysIO - ok
20:37:17.0074 0x7020  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
20:37:17.0087 0x7020  amdide - ok
20:37:17.0153 0x7020  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
20:37:17.0228 0x7020  AmdK8 - ok
20:37:17.0245 0x7020  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
20:37:17.0323 0x7020  AmdPPM - ok
20:37:17.0404 0x7020  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
20:37:17.0424 0x7020  amdsata - ok
20:37:17.0450 0x7020  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
20:37:17.0469 0x7020  amdsbs - ok
20:37:17.0487 0x7020  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
20:37:17.0527 0x7020  amdxata - ok
20:37:17.0573 0x7020  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
20:37:17.0747 0x7020  AppID - ok
20:37:17.0775 0x7020  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
20:37:17.0853 0x7020  AppIDSvc - ok
20:37:17.0910 0x7020  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
20:37:18.0002 0x7020  Appinfo - ok
20:37:18.0120 0x7020  [ 650D03E40F93FAE323CB841F80368E5C, F67B97CFDCE2EE9294977725268EFDB0DD724BD16E7ED5BFCA45375AA8EBA5BB ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:37:18.0135 0x7020  Apple Mobile Device - ok
20:37:18.0182 0x7020  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
20:37:18.0305 0x7020  AppMgmt - ok
20:37:18.0324 0x7020  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
20:37:18.0375 0x7020  arc - ok
20:37:18.0410 0x7020  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
20:37:18.0429 0x7020  arcsas - ok
20:37:18.0579 0x7020  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
20:37:18.0628 0x7020  aspnet_state - ok
20:37:18.0653 0x7020  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
20:37:18.0709 0x7020  AsyncMac - ok
20:37:18.0738 0x7020  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
20:37:18.0752 0x7020  atapi - ok
20:37:18.0799 0x7020  [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:37:18.0878 0x7020  AudioEndpointBuilder - ok
20:37:18.0901 0x7020  [ DE3E38431B00C2EA247C53675DCF01A0, 8965192096C94203A1F16689DCDA45FE0EDF3A6FB75B70FC378C2008E8E71C9B ] AudioSrv        C:\Windows\System32\Audiosrv.dll
20:37:18.0938 0x7020  AudioSrv - ok
20:37:18.0974 0x7020  [ 0FFD8DCCB37BBF1C5BBE44B3CE90452A, 7E3516AC094857E67F378A6696A31433C6BEC787D20D519BAFFB086AD7EE9391 ] AVXBAR          C:\Windows\system32\DRIVERS\88xAXbar.sys
20:37:18.0988 0x7020  AVXBAR - ok
20:37:19.0019 0x7020  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
20:37:19.0112 0x7020  AxInstSV - ok
20:37:19.0163 0x7020  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
20:37:19.0232 0x7020  b06bdrv - ok
20:37:19.0266 0x7020  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
20:37:19.0374 0x7020  b57nd60a - ok
20:37:19.0397 0x7020  [ E4C980B3AB47AA69C1EF07BA121C8411, 9DC44A049449CECC899B3A03B4610544AF3D33DC37957389E15AF339168BCA8E ] BDATUNE         C:\Windows\system32\DRIVERS\88xBdaTune.sys
20:37:19.0412 0x7020  BDATUNE - ok
20:37:19.0464 0x7020  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
20:37:19.0533 0x7020  BDESVC - ok
20:37:19.0556 0x7020  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
20:37:19.0630 0x7020  Beep - ok
20:37:19.0817 0x7020  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
20:37:19.0921 0x7020  BFE - ok
20:37:20.0172 0x7020  [ 99EE5EB9FCBAD85F1992C47C5BB68649, 604B618F0106B09207B262E22E70E152C4104FB2602C009F19EBEB342D0E9CE7 ] BHDrvx64        C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\BASHDefs\20150203.001\BHDrvx64.sys
20:37:20.0224 0x7020  BHDrvx64 - ok
20:37:20.0271 0x7020  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
20:37:20.0503 0x7020  BITS - ok
20:37:20.0525 0x7020  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
20:37:20.0603 0x7020  blbdrive - ok
20:37:20.0725 0x7020  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:37:20.0750 0x7020  Bonjour Service - ok
20:37:20.0777 0x7020  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
20:37:20.0872 0x7020  bowser - ok
20:37:20.0905 0x7020  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:37:21.0001 0x7020  BrFiltLo - ok
20:37:21.0017 0x7020  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:37:21.0092 0x7020  BrFiltUp - ok
20:37:21.0143 0x7020  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
20:37:21.0208 0x7020  Browser - ok
20:37:21.0230 0x7020  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
20:37:21.0336 0x7020  Brserid - ok
20:37:21.0353 0x7020  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
20:37:21.0416 0x7020  BrSerWdm - ok
20:37:21.0453 0x7020  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
20:37:21.0512 0x7020  BrUsbMdm - ok
20:37:21.0533 0x7020  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
20:37:21.0581 0x7020  BrUsbSer - ok
20:37:21.0608 0x7020  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
20:37:21.0647 0x7020  BTHMODEM - ok
20:37:21.0704 0x7020  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
20:37:21.0743 0x7020  bthserv - ok
20:37:21.0851 0x7020  [ 09A841B941CB375793AA174A60BEAAD5, BB961972EE4A8D5D9FA49FE211E5E114A36674992D56687670248229FCA797E8 ] ccSet_NS        C:\Windows\system32\drivers\NSx64\1601000.009\ccSetx64.sys
20:37:21.0870 0x7020  ccSet_NS - ok
20:37:21.0905 0x7020  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
20:37:21.0999 0x7020  cdfs - ok
20:37:22.0036 0x7020  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
20:37:22.0071 0x7020  cdrom - ok
20:37:22.0111 0x7020  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
20:37:22.0164 0x7020  CertPropSvc - ok
20:37:22.0177 0x7020  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
20:37:22.0211 0x7020  circlass - ok
20:37:22.0483 0x7020  [ BDF4915D53BDEF80738A30AC3F7CDC76, 766269A5EB662644F9C0376A999D96DD32890427A32CAF983F83179D55B54251 ] cjpcsc          C:\Windows\SysWOW64\cjpcsc.exe
20:37:22.0550 0x7020  cjpcsc - ok
20:37:22.0583 0x7020  [ 06E1F5228399FC49A8D026DA38DB6784, 5554071E5C55FC7EF3C7C95F0BC565509C3F0C03E0814C98376932A9D1C32AA6 ] cjusb           C:\Windows\system32\DRIVERS\cjusb.sys
20:37:22.0615 0x7020  cjusb - ok
20:37:22.0688 0x7020  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
20:37:22.0714 0x7020  CLFS - ok
20:37:22.0874 0x7020  [ 5B80BCD82FFE6D5240BA02AD338C547C, 8FF4E38C3FE8211C9C244E5270B98AFC8B68A769153E0690268DE23FB7D2DDB3 ] CLHNServiceForPowerDVD12 G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
20:37:22.0889 0x7020  CLHNServiceForPowerDVD12 - ok
20:37:22.0966 0x7020  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:37:22.0986 0x7020  clr_optimization_v2.0.50727_32 - ok
20:37:23.0035 0x7020  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:37:23.0056 0x7020  clr_optimization_v2.0.50727_64 - ok
20:37:23.0112 0x7020  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:37:23.0220 0x7020  clr_optimization_v4.0.30319_32 - ok
20:37:23.0257 0x7020  [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:37:23.0277 0x7020  clr_optimization_v4.0.30319_64 - ok
20:37:23.0303 0x7020  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
20:37:23.0420 0x7020  CmBatt - ok
20:37:23.0466 0x7020  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
20:37:23.0484 0x7020  cmdide - ok
20:37:23.0583 0x7020  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys
20:37:23.0613 0x7020  CNG - ok
20:37:23.0620 0x7020  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
20:37:23.0634 0x7020  Compbatt - ok
20:37:23.0670 0x7020  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
20:37:23.0728 0x7020  CompositeBus - ok
20:37:23.0744 0x7020  COMSysApp - ok
20:37:23.0818 0x7020  [ 3CA734CE373E5675FBC15CA2C45228E5, A6C6E9FABDE5EA18D266DB71C0CC6B51D682116D1898CCB4E9BA730F15C44B32 ] cpudrv64        C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys
20:37:23.0834 0x7020  cpudrv64 - ok
20:37:23.0845 0x7020  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
20:37:23.0859 0x7020  crcdisk - ok
20:37:23.0899 0x7020  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll
20:37:23.0951 0x7020  CryptSvc - ok
20:37:23.0986 0x7020  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
20:37:24.0076 0x7020  CSC - ok
20:37:24.0144 0x7020  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
20:37:24.0185 0x7020  CscService - ok
20:37:24.0232 0x7020  [ 5975309093F2960900729E218FC80FD5, 71EBAA07C5C0016CA6BB3CC13E9453D59A585FCB51A555E4839998D117298665 ] CX23880         C:\Windows\system32\DRIVERS\88xAStream.sys
20:37:24.0248 0x7020  CX23880 - ok
20:37:24.0322 0x7020  [ 550EE5CC3203B4ADCB983D7F8A1C7DE3, 589FD9B6BACA94C1604F1BDA64D707678D23CD4DD4DFF251A49587CD8EEC0753 ] CX88IR          C:\Windows\system32\DRIVERS\88xBdaIr.sys
20:37:24.0336 0x7020  CX88IR - ok
20:37:24.0357 0x7020  [ B3ED00327909BAA822FA1876C2B8D2CC, 4C017E1D9CBEE4EAD6D7A26D0B41B47AC36171C671E48A6D11DFF7B1C0338E12 ] CXAVSTS         C:\Windows\system32\DRIVERS\88xBdaCap.sys
20:37:24.0371 0x7020  CXAVSTS - ok
20:37:24.0419 0x7020  [ 392EB4108A6A8B8E46A3A3568055F277, 6D7B830F2C1E3851EDBAC3B35B8138ECBDF6CF32847FE27957DFBEE3A6C07161 ] CyberLink PowerDVD 12 Media Server Monitor Service G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
20:37:24.0448 0x7020  CyberLink PowerDVD 12 Media Server Monitor Service - ok
20:37:24.0496 0x7020  [ 61A27B34B6A7B534F2DB95C0F8762FAE, 8D4E8A4C06415A031BD97BE42FA4A01A2F7261FB927CB6B9CFE453597954E9A3 ] CyberLink PowerDVD 12 Media Server Service G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
20:37:24.0516 0x7020  CyberLink PowerDVD 12 Media Server Service - ok
20:37:24.0541 0x7020  [ BA25D4B9B067248F7CAC416E855D706B, EB00FEC005863284D25AC708CEF65D945A1599801A3FDE4B992C1AD4593E2036 ] dc3d            C:\Windows\system32\DRIVERS\dc3d.sys
20:37:24.0557 0x7020  dc3d - ok
20:37:24.0593 0x7020  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
20:37:24.0652 0x7020  DcomLaunch - ok
20:37:24.0698 0x7020  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
20:37:24.0755 0x7020  defragsvc - ok
20:37:24.0794 0x7020  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
20:37:24.0890 0x7020  DfsC - ok
20:37:24.0932 0x7020  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
20:37:25.0055 0x7020  Dhcp - ok
20:37:25.0139 0x7020  [ 05F99DFF3A8D705F9AA6B87224F7BEB1, DDE133A44A330A07A0EB961559C840BBFC9D9E0CCA27DE0B4284C76BCAD31EDE ] DirMngr         G:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
20:37:25.0163 0x7020  DirMngr - detected UnsignedFile.Multi.Generic ( 1 )
20:37:27.0877 0x7020  Detect skipped due to KSN trusted
20:37:27.0877 0x7020  DirMngr - ok
20:37:27.0908 0x7020  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
20:37:27.0954 0x7020  discache - ok
20:37:27.0979 0x7020  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
20:37:27.0995 0x7020  Disk - ok
20:37:28.0023 0x7020  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
20:37:28.0059 0x7020  Dnscache - ok
20:37:28.0090 0x7020  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
20:37:28.0138 0x7020  dot3svc - ok
20:37:28.0168 0x7020  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
20:37:28.0243 0x7020  DPS - ok
20:37:28.0285 0x7020  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
20:37:28.0344 0x7020  drmkaud - ok
20:37:28.0400 0x7020  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
20:37:28.0448 0x7020  DXGKrnl - ok
20:37:28.0474 0x7020  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
20:37:28.0524 0x7020  EapHost - ok
20:37:28.0626 0x7020  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
20:37:28.0751 0x7020  ebdrv - ok
20:37:28.0830 0x7020  [ 47A68B3DBBB34D4FE61DE221A8536627, BC61CE4BD4F3A12C75BA6EB9D239F24CD3F54495DE9D6C901F4DAF5D92E8366B ] eeCtrl          C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
20:37:28.0858 0x7020  eeCtrl - ok
20:37:28.0898 0x7020  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS             C:\Windows\System32\lsass.exe
20:37:28.0933 0x7020  EFS - ok
20:37:28.0993 0x7020  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
20:37:29.0058 0x7020  ehRecvr - ok
20:37:29.0088 0x7020  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
20:37:29.0131 0x7020  ehSched - ok
20:37:29.0181 0x7020  [ A05FC7ECA0966EBB70E4D17B855A853B, 16A0C8138A3BBD8BE2658261131F9777940CFB1431018A10710E5C1A88AB70EA ] ElbyCDIO        C:\Windows\system32\Drivers\ElbyCDIO.sys
20:37:29.0196 0x7020  ElbyCDIO - ok
20:37:29.0225 0x7020  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
20:37:29.0253 0x7020  elxstor - ok
20:37:29.0296 0x7020  [ B9773081AAF65E6D553496BA0CADCBB3, 3A77A12544755BFA1ABAA6DC53E5F03522627F57EF7092E3CC54C6431C75076A ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
20:37:29.0311 0x7020  EraserUtilRebootDrv - ok
20:37:29.0339 0x7020  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
20:37:29.0363 0x7020  ErrDev - ok
20:37:29.0376 0x7020  EST_BusEnum - ok
20:37:29.0411 0x7020  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
20:37:29.0485 0x7020  EventSystem - ok
20:37:29.0508 0x7020  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
20:37:29.0565 0x7020  exfat - ok
20:37:29.0588 0x7020  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
20:37:29.0639 0x7020  fastfat - ok
20:37:29.0691 0x7020  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
20:37:29.0759 0x7020  Fax - ok
20:37:29.0769 0x7020  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
20:37:29.0809 0x7020  fdc - ok
20:37:29.0837 0x7020  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
20:37:29.0878 0x7020  fdPHost - ok
20:37:29.0893 0x7020  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
20:37:29.0940 0x7020  FDResPub - ok
20:37:29.0955 0x7020  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
20:37:29.0970 0x7020  FileInfo - ok
20:37:29.0976 0x7020  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
20:37:30.0027 0x7020  Filetrace - ok
20:37:30.0072 0x7020  [ 4E3916FF1534709F8D7D0B882EA696EA, 849CA8AC804E0736DEE9295D41F21D4DD44999E041F346823E6B29E95A04CBCB ] FIXUSTOR        C:\Windows\system32\DRIVERS\fixustor.sys
20:37:30.0124 0x7020  FIXUSTOR - ok
20:37:30.0133 0x7020  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
20:37:30.0158 0x7020  flpydisk - ok
20:37:30.0180 0x7020  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
20:37:30.0200 0x7020  FltMgr - ok
20:37:30.0263 0x7020  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
20:37:30.0340 0x7020  FontCache - ok
20:37:30.0389 0x7020  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:37:30.0406 0x7020  FontCache3.0.0.0 - ok
20:37:30.0418 0x7020  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
20:37:30.0433 0x7020  FsDepends - ok
20:37:30.0464 0x7020  [ 8DE1B4F579F8F8897409856F3BB7A7D2, F6F6B2450951E875C3C236F7798F960FD4433EE6B0C57132CB3D32126BEE34E0 ] fssfltr         C:\Windows\system32\DRIVERS\fssfltr.sys
20:37:30.0481 0x7020  fssfltr - ok
20:37:30.0555 0x7020  [ 7B4C82899A967A7EB22DAB502770AE8E, 209FB59669070FCAAACB24B0CE81C375362BF1C519B15FDB5AA3EC2C87E2069B ] fsssvc          C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe
20:37:30.0603 0x7020  fsssvc - ok
20:37:30.0638 0x7020  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
20:37:30.0654 0x7020  Fs_Rec - ok
20:37:30.0697 0x7020  [ F71005764F9FF3CE6D0CF070708E972B, 470660A9DFE158661383BB7B99DFA20A05F1BFFBF4B0CD43E2DA76E83A441FB7 ] FTDIBUS         C:\Windows\system32\drivers\ftdibus.sys
20:37:30.0711 0x7020  FTDIBUS - ok
20:37:30.0749 0x7020  [ F5801AE9CE5847AA6B270358438A2C12, 0AB9CFB9EF851DA6BB20C63D759DFFB13B4BF696AE3C03C86CCE175670552FA1 ] FTSER2K         C:\Windows\system32\drivers\ftser2k.sys
20:37:30.0761 0x7020  FTSER2K - ok
20:37:30.0794 0x7020  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
20:37:30.0816 0x7020  fvevol - ok
20:37:30.0844 0x7020  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
20:37:30.0875 0x7020  gagp30kx - ok
20:37:30.0914 0x7020  [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:37:30.0925 0x7020  GEARAspiWDM - ok
20:37:31.0039 0x7020  [ 0C52567F023D0F05F4EFC26F607D415B, 168D2AAB2F9CF8DE4A894DE3B2A5C67F1DAD758DBEC95FCFF4D752645BB37C38 ] GfExperienceService C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
20:37:31.0083 0x7020  GfExperienceService - ok
20:37:31.0129 0x7020  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
20:37:31.0197 0x7020  gpsvc - ok
20:37:31.0237 0x7020  [ BA207B48AA3D9D73FD4856400F852458, CFD9058B7F1F7B8C30EA77B18196D39D5B231192A3262017A303A0375514CF7D ] hcmon           C:\Windows\system32\drivers\hcmon.sys
20:37:31.0250 0x7020  hcmon - ok
20:37:31.0277 0x7020  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
20:37:31.0311 0x7020  hcw85cir - ok
20:37:31.0360 0x7020  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:37:31.0402 0x7020  HdAudAddService - ok
20:37:31.0462 0x7020  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
20:37:31.0496 0x7020  HDAudBus - ok
20:37:31.0511 0x7020  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
20:37:31.0547 0x7020  HidBatt - ok
20:37:31.0573 0x7020  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
20:37:31.0607 0x7020  HidBth - ok
20:37:31.0628 0x7020  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
20:37:31.0647 0x7020  HidIr - ok
20:37:31.0674 0x7020  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
20:37:31.0719 0x7020  hidserv - ok
20:37:31.0770 0x7020  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
20:37:31.0791 0x7020  HidUsb - ok
20:37:31.0826 0x7020  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
20:37:31.0876 0x7020  hkmsvc - ok
20:37:31.0898 0x7020  [ CF07C0A9D38A248D036DD9C47E4D0D6E, 6952DA6466DAE2E378F92934E1925887DD122A511BC5D6A0EF2194108E320126 ] hmpalert        C:\Windows\system32\drivers\hmpalert.sys
20:37:31.0913 0x7020  hmpalert - ok
20:37:32.0007 0x7020  [ 2638395F6E61889D75C363A80A0E17F4, D61FD993DA6605F32E6CDAC889285EB67F1A112BB9A294838BB90FCBF5FA11C1 ] hmpalertsvc     C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
20:37:32.0071 0x7020  hmpalertsvc - ok
20:37:32.0101 0x7020  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:37:32.0146 0x7020  HomeGroupListener - ok
20:37:32.0178 0x7020  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:37:32.0214 0x7020  HomeGroupProvider - ok
20:37:32.0325 0x7020  [ 5E1F183B65AD00908819FF3557B3DCBE, A8FD5D9BD253D6428D7A1EED829E42C33C712B727DAABA234D25A4D68CB8C0C5 ] hotcore3        C:\Windows\syswow64\drivers\hotcore3.sys
20:37:32.0340 0x7020  hotcore3 - ok
20:37:32.0370 0x7020  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
20:37:32.0384 0x7020  HpSAMD - ok
20:37:32.0437 0x7020  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
20:37:32.0503 0x7020  HTTP - ok
20:37:32.0536 0x7020  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
20:37:32.0551 0x7020  hwpolicy - ok
20:37:32.0592 0x7020  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
20:37:32.0610 0x7020  i8042prt - ok
20:37:32.0663 0x7020  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
20:37:32.0686 0x7020  iaStorV - ok
20:37:32.0742 0x7020  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:37:32.0778 0x7020  idsvc - ok
20:37:32.0906 0x7020  [ EB1118C371A096FFD4275EB85CB9EC2E, 9A697FFA7874279D26B71F1294858B8F91CB9782E40AB963AA417AFF4FFD3889 ] IDSVia64        C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\IPSDefs\20150210.001\IDSvia64.sys
20:37:32.0933 0x7020  IDSVia64 - ok
20:37:32.0963 0x7020  IEEtwCollectorService - ok
20:37:32.0997 0x7020  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
20:37:33.0011 0x7020  iirsp - ok
20:37:33.0060 0x7020  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
20:37:33.0112 0x7020  IKEEXT - ok
20:37:33.0217 0x7020  [ A0EAB13A78CC5FB960EC76E3D6408DA3, F536B151EB1F284E8F352A7D8C9C0EBBC2E852E5EB6F0F6C6C313F272CE617FE ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
20:37:33.0281 0x7020  IntcAzAudAddService - ok
20:37:33.0305 0x7020  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
20:37:33.0320 0x7020  intelide - ok
20:37:33.0335 0x7020  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
20:37:33.0370 0x7020  intelppm - ok
20:37:33.0395 0x7020  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
20:37:33.0446 0x7020  IPBusEnum - ok
20:37:33.0469 0x7020  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:37:33.0515 0x7020  IpFilterDriver - ok
20:37:33.0565 0x7020  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
20:37:33.0619 0x7020  iphlpsvc - ok
20:37:33.0646 0x7020  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
20:37:33.0670 0x7020  IPMIDRV - ok
20:37:33.0692 0x7020  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
20:37:33.0738 0x7020  IPNAT - ok
20:37:33.0805 0x7020  [ 7FAE5B6CDB18B0B2E81F32869F595022, D873A7EE94749E1700E8F6B8BB7B485AE1B0B83388D63BE06335720498D4794F ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
20:37:33.0831 0x7020  iPod Service - ok
20:37:33.0856 0x7020  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
20:37:33.0907 0x7020  IRENUM - ok
20:37:33.0936 0x7020  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
20:37:33.0959 0x7020  isapnp - ok
20:37:33.0987 0x7020  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
20:37:34.0007 0x7020  iScsiPrt - ok
20:37:34.0034 0x7020  [ 1C368C1A2733DCC5B8E15420AA2B0F6D, C43A3534E33CEAEB8359D493FDB4663CB7C1E9286862B2CEE2788E9EA060DF1D ] JRAID           C:\Windows\system32\DRIVERS\jraid.sys
20:37:34.0047 0x7020  JRAID - ok
20:37:34.0066 0x7020  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
20:37:34.0082 0x7020  kbdclass - ok
20:37:34.0115 0x7020  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
20:37:34.0145 0x7020  kbdhid - ok
20:37:34.0164 0x7020  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso          C:\Windows\system32\lsass.exe
20:37:34.0180 0x7020  KeyIso - ok
20:37:34.0216 0x7020  [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
20:37:34.0250 0x7020  KSecDD - ok
20:37:34.0275 0x7020  [ 41774FF331F609EF442B7398EE6202B1, AD67DA06A74895C384F4A1F1CF47050DAEE9C6CE8AD12F1A116FC977B6C3A864 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
20:37:34.0292 0x7020  KSecPkg - ok
20:37:34.0302 0x7020  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
20:37:34.0364 0x7020  ksthunk - ok
20:37:34.0400 0x7020  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
20:37:34.0457 0x7020  KtmRm - ok
20:37:34.0507 0x7020  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
20:37:34.0554 0x7020  LanmanServer - ok
20:37:34.0583 0x7020  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:37:34.0623 0x7020  LanmanWorkstation - ok
20:37:34.0670 0x7020  [ 71C6A95A5F0CCC87298C4DD0F2C3635A, F8C9DE947A9650F1000EEF783942610FB38F06F4F453E2C7E1383611FDF96F23 ] LightScribeService C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
20:37:34.0689 0x7020  LightScribeService - detected UnsignedFile.Multi.Generic ( 1 )
20:37:37.0408 0x7020  Detect skipped due to KSN trusted
20:37:37.0408 0x7020  LightScribeService - ok
20:37:37.0436 0x7020  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
20:37:37.0479 0x7020  lltdio - ok
20:37:37.0510 0x7020  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
20:37:37.0574 0x7020  lltdsvc - ok
20:37:37.0593 0x7020  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
20:37:37.0637 0x7020  lmhosts - ok
20:37:37.0666 0x7020  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
20:37:37.0682 0x7020  LSI_FC - ok
20:37:37.0708 0x7020  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
20:37:37.0724 0x7020  LSI_SAS - ok
20:37:37.0737 0x7020  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:37:37.0752 0x7020  LSI_SAS2 - ok
20:37:37.0759 0x7020  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:37:37.0776 0x7020  LSI_SCSI - ok
20:37:37.0800 0x7020  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
20:37:37.0849 0x7020  luafv - ok
20:37:37.0879 0x7020  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
20:37:37.0906 0x7020  Mcx2Svc - ok
20:37:37.0917 0x7020  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
20:37:37.0932 0x7020  megasas - ok
20:37:37.0949 0x7020  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
20:37:37.0969 0x7020  MegaSR - ok
20:37:38.0016 0x7020  [ D70476AD02D6FD75282B196D3B58831D, F93565261EC57F43445C082DBCE5CE0D4B121A5C34B818A09AB5B311457588FD ] MEMSWEEP2       C:\Windows\system32\FF9A.tmp
20:37:38.0030 0x7020  MEMSWEEP2 - detected UnsignedFile.Multi.Generic ( 1 )
20:37:40.0668 0x25cc  Object required for P2P: [ 1C368C1A2733DCC5B8E15420AA2B0F6D ] JRAID
20:37:40.0956 0x7020  Detect skipped due to KSN trusted
20:37:40.0956 0x7020  MEMSWEEP2 - ok
20:37:41.0014 0x7020  [ 123271BD5237AB991DC5C21FDF8835EB, 004F8F9228EE291A0E36CE33078D572D61733516F9AA5CFC832AF204C6869E89 ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
20:37:41.0041 0x7020  Microsoft Office Groove Audit Service - ok
20:37:41.0062 0x7020  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
20:37:41.0125 0x7020  MMCSS - ok
20:37:41.0145 0x7020  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
20:37:41.0192 0x7020  Modem - ok
20:37:41.0223 0x7020  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
20:37:41.0257 0x7020  monitor - ok
20:37:41.0283 0x7020  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
20:37:41.0297 0x7020  mouclass - ok
20:37:41.0310 0x7020  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
20:37:41.0336 0x7020  mouhid - ok
20:37:41.0365 0x7020  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
20:37:41.0380 0x7020  mountmgr - ok
20:37:41.0434 0x7020  [ 345477F02C308B7480702767218C86A2, 98AFB5CF35BD82BA44B8F52CBC5FA3760506ADD7892C2AA1A77E8DF71FC8523F ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:37:41.0454 0x7020  MozillaMaintenance - ok
20:37:41.0482 0x7020  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
20:37:41.0500 0x7020  mpio - ok
20:37:41.0522 0x7020  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
20:37:41.0560 0x7020  mpsdrv - ok
20:37:41.0610 0x7020  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
20:37:41.0676 0x7020  MpsSvc - ok
20:37:41.0701 0x7020  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
20:37:41.0727 0x7020  MRxDAV - ok
20:37:41.0756 0x7020  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
20:37:41.0801 0x7020  mrxsmb - ok
20:37:41.0833 0x7020  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:37:41.0872 0x7020  mrxsmb10 - ok
20:37:41.0895 0x7020  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:37:41.0939 0x7020  mrxsmb20 - ok
20:37:41.0964 0x7020  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
20:37:41.0980 0x7020  msahci - ok
20:37:41.0997 0x7020  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
20:37:42.0013 0x7020  msdsm - ok
20:37:42.0048 0x7020  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
20:37:42.0070 0x7020  MSDTC - ok
20:37:42.0104 0x7020  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
20:37:42.0142 0x7020  Msfs - ok
20:37:42.0152 0x7020  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
20:37:42.0206 0x7020  mshidkmdf - ok
20:37:42.0236 0x7020  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
20:37:42.0250 0x7020  msisadrv - ok
20:37:42.0295 0x7020  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
20:37:42.0349 0x7020  MSiSCSI - ok
20:37:42.0352 0x7020  msiserver - ok
20:37:42.0382 0x7020  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
20:37:42.0424 0x7020  MSKSSRV - ok
20:37:42.0435 0x7020  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
20:37:42.0483 0x7020  MSPCLOCK - ok
20:37:42.0499 0x7020  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
20:37:42.0547 0x7020  MSPQM - ok
20:37:42.0579 0x7020  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
20:37:42.0601 0x7020  MsRPC - ok
20:37:42.0630 0x7020  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
20:37:42.0645 0x7020  mssmbios - ok
20:37:42.0650 0x7020  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
20:37:42.0695 0x7020  MSTEE - ok
20:37:42.0705 0x7020  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
20:37:42.0722 0x7020  MTConfig - ok
20:37:42.0734 0x7020  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
20:37:42.0750 0x7020  Mup - ok
20:37:42.0788 0x7020  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
20:37:42.0845 0x7020  napagent - ok
20:37:42.0881 0x7020  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
20:37:42.0918 0x7020  NativeWifiP - ok
20:37:42.0994 0x7020  [ 54F4B358F41C664CBDE4507D67EED1CD, CDCA0A778AF596933CD7CBF1119FCA551ECC03CBBD4F1E8213C3FD2FECA902F2 ] NAVENG          C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\VirusDefs\20150210.038\ENG64.SYS
20:37:43.0009 0x7020  NAVENG - ok
20:37:43.0096 0x7020  [ A74D67EEEB3938FD2FA3B65B24C32C44, 4D780B70B57E23A3A155794C4DEEBD856E32D35B789BDF4673AAC8FC3AC4367B ] NAVEX15         C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\VirusDefs\20150210.038\EX64.SYS
20:37:43.0156 0x7020  NAVEX15 - ok
20:37:43.0222 0x7020  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
20:37:43.0258 0x7020  NDIS - ok
20:37:43.0273 0x7020  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
20:37:43.0312 0x7020  NdisCap - ok
20:37:43.0332 0x7020  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
20:37:43.0369 0x7020  NdisTapi - ok
20:37:43.0398 0x7020  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
20:37:43.0454 0x7020  Ndisuio - ok
20:37:43.0483 0x7020  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
20:37:43.0535 0x7020  NdisWan - ok
20:37:43.0562 0x7020  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
20:37:43.0606 0x7020  NDProxy - ok
20:37:43.0622 0x7020  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
20:37:43.0668 0x7020  NetBIOS - ok
20:37:43.0695 0x7020  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
20:37:43.0745 0x7020  NetBT - ok
20:37:43.0759 0x7020  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon        C:\Windows\system32\lsass.exe
20:37:43.0776 0x7020  Netlogon - ok
20:37:43.0806 0x7020  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
20:37:43.0861 0x7020  Netman - ok
20:37:43.0926 0x7020  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:37:43.0957 0x7020  NetMsmqActivator - ok
20:37:43.0963 0x7020  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:37:43.0985 0x7020  NetPipeActivator - ok
20:37:44.0016 0x7020  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
20:37:44.0067 0x7020  netprofm - ok
20:37:44.0083 0x7020  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:37:44.0101 0x7020  NetTcpActivator - ok
20:37:44.0108 0x7020  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
20:37:44.0127 0x7020  NetTcpPortSharing - ok
20:37:44.0133 0x7020  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
20:37:44.0150 0x7020  nfrd960 - ok
20:37:44.0260 0x7020  [ 9ED6B2F6D9D04FB883F578ABC239EE07, F93F2AFB91AE605D96E83258F2EA20BF08E74FE8C36EEF39650F369071A080AF ] NitroReaderDriverReadSpool3 C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
20:37:44.0280 0x7020  NitroReaderDriverReadSpool3 - ok
20:37:44.0322 0x7020  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
20:37:44.0370 0x7020  NlaSvc - ok
20:37:44.0392 0x7020  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
20:37:44.0428 0x7020  Npfs - ok
20:37:44.0552 0x7020  [ 186BFE4D4B50860021C2B515A845EEEF, A49D214C770040205E88E1C06735B0F3F747099E496957CAC5356ABC00863464 ] NS              C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe
20:37:44.0575 0x7020  NS - ok
20:37:44.0605 0x7020  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
20:37:44.0653 0x7020  nsi - ok
20:37:44.0668 0x7020  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
20:37:44.0717 0x7020  nsiproxy - ok
20:37:44.0792 0x7020  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
20:37:44.0843 0x7020  Ntfs - ok
20:37:44.0879 0x7020  [ A773AA47341A1FD16C6A9BA3C11D7DAA, 55BA057FD11856BEB5F8C31CE3F422B53ABAACE565933B658882635A95231E6E ] ntk_PowerDVD12  G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys
20:37:44.0893 0x7020  ntk_PowerDVD12 - ok
20:37:44.0934 0x7020  [ 189B73C24B70641C0E7ECBB866E0B1E5, 41E1AC3E1AD16866FBA17B8A933C1F9529A29F57ECD0117D053E01433E9C7BBC ] NuidFltr        C:\Windows\system32\DRIVERS\NuidFltr.sys
20:37:44.0948 0x7020  NuidFltr - ok
20:37:44.0958 0x7020  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
20:37:45.0005 0x7020  Null - ok
20:37:45.0009 0x7020  NUS_Bus - ok
20:37:45.0046 0x7020  [ 7E4355930B28C2798D9F09AB9F81151F, 941C730F3B75BDF99639E76350031EDD15F18D8D860F3B1282C28B62096E7717 ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
20:37:45.0063 0x7020  NVHDA - ok
20:37:45.0353 0x7020  [ 7F58A8A5F208557F1FF8D7F45D5811DB, D9999DAD9BBBC907C8633AD08D90E40D861E9941A74CCF3C6183C9E220FEA0E9 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:37:45.0588 0x7020  nvlddmkm - ok
20:37:45.0751 0x7020  [ DDF6920EBE96B0304279834F2EE2193E, F631974EE3659EC01863C2502FD26A45A237A59B9B005E5B1F9F78357CCBB974 ] NvNetworkService C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
20:37:45.0801 0x7020  NvNetworkService - ok
20:37:45.0834 0x7020  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
20:37:45.0851 0x7020  nvraid - ok
20:37:45.0883 0x7020  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
20:37:45.0901 0x7020  nvstor - ok
20:37:45.0970 0x7020  [ 0C4A0D577A6EF1B9D353851668779944, 70E866AD50809CC80F167796C516190918A542F7767A8841948E656F36877AFE ] NvStreamKms     C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
20:37:45.0984 0x7020  NvStreamKms - ok
20:37:46.0572 0x7020  [ BC00A5B3A9F759F7B1DD0A5868C4492F, 23058E56016B836339AACDB0D42E074FB4EF560C27831F6228A455D70585D1EE ] NvStreamSvc     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
20:37:47.0041 0x7020  NvStreamSvc - ok
20:37:47.0150 0x7020  [ 806069C408AE736E2182D2FF6C2FA8EE, 9C2D2309C4F4135772C53C10C7442BCA362657B062177B20C2F00DC2137E8362 ] nvsvc           C:\Windows\system32\nvvsvc.exe
20:37:47.0183 0x7020  nvsvc - ok
20:37:47.0208 0x7020  [ DBFE7B2DF103F74AE51840B3C5F25FE9, 436CAA417FD24BA870F117FA4BABA2AB694825795508BCFCC8C927CC2D5BBC5E ] nvvad_WaveExtensible C:\Windows\system32\drivers\nvvad64v.sys
20:37:47.0220 0x7020  nvvad_WaveExtensible - ok
20:37:47.0259 0x7020  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
20:37:47.0275 0x7020  nv_agp - ok
20:37:47.0373 0x7020  [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:37:47.0393 0x7020  odserv - ok
20:37:47.0416 0x7020  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
20:37:47.0433 0x7020  ohci1394 - ok
20:37:47.0479 0x7020  [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:37:47.0493 0x7020  ose - ok
20:37:47.0522 0x7020  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
20:37:47.0573 0x7020  p2pimsvc - ok
20:37:47.0609 0x7020  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
20:37:47.0652 0x7020  p2psvc - ok
20:37:47.0677 0x7020  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
20:37:47.0705 0x7020  Parport - ok
20:37:47.0734 0x7020  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
20:37:47.0750 0x7020  partmgr - ok
20:37:47.0765 0x7020  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
20:37:47.0790 0x7020  PcaSvc - ok
20:37:47.0818 0x7020  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
20:37:47.0835 0x7020  pci - ok
20:37:47.0867 0x7020  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
20:37:47.0882 0x7020  pciide - ok
20:37:47.0899 0x7020  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
20:37:47.0917 0x7020  pcmcia - ok
20:37:47.0944 0x7020  [ AF7CE12C4F3DC8CB2B07685C916BBCFE, 1AF47113778D411BF3CF82ACF428676908121B1F3252133A5F98E188ED1E9C6C ] pcouffin        C:\Windows\system32\Drivers\pcouffin.sys
20:37:47.0981 0x7020  pcouffin - ok
20:37:47.0993 0x7020  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
20:37:48.0009 0x7020  pcw - ok
20:37:48.0034 0x7020  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
20:37:48.0087 0x7020  PEAUTH - ok
20:37:48.0148 0x7020  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
20:37:48.0221 0x7020  PeerDistSvc - ok
20:37:48.0292 0x7020  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
20:37:48.0320 0x7020  PerfHost - ok
20:37:48.0383 0x7020  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
20:37:48.0465 0x7020  pla - ok
20:37:48.0520 0x7020  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
20:37:48.0574 0x7020  PlugPlay - ok
20:37:48.0583 0x7020  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
20:37:48.0615 0x7020  PNRPAutoReg - ok
20:37:48.0626 0x7020  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
20:37:48.0650 0x7020  PNRPsvc - ok
20:37:48.0683 0x7020  [ 34A8FAE065249F85A67A3215FF5ECB34, 913297755C1046BA004E79660B7DA5BBE5E92B96AAA83D78AE3FF379371950D5 ] Point64         C:\Windows\system32\DRIVERS\point64.sys
20:37:48.0698 0x7020  Point64 - ok
20:37:48.0719 0x7020  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
20:37:48.0776 0x7020  PolicyAgent - ok
20:37:48.0806 0x7020  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
20:37:48.0860 0x7020  Power - ok
20:37:48.0899 0x7020  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
20:37:48.0940 0x7020  PptpMiniport - ok
20:37:48.0956 0x7020  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
20:37:48.0978 0x7020  Processor - ok
20:37:49.0019 0x7020  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
20:37:49.0058 0x7020  ProfSvc - ok
20:37:49.0075 0x7020  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:37:49.0093 0x7020  ProtectedStorage - ok
20:37:49.0119 0x7020  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
20:37:49.0173 0x7020  Psched - ok
20:37:49.0228 0x7020  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
20:37:49.0277 0x7020  ql2300 - ok
20:37:49.0297 0x7020  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
20:37:49.0314 0x7020  ql40xx - ok
20:37:49.0348 0x7020  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
20:37:49.0375 0x7020  QWAVE - ok
20:37:49.0385 0x7020  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
20:37:49.0417 0x7020  QWAVEdrv - ok
20:37:49.0429 0x7020  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
20:37:49.0474 0x7020  RasAcd - ok
20:37:49.0500 0x7020  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
20:37:49.0551 0x7020  RasAgileVpn - ok
20:37:49.0569 0x7020  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
20:37:49.0624 0x7020  RasAuto - ok
20:37:49.0647 0x7020  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
20:37:49.0685 0x7020  Rasl2tp - ok
20:37:49.0721 0x7020  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
20:37:49.0767 0x7020  RasMan - ok
20:37:49.0782 0x7020  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
20:37:49.0832 0x7020  RasPppoe - ok
20:37:49.0853 0x7020  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
20:37:49.0900 0x7020  RasSstp - ok
20:37:49.0933 0x7020  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
20:37:49.0975 0x7020  rdbss - ok
20:37:50.0001 0x7020  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
20:37:50.0019 0x7020  rdpbus - ok
20:37:50.0027 0x7020  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
20:37:50.0079 0x7020  RDPCDD - ok
20:37:50.0105 0x7020  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
20:37:50.0144 0x7020  RDPDR - ok
20:37:50.0164 0x7020  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
20:37:50.0209 0x7020  RDPENCDD - ok
20:37:50.0227 0x7020  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
20:37:50.0271 0x7020  RDPREFMP - ok
20:37:50.0338 0x7020  [ 70CBA1A0C98600A2AA1863479B35CB90, 91A133297921B4955817176251AFC5283DA3C7D2099700C4C92ECC94DBE9A99E ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
20:37:50.0364 0x7020  RdpVideoMiniport - ok
20:37:50.0395 0x7020  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
20:37:50.0432 0x7020  RDPWD - ok
20:37:50.0463 0x7020  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
20:37:50.0482 0x7020  rdyboost - ok
20:37:50.0517 0x7020  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
20:37:50.0578 0x7020  RemoteAccess - ok
20:37:50.0620 0x7020  [ BFA4873CD96D7144DC0059A70E1E358F, 1BA488D5BF4679EC4F0BFEDA9396D9CD0D946794A3F980983540F7E13562BB12 ] RemoteControl-USBLAN C:\Windows\system32\DRIVERS\rcblan.sys
20:37:50.0633 0x7020  RemoteControl-USBLAN - ok
20:37:50.0652 0x7020  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
20:37:50.0704 0x7020  RemoteRegistry - ok
20:37:50.0721 0x7020  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
20:37:50.0761 0x7020  RpcEptMapper - ok
20:37:50.0772 0x7020  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
20:37:50.0790 0x7020  RpcLocator - ok
20:37:50.0831 0x7020  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
20:37:50.0881 0x7020  RpcSs - ok
20:37:50.0907 0x7020  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
20:37:50.0956 0x7020  rspndr - ok
20:37:51.0001 0x7020  [ 1440C0DA81C700BD61142BC569477D81, 7FC01F25C4C18A6C539CDA38FDBF34B2FF02A15FFD1D93A7215E1F48F76FB3BE ] RTCore64        G:\Program Files (x86)\EVGA Precision X\RTCore64.sys
20:37:51.0016 0x7020  RTCore64 - ok
20:37:51.0061 0x7020  [ EE082E06A82FF630351D1E0EBBD3D8D0, 537F1A4108BDA72E8DD271466E7B7FCF39D4D55E4129AB35A409AB7AF2E7D219 ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
20:37:51.0085 0x7020  RTL8167 - ok
20:37:51.0130 0x7020  [ C4DD02A9D97C5531E145F9E4420636F8, FCF033287C2E7713A894B7319A492CB6513C835E90DD29008DEC14CE286F1EC8 ] RTL8169         C:\Windows\system32\DRIVERS\Rtlh64.sys
20:37:51.0149 0x7020  RTL8169 - ok
20:37:51.0174 0x7020  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
20:37:51.0229 0x7020  s3cap - ok
20:37:51.0244 0x7020  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs           C:\Windows\system32\lsass.exe
20:37:51.0260 0x7020  SamSs - ok
20:37:51.0366 0x7020  [ 3DDB778E3E4F7FC9C03D5E50CD41C437, 153C31E06204D0D5FF8CCE90EACB8AF4F09C262354B9F5E08EB66BA61554E67D ] Samsung Network Fax Server C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe
20:37:51.0407 0x7020  Samsung Network Fax Server - ok
20:37:51.0506 0x7020  [ 5EFBBFCC6ADAC121C8E2FE76641ED329, 0EAB16C7F54B61620277977F8C332737081A46BC6BBDE50742B6904BDD54F502 ] SANDRA          G:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\WNt500x64\Sandra.sys
20:37:51.0521 0x7020  SANDRA - ok
20:37:51.0555 0x7020  [ 5FDF2605205C73E05316795DCC6663EC, 674075E7263068AA20D91B4101CDD95F9D1B8FEEA0FC65CB8611EF8C7407E0F0 ] SandraAgentSrv  G:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\RpcAgentSrv.exe
20:37:51.0578 0x7020  SandraAgentSrv - detected UnsignedFile.Multi.Generic ( 1 )
20:37:54.0523 0x7020  Detect skipped due to KSN trusted
20:37:54.0523 0x7020  SandraAgentSrv - ok
20:37:54.0583 0x7020  [ B38103F1B78072D53EC23AC8287A72C2, B502C6AD64DC3D1185086623D32C275CEAF1F50BE22011B2B7F55B7FC0135857 ] SbieDrv         G:\Program Files\Sandboxie\SbieDrv.sys
20:37:54.0604 0x7020  SbieDrv - ok
20:37:54.0647 0x7020  [ 542B3B5219AA6CE3E55B7C70021C0C35, B47E23E647AAD7C88DE7116F11973D3E6B7423A13B4F0709F2A11CC405423E10 ] SbieSvc         G:\Program Files\Sandboxie\SbieSvc.exe
20:37:54.0665 0x7020  SbieSvc - ok
20:37:54.0681 0x7020  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
20:37:54.0697 0x7020  sbp2port - ok
20:37:54.0725 0x7020  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
20:37:54.0776 0x7020  SCardSvr - ok
20:37:54.0802 0x7020  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
20:37:54.0847 0x7020  scfilter - ok
20:37:54.0896 0x7020  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
20:37:54.0967 0x7020  Schedule - ok
20:37:55.0004 0x7020  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
20:37:55.0041 0x7020  SCPolicySvc - ok
20:37:55.0073 0x7020  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
20:37:55.0125 0x7020  SDRSVC - ok
20:37:55.0164 0x7020  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
20:37:55.0215 0x7020  secdrv - ok
20:37:55.0242 0x7020  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
20:37:55.0291 0x7020  seclogon - ok
20:37:55.0307 0x7020  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
20:37:55.0355 0x7020  SENS - ok
20:37:55.0368 0x7020  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
20:37:55.0387 0x7020  SensrSvc - ok
20:37:55.0405 0x7020  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
20:37:55.0420 0x7020  Serenum - ok
20:37:55.0444 0x7020  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
20:37:55.0473 0x7020  Serial - ok
20:37:55.0498 0x7020  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
20:37:55.0528 0x7020  sermouse - ok
20:37:55.0565 0x7020  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
20:37:55.0621 0x7020  SessionEnv - ok
20:37:55.0649 0x7020  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
20:37:55.0677 0x7020  sffdisk - ok
20:37:55.0683 0x7020  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
20:37:55.0715 0x7020  sffp_mmc - ok
20:37:55.0720 0x7020  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
20:37:55.0738 0x7020  sffp_sd - ok
20:37:55.0750 0x7020  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
20:37:55.0767 0x7020  sfloppy - ok
20:37:55.0802 0x7020  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
20:37:55.0862 0x7020  SharedAccess - ok
20:37:55.0897 0x7020  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:37:55.0964 0x7020  ShellHWDetection - ok
20:37:55.0993 0x7020  [ 7799106FEE728B907A86D9C9751E02D5, EE85E8D3CF3819DB28221BFC103DE8DF0E14E1878CECF54E8CD8C161B0E0AF3C ] silabenm        C:\Windows\system32\DRIVERS\silabenm.sys
20:37:56.0034 0x7020  silabenm - ok
20:37:56.0062 0x7020  [ 5779D0AEA7F27CAB93F7E42265F9B7C5, 06FA006C61D08F866BBFF35AE5956A203E33A27C009722C1CFCAE6074EB6BE32 ] silabser        C:\Windows\system32\DRIVERS\silabser.sys
20:37:56.0090 0x7020  silabser - ok
20:37:56.0104 0x7020  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:37:56.0120 0x7020  SiSRaid2 - ok
20:37:56.0135 0x7020  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
20:37:56.0152 0x7020  SiSRaid4 - ok
20:37:56.0175 0x7020  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
20:37:56.0214 0x7020  Smb - ok
20:37:56.0253 0x7020  [ B2C19AE46C5A109679B4FB38058DF05A, 93DD4D356650C51348795653286E6C627FF5F7071F2787DF7C50B75A3120E308 ] snapman         C:\Windows\system32\DRIVERS\snapman.sys
20:37:56.0270 0x7020  snapman - ok
20:37:56.0292 0x7020  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
20:37:56.0322 0x7020  SNMPTRAP - ok
20:37:56.0350 0x7020  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
20:37:56.0365 0x7020  spldr - ok
20:37:56.0403 0x7020  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
20:37:56.0462 0x7020  Spooler - ok
20:37:56.0793 0x7020  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
20:37:56.0931 0x7020  sppsvc - ok
20:37:56.0953 0x7020  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
20:37:57.0014 0x7020  sppuinotify - ok
20:37:57.0117 0x7020  [ 7F242B9CA9297A427E73C7D819DA2F73, 6516EC73685F7B1107DD7E664BAFA099828102965AF917D7E179CDC94681D7C5 ] SRTSP           C:\Windows\system32\drivers\NSx64\1601000.009\SRTSP64.SYS
20:37:57.0154 0x7020  SRTSP - ok
20:37:57.0176 0x7020  [ 896088EAE00305E6BA9B081114B23DAE, 71D9A6113F1950B005009AAC374211CB218771A01AF9256A21420C1345C47F2F ] SRTSPX          C:\Windows\system32\drivers\NSx64\1601000.009\SRTSPX64.SYS
20:37:57.0189 0x7020  SRTSPX - ok
20:37:57.0227 0x7020  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
20:37:57.0280 0x7020  srv - ok
20:37:57.0304 0x7020  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
20:37:57.0329 0x7020  srv2 - ok
20:37:57.0345 0x7020  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
20:37:57.0373 0x7020  srvnet - ok
20:37:57.0381 0x7020  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
20:37:57.0436 0x7020  SSDPSRV - ok
20:37:57.0474 0x7020  [ 0211AB46B73A2623B86C1CFCB30579AB, 7CC9BA2DF7B9EA6BB17EE342898EDD7F54703B93B6DED6A819E83A7EE9F938B4 ] SSPORT          C:\Windows\system32\Drivers\SSPORT.sys
20:37:57.0488 0x7020  SSPORT - ok
20:37:57.0501 0x7020  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
20:37:57.0547 0x7020  SstpSvc - ok
20:37:57.0643 0x7020  [ 3BF022F8064A83A23DF90971DD78CA83, 85754DF1C6DE745ADF9A0BAB1948AFF2CA16C4569128DA90AF610D199E621BF4 ] StarMoney 9.0 OnlineUpdate G:\Program Files (x86)\StarMoney9.0\ouservice\StarMoneyOnlineUpdate.exe
20:37:57.0673 0x7020  StarMoney 9.0 OnlineUpdate - ok
20:37:57.0764 0x7020  [ 8330F6741D4D8691B58663EBD831F8D7, 42452A69CD2EA7CCD50A7F0ACFB804AA7CC7F38F47111CB57EEB8E8EA07A4D73 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
20:37:57.0786 0x7020  Stereo Service - ok
20:37:57.0799 0x7020  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
20:37:57.0814 0x7020  stexstor - ok
20:37:57.0854 0x7020  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
20:37:57.0892 0x7020  stisvc - ok
20:37:57.0916 0x7020  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
20:37:57.0932 0x7020  storflt - ok
20:37:57.0969 0x7020  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
20:37:57.0985 0x7020  storvsc - ok
20:37:58.0011 0x7020  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
20:37:58.0042 0x7020  swenum - ok
20:37:58.0081 0x7020  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
20:37:58.0138 0x7020  swprv - ok
20:37:58.0174 0x7020  [ 3E10ECB0188163B935273D5F8370FD04, 85F39A08A27C7A2E2CB5C1014A8172F935CB1B7E21FF8B30E7334E8DA3A32323 ] SymDS           C:\Windows\system32\drivers\NSx64\1601000.009\SYMDS64.SYS
         

TDSS (Teil2):

20:37:58.0197 0x7020  SymDS - ok
20:37:58.0253 0x7020  [ 642A53193D4767B3B6356E809A20EC7C, 1899A1016E235D6B09232FF0C09DB0E5695B7365AC0F24B1528B155F8771A247 ] SymEFA          C:\Windows\system32\drivers\NSx64\1601000.009\SYMEFA64.SYS
20:37:58.0291 0x7020  SymEFA - ok
20:37:58.0331 0x7020  [ 37DA6EC1E8C88C7D859989E668863712, 4236C405E907AFA5A303BCD9F385AB0C6419B250CBB5518C175CF01850576D1D ] SymEvent        C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
20:37:58.0346 0x7020  SymEvent - ok
20:37:58.0382 0x7020  [ 7828EABA7736518FAC675F36134B2EDB, 0AB47A8D9F2B3730AC2C9D1C80BFAF510A76E5962E35C2115EEDCEA26A0964BD ] SymIRON         C:\Windows\system32\drivers\NSx64\1601000.009\Ironx64.SYS
20:37:58.0399 0x7020  SymIRON - ok
20:37:58.0476 0x7020  [ 52C0A3DDFE46CB238C74B136D522DEA3, 6478FD2BB21A738455DF3EB45106E5BF41337E7BDBE4E44BD5354C7DCF60F324 ] SymNetS         C:\Windows\system32\drivers\NSx64\1601000.009\SYMNETS.SYS
20:37:58.0503 0x7020  SymNetS - ok
20:37:58.0593 0x7020  [ 06DC2FDC6282F0D68910417B1150C848, 078994CD312D3C8D7D94B173551D5AF613E947763E1515DCC568D55DEF2D35D3 ] SyncThru Admin 6 G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe
20:37:58.0616 0x7020  SyncThru Admin 6 - detected UnsignedFile.Multi.Generic ( 1 )
20:38:00.0671 0x25cc  Object send P2P result: false
20:38:01.0370 0x7020  Detect skipped due to KSN trusted
20:38:01.0370 0x7020  SyncThru Admin 6 - ok
20:38:01.0437 0x7020  [ D2E7B80F1168F2BFE0ABD3EDBB0996BF, 3DEA9A217A2F03BCC103382C22A11EFC5C945D4121B605A75CEA48BE93D3358B ] SynoDrService   G:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe
20:38:01.0454 0x7020  SynoDrService - detected UnsignedFile.Multi.Generic ( 1 )
20:38:04.0608 0x7020  Detect skipped due to KSN trusted
20:38:04.0611 0x7020  SynoDrService - ok
20:38:04.0635 0x7020  Synth3dVsc - ok
20:38:04.0706 0x7020  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
20:38:04.0771 0x7020  SysMain - ok
20:38:04.0801 0x7020  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:38:04.0836 0x7020  TabletInputService - ok
20:38:04.0859 0x7020  [ 8502BFC9C990567E4049358EC063D621, C7A690A31C996D8E2EF76A1049CC2978E944ED0FD15EBAD6E1FC810F25F0E503 ] tap0801         C:\Windows\system32\DRIVERS\tap0801.sys
20:38:04.0866 0x7020  tap0801 - detected UnsignedFile.Multi.Generic ( 1 )
20:38:07.0579 0x7020  Detect skipped due to KSN trusted
20:38:07.0579 0x7020  tap0801 - ok
20:38:07.0607 0x7020  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
20:38:07.0661 0x7020  TapiSrv - ok
20:38:07.0690 0x7020  [ 927D0CDB3F96EFC1E98FB1A2C9FB67AD, 58F14DAA0EA21EA2F2A1D3D62C88BD8E5A0E0EF498B7B8D367BEEADE6A46843C ] tapoas          C:\Windows\system32\DRIVERS\tapoas.sys
20:38:07.0713 0x7020  tapoas - ok
20:38:07.0723 0x7020  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
20:38:07.0763 0x7020  TBS - ok
20:38:07.0839 0x7020  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
20:38:07.0898 0x7020  Tcpip - ok
20:38:07.0948 0x7020  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
20:38:08.0005 0x7020  TCPIP6 - ok
20:38:08.0037 0x7020  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
20:38:08.0065 0x7020  tcpipreg - ok
20:38:08.0094 0x7020  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
20:38:08.0141 0x7020  TDPIPE - ok
20:38:08.0199 0x7020  [ 99527D49EE0A96FC25537C61B270A372, 519E23F86EC86349F92C4A88DBD19C097AEE0A6E152776B32B45D293ED14946B ] tdrpman273      C:\Windows\system32\DRIVERS\tdrpm273.sys
20:38:08.0240 0x7020  tdrpman273 - ok
20:38:08.0264 0x7020  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
20:38:08.0288 0x7020  TDTCP - ok
20:38:08.0331 0x7020  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
20:38:08.0375 0x7020  tdx - ok
20:38:08.0392 0x7020  [ F5520DBB47C60EE83024B38720ABDA24, B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0 ] teamviewervpn   C:\Windows\system32\DRIVERS\teamviewervpn.sys
20:38:08.0404 0x7020  teamviewervpn - ok
20:38:08.0425 0x7020  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
20:38:08.0440 0x7020  TermDD - ok
20:38:08.0485 0x7020  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
20:38:08.0530 0x7020  TermService - ok
20:38:08.0562 0x7020  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
20:38:08.0592 0x7020  Themes - ok
20:38:08.0616 0x7020  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
20:38:08.0654 0x7020  THREADORDER - ok
20:38:08.0683 0x7020  [ 156EF5E1164BBA862EEE84400C7BA034, 60543C57A8C8E90FEE514899417520B0A24E73A0230527A4D7AFE9675D8D54E2 ] tifsfilter      C:\Windows\system32\DRIVERS\tifsfilt.sys
20:38:08.0697 0x7020  tifsfilter - ok
20:38:08.0729 0x7020  [ EBBAEA02F0095A798000C7E06B16D41B, CBEAC6CBF0F8D5B72ACCBADA6BD1DF1EB31F84B0D973DA955337991D4DBBDF7E ] timounter       C:\Windows\system32\DRIVERS\timntr.sys
20:38:08.0763 0x7020  timounter - ok
20:38:08.0780 0x7020  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
20:38:08.0827 0x7020  TrkWks - ok
20:38:08.0871 0x7020  [ 8DE922CD4FEA6F83B10805DF965B9A08, AD6BBBA1D6FD8D717CC2CC4BB9FCCF2AF14BB12E76E51BB8A5BA1642E143D324 ] truecrypt       C:\Windows\system32\drivers\truecrypt.sys
20:38:08.0890 0x7020  truecrypt - ok
20:38:08.0951 0x7020  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:38:09.0007 0x7020  TrustedInstaller - ok
20:38:09.0033 0x7020  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
20:38:09.0059 0x7020  tssecsrv - ok
20:38:09.0096 0x7020  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
20:38:09.0137 0x7020  TsUsbFlt - ok
20:38:09.0141 0x7020  tsusbhub - ok
20:38:09.0187 0x7020  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
20:38:09.0245 0x7020  tunnel - ok
20:38:09.0263 0x7020  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
20:38:09.0280 0x7020  uagp35 - ok
20:38:09.0318 0x7020  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
20:38:09.0369 0x7020  udfs - ok
20:38:09.0438 0x7020  [ 215462AE7E6A897D675E84DD1E3B3B56, 7F45E77F971E9AC3E1402663EF5F6A2D496F9BB758C8E50D2D329E834E20B7D8 ] ufad-ws60       G:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe
20:38:09.0454 0x7020  ufad-ws60 - ok
20:38:09.0491 0x7020  [ 0FB030C397E97811CA141355541C8F41, 956E4C6ECE7330AF791B6DC13B79D546EBF8C7EB8127EFE1578B6C480EADE4E8 ] UGURU           C:\Windows\system32\drivers\uGuru.sys
20:38:09.0502 0x7020  UGURU - ok
20:38:09.0515 0x7020  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
20:38:09.0546 0x7020  UI0Detect - ok
20:38:09.0577 0x7020  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
20:38:09.0591 0x7020  uliagpkx - ok
20:38:09.0647 0x7020  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
20:38:09.0665 0x7020  umbus - ok
20:38:09.0681 0x7020  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
20:38:09.0720 0x7020  UmPass - ok
20:38:09.0751 0x7020  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
20:38:09.0786 0x7020  UmRdpService - ok
20:38:09.0832 0x7020  [ 9DC07E73A4ABB9ACF692113B36A5009F, CA7176FC219515D58DCFA66EC61880ECE5617275C9B83701BB74D8B60E733D34 ] UnlockerDriver5 G:\Program Files\Unlocker\UnlockerDriver5.sys
20:38:09.0843 0x7020  UnlockerDriver5 - ok
20:38:09.0875 0x7020  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
20:38:09.0936 0x7020  upnphost - ok
20:38:09.0968 0x7020  [ 5C3BE22E485B9BF11FCEFDC676C728D0, F55061066ECF6920D56518A677BB538C18B7F1BB150ED6DB3591408F44E8D53A ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys
20:38:10.0016 0x7020  USBAAPL64 - ok
20:38:10.0045 0x7020  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
20:38:10.0069 0x7020  usbaudio - ok
20:38:10.0101 0x7020  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
20:38:10.0143 0x7020  usbccgp - ok
20:38:10.0170 0x7020  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
20:38:10.0205 0x7020  usbcir - ok
20:38:10.0226 0x7020  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
20:38:10.0254 0x7020  usbehci - ok
20:38:10.0290 0x7020  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
20:38:10.0314 0x7020  usbhub - ok
20:38:10.0329 0x7020  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
20:38:10.0354 0x7020  usbohci - ok
20:38:10.0375 0x7020  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
20:38:10.0407 0x7020  usbprint - ok
20:38:10.0441 0x7020  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\Windows\system32\drivers\usbscan.sys
20:38:10.0474 0x7020  usbscan - ok
20:38:10.0505 0x7020  [ B57B4F0BEC4270A281B9F8537EB2FA04, 554273482EE85F010DC62E412C9933E65BD63AA09911BD25D86F86D2618EF382 ] usbser64        C:\Windows\system32\DRIVERS\usbser.sys
20:38:10.0541 0x7020  usbser64 - ok
20:38:10.0572 0x7020  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:38:10.0597 0x7020  USBSTOR - ok
20:38:10.0622 0x7020  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
20:38:10.0637 0x7020  usbuhci - ok
20:38:10.0664 0x7020  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
20:38:10.0691 0x7020  usbvideo - ok
20:38:10.0800 0x7020  [ DC21A408DC2B8DA41FFC1AE6C015E748, 3B8FE0936EE5D19B4724786E41EB8A80F63CF65B06152879E689B37DE06CBBED ] uvnc_service    G:\Program Files\UltraVNC\WinVNC.exe
20:38:10.0866 0x7020  uvnc_service - ok
20:38:10.0889 0x7020  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
20:38:10.0942 0x7020  UxSms - ok
20:38:10.0947 0x7020  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc        C:\Windows\system32\lsass.exe
20:38:10.0964 0x7020  VaultSvc - ok
20:38:11.0008 0x7020  [ FD911873C0BB6945FA38C16E9A2B58F9, EF8C833321449A6E8B671890F2EBC82ABC276B890D274AADDB626D763EE98964 ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
20:38:11.0042 0x7020  VClone - ok
20:38:11.0068 0x7020  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
20:38:11.0083 0x7020  vdrvroot - ok
20:38:11.0138 0x7020  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
20:38:11.0211 0x7020  vds - ok
20:38:11.0225 0x7020  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
20:38:11.0256 0x7020  vga - ok
20:38:11.0269 0x7020  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
20:38:11.0307 0x7020  VgaSave - ok
20:38:11.0314 0x7020  VGPU - ok
20:38:11.0347 0x7020  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
20:38:11.0368 0x7020  vhdmp - ok
20:38:11.0396 0x7020  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
20:38:11.0411 0x7020  viaide - ok
20:38:11.0486 0x7020  [ 42F0ECAF36636841A4A006850695507F, 48DAD57BCD60C0B26460E0BCAABC1B2C9B992E4F8D6D1E3F8467883FD40C2C98 ] VMAuthdService  G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
20:38:11.0500 0x7020  VMAuthdService - ok
20:38:11.0541 0x7020  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
20:38:11.0560 0x7020  vmbus - ok
20:38:11.0583 0x7020  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
20:38:11.0622 0x7020  VMBusHID - ok
20:38:11.0647 0x7020  [ 3D810A11C3E7FD4682A8824F54C1A04F, EC9CE1643C33152CD46A7C3D69131372F1EE6A9FAD7FE2B38BDF8D12DB6C7601 ] vmci            C:\Windows\system32\drivers\vmci.sys
20:38:11.0660 0x7020  vmci - ok
20:38:11.0732 0x7020  [ 1AF6462718E5AB0ED55014A6EF3790EF, 2852A48EF9CC9F0D8F5CE6320297A390DF59E8FF1BC966D59AE975D5F494EF2A ] vmkbd           C:\Windows\system32\drivers\VMkbd.sys
20:38:11.0744 0x7020  vmkbd - ok
20:38:11.0750 0x7020  [ 9D54F1339E78C95BF3D9939EBCB66378, 99E29225443049B35E633BB7E709AC89B555F6A1EC5FAE075825A74F088FDC9A ] VMnetAdapter    C:\Windows\system32\DRIVERS\vmnetadapter.sys
20:38:11.0761 0x7020  VMnetAdapter - ok
20:38:11.0785 0x7020  [ FB54EF3AA613D2832FD3812E7CB2FC75, 2D638EFE2E457C4F9B50AF49C7A0B0DA82A98FF10049C2E5DABE32B7E0BA2B23 ] VMnetBridge     C:\Windows\system32\DRIVERS\vmnetbridge.sys
20:38:11.0796 0x7020  VMnetBridge - ok
20:38:11.0800 0x7020  VMnetDHCP - ok
20:38:11.0812 0x7020  [ DAF5E04EB56CD0ED945FB2FDD94812DB, 7F7B2768E0CEBF7CAFEAA1A13986895B5AA530401ACD70E75A4D0BFF56FD3709 ] VMnetuserif     C:\Windows\system32\drivers\vmnetuserif.sys
20:38:11.0824 0x7020  VMnetuserif - ok
20:38:11.0873 0x7020  [ F22098DBDD13C1221C274496B3E18DA7, E15922A001136978C01D7E31EC02452D80FC6943F39D24B80AF7CB60D965CDE2 ] VMUSBArbService C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
20:38:11.0895 0x7020  VMUSBArbService - ok
20:38:11.0903 0x7020  VMware NAT Service - ok
20:38:11.0935 0x7020  [ AE7F667DB83E108E83C86A56B821E9A6, A74DAE88AF0BD04DA8325D01D3A7D535FBB3A971CB642D724DFE5FAAAF819977 ] vmx86           C:\Windows\system32\drivers\vmx86.sys
20:38:11.0948 0x7020  vmx86 - ok
20:38:11.0979 0x7020  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
20:38:11.0996 0x7020  volmgr - ok
20:38:12.0055 0x7020  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
20:38:12.0079 0x7020  volmgrx - ok
20:38:12.0100 0x7020  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
20:38:12.0122 0x7020  volsnap - ok
20:38:12.0147 0x7020  [ B4A73CA4EF9A02B9738CEA9AD5FE5917, B6A8086189FE2F1C3FE5B3F484FBA3DB2E5E1836F3154D30090F136C27D16166 ] vpcbus          C:\Windows\system32\DRIVERS\vpchbus.sys
20:38:12.0165 0x7020  vpcbus - ok
20:38:12.0198 0x7020  [ E675FB2B48C54F09895482E2253B289C, 68BBFBF2356C849722E429CA753CC309A3CCE8CF00EBDBBD2695ECD292324DF2 ] vpcnfltr        C:\Windows\system32\DRIVERS\vpcnfltr.sys
20:38:12.0241 0x7020  vpcnfltr - ok
20:38:12.0254 0x7020  [ 5FB42082B0D19A0268705F1DD343DF20, 62F8EEE6A507CE6A8BD638020118D71B78332F79BA82654AB702AE46B04767D9 ] vpcusb          C:\Windows\system32\DRIVERS\vpcusb.sys
20:38:12.0281 0x7020  vpcusb - ok
20:38:12.0329 0x7020  [ 207B6539799CC1C112661A9B620DD233, 6B915CC7F77C867516D94865D7BF2E5C815402EF0A4488C3EB2FEF7CFA6C98F6 ] vpcvmm          C:\Windows\system32\drivers\vpcvmm.sys
20:38:12.0351 0x7020  vpcvmm - ok
20:38:12.0374 0x7020  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
20:38:12.0392 0x7020  vsmraid - ok
20:38:12.0458 0x7020  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
20:38:12.0550 0x7020  VSS - ok
20:38:12.0596 0x7020  [ E61C910E2DDF4797C1B1F9239636E894, BEC555AB66BD0D33BBC9ABFF7F3955F7D0821383549C8BAC1944B63A85F897E8 ] vstor2-ws60     G:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys
20:38:12.0610 0x7020  vstor2-ws60 - ok
20:38:12.0632 0x7020  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
20:38:12.0654 0x7020  vwifibus - ok
20:38:12.0713 0x7020  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
20:38:12.0774 0x7020  W32Time - ok
20:38:12.0799 0x7020  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
20:38:12.0829 0x7020  WacomPen - ok
20:38:12.0871 0x7020  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
20:38:12.0909 0x7020  WANARP - ok
20:38:12.0913 0x7020  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
20:38:12.0950 0x7020  Wanarpv6 - ok
20:38:13.0037 0x7020  [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
20:38:13.0081 0x7020  WatAdminSvc - ok
20:38:13.0133 0x7020  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
20:38:13.0208 0x7020  wbengine - ok
20:38:13.0231 0x7020  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
20:38:13.0271 0x7020  WbioSrvc - ok
20:38:13.0312 0x7020  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
20:38:13.0355 0x7020  wcncsvc - ok
20:38:13.0372 0x7020  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:38:13.0414 0x7020  WcsPlugInService - ok
20:38:13.0428 0x7020  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
20:38:13.0444 0x7020  Wd - ok
20:38:13.0531 0x7020  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
20:38:13.0573 0x7020  Wdf01000 - ok
20:38:13.0626 0x7020  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
20:38:13.0910 0x7020  WdiServiceHost - ok
20:38:13.0916 0x7020  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
20:38:13.0944 0x7020  WdiSystemHost - ok
20:38:13.0984 0x7020  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
20:38:14.0025 0x7020  WebClient - ok
20:38:14.0086 0x7020  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
20:38:14.0149 0x7020  Wecsvc - ok
20:38:14.0188 0x7020  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
20:38:14.0251 0x7020  wercplsupport - ok
20:38:14.0315 0x7020  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
20:38:14.0375 0x7020  WerSvc - ok
20:38:14.0417 0x7020  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
20:38:14.0470 0x7020  WfpLwf - ok
20:38:14.0486 0x7020  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
20:38:14.0500 0x7020  WIMMount - ok
20:38:14.0521 0x7020  WinDefend - ok
20:38:14.0549 0x7020  WinHttpAutoProxySvc - ok
20:38:14.0620 0x7020  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
20:38:14.0676 0x7020  Winmgmt - ok
20:38:14.0761 0x7020  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll
20:38:14.0863 0x7020  WinRM - ok
20:38:14.0910 0x7020  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
20:38:14.0932 0x7020  WinUsb - ok
20:38:14.0990 0x7020  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
20:38:15.0034 0x7020  Wlansvc - ok
20:38:15.0208 0x7020  [ 357CABBF155AFD1D3926E62539D2A3A7, C43CFF84E7D930B4999DC061AB0766B57AAD7540B3E6EE54605B10ECE90825F5 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:38:15.0277 0x7020  wlidsvc - ok
20:38:15.0304 0x7020  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
20:38:15.0333 0x7020  WmiAcpi - ok
20:38:15.0353 0x7020  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
20:38:15.0385 0x7020  wmiApSrv - ok
20:38:15.0410 0x7020  WMPNetworkSvc - ok
20:38:15.0423 0x7020  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
20:38:15.0464 0x7020  WPCSvc - ok
20:38:15.0495 0x7020  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
20:38:15.0527 0x7020  WPDBusEnum - ok
20:38:15.0551 0x7020  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
20:38:15.0598 0x7020  ws2ifsl - ok
20:38:15.0617 0x7020  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
20:38:15.0641 0x7020  wscsvc - ok
20:38:15.0671 0x7020  [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
20:38:15.0712 0x7020  WSDPrintDevice - ok
20:38:15.0729 0x7020  [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan         C:\Windows\system32\DRIVERS\WSDScan.sys
20:38:15.0752 0x7020  WSDScan - ok
20:38:15.0757 0x7020  WSearch - ok
20:38:15.0851 0x7020  [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv        C:\Windows\system32\wuaueng.dll
20:38:15.0922 0x7020  wuauserv - ok
20:38:15.0958 0x7020  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
20:38:16.0006 0x7020  WudfPf - ok
20:38:16.0032 0x7020  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
20:38:16.0060 0x7020  WUDFRd - ok
20:38:16.0090 0x7020  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
20:38:16.0123 0x7020  wudfsvc - ok
20:38:16.0155 0x7020  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
20:38:16.0182 0x7020  WwanSvc - ok
20:38:16.0284 0x7020  [ 6F610F00DC6B4489811EDCBC76D3EBA6, 172DDA80D3400A292E6F5B94FDC1BC2F5EBF4C01BD050C86B57065114B9B0AA6 ] {73526619-C24F-470B-9BED-53D455FBB5C6} G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\NavFilter\000.fcl
20:38:16.0301 0x7020  {73526619-C24F-470B-9BED-53D455FBB5C6} - ok
20:38:16.0328 0x7020  ================ Scan global ===============================
20:38:16.0359 0x7020  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
20:38:16.0389 0x7020  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
20:38:16.0403 0x7020  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
20:38:16.0433 0x7020  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
20:38:16.0469 0x7020  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
20:38:16.0478 0x7020  [ Global ] - ok
20:38:16.0478 0x7020  ================ Scan MBR ==================================
20:38:16.0487 0x7020  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
20:38:17.0057 0x7020  \Device\Harddisk1\DR1 - ok
20:38:17.0062 0x7020  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
20:38:17.0301 0x7020  \Device\Harddisk0\DR0 - ok
20:38:17.0302 0x7020  ================ Scan VBR ==================================
20:38:17.0305 0x7020  [ B375EC49ED692C9C8B90E03651D23467 ] \Device\Harddisk1\DR1\Partition1
20:38:17.0350 0x7020  \Device\Harddisk1\DR1\Partition1 - ok
20:38:17.0353 0x7020  [ 6B0969735A0FFE88D73454AF5811AB4F ] \Device\Harddisk1\DR1\Partition2
20:38:17.0355 0x7020  \Device\Harddisk1\DR1\Partition2 - ok
20:38:17.0358 0x7020  [ 4B8401E94946CFEA09CB8F63E7AA0C80 ] \Device\Harddisk1\DR1\Partition3
20:38:17.0360 0x7020  \Device\Harddisk1\DR1\Partition3 - ok
20:38:17.0363 0x7020  [ 108BA98D8CAEED614A74C5A762F5E98B ] \Device\Harddisk0\DR0\Partition1
20:38:17.0420 0x7020  \Device\Harddisk0\DR0\Partition1 - ok
20:38:17.0423 0x7020  [ 0F219C7B5D8780388EE5568940D7B9F3 ] \Device\Harddisk0\DR0\Partition2
20:38:17.0443 0x7020  \Device\Harddisk0\DR0\Partition2 - ok
20:38:17.0446 0x7020  [ B52BB318A2580BF946937C734C18B4EE ] \Device\Harddisk0\DR0\Partition3
20:38:17.0447 0x7020  \Device\Harddisk0\DR0\Partition3 - ok
20:38:17.0448 0x7020  ================ Scan generic autorun ======================
20:38:17.0522 0x7020  [ 0F498556C6BC1EF32D3FE163B6DB8DF9, 2E63AC954E0E2E691DE3C3897ADE013D5B2BC3D7806BC699D87CF513B6B8A79C ] C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
20:38:17.0540 0x7020  Acronis Scheduler2 Service - ok
20:38:17.0627 0x7020  [ 07FB459A6ECA8D67F13C354F2BE02462, FE9C9F4C13C288BB5A13E6081C6505415B6FB121464C028F2CCE980E045115BB ] C:\Windows\SysWOW64\UMonit.exe
20:38:17.0649 0x7020  UMonit - detected UnsignedFile.Multi.Generic ( 1 )
20:38:20.0602 0x7020  Detect skipped due to KSN trusted
20:38:20.0602 0x7020  UMonit - ok
20:38:20.0898 0x7020  [ 73E7DAFAA77FC23F8139F87BA96D7FC5, 6C6A1D81A87D475819901E213753E84DE0E5C5AB37DE5FF200A0C753015E091B ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
20:38:21.0126 0x7020  RtHDVCpl - ok
20:38:21.0166 0x7020  [ B1964E8776FD7633F149788F5B2A71CB, E30AC137B9DC2D3456499E0BB3B1955D2E0F7FFDB11E7A290A9DA25C76F4FAF8 ] C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
20:38:21.0185 0x7020  CDAServer - ok
20:38:21.0209 0x7020  [ DD81D91FF3B0763C392422865C9AC12E, F5691B8F200E3196E6808E932630E862F8F26F31CD949981373F23C9D87DB8B9 ] C:\Windows\system32\rundll32.exe
20:38:21.0240 0x7020  ShadowPlay - ok
20:38:21.0350 0x7020  [ 7304E21B92E538E2CC793EDF478AC034, 39992D4541E100E5D8199B2FB5B7C7DD7213F8BC84AEA1924C6EC46E8711BF28 ] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
20:38:21.0424 0x7020  NvBackend - ok
20:38:21.0475 0x7020  [ DB4E2D9C09A5762CB2551222B5E443B2, 318AD09D1821E38B7D7ACC0A06965057B494A752C9E34FD1CA41247DC703F985 ] C:\Windows\RaidTool\xInsIDE.exe
20:38:21.0480 0x7020  JMB36X IDE Setup - detected UnsignedFile.Multi.Generic ( 1 )
20:38:24.0211 0x7020  Detect skipped due to KSN trusted
20:38:24.0211 0x7020  JMB36X IDE Setup - ok
20:38:24.0400 0x7020  [ 01605C995B9F6D948370B9FFE451DF7F, D2F29BB3C3CBEDA92E512423F640959277F8C5C8B0F75EE11B2E6BFD706516DB ] G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
20:38:24.0524 0x7020  TrueImageMonitor.exe - ok
20:38:24.0603 0x7020  [ 0E34B7BB1FCF22BCC1E394D16F9E992B, 382CA8E6BAC301E2F277F8EDA03D263FF71272796A8EED582C36294EEE9191F9 ] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe
20:38:24.0619 0x7020  GrooveMonitor - ok
20:38:24.0789 0x7020  [ 1D5866CC12F3183BC287EB7853EE4A62, 45CCFC897044F9CCAECEDEDB0BA2F9DB8FE01F93A95955A1C6737744FC1DAED8 ] G:\Program Files (x86)\BOINC\boincmgr.exe
20:38:24.0901 0x7020  boincmgr - ok
20:38:24.0931 0x7020  [ BE49CD7A9FF81D2AFBCF5520317A9A88, BD9CE865A759C3F8DD9C5440825D3D9B56DA5D5DA4A16CE2F663CB1DAD8F371B ] G:\Program Files (x86)\BOINC\boinctray.exe
20:38:24.0943 0x7020  boinctray - ok
20:38:24.0970 0x7020  [ 9D56299FA5C9B3D9E67FF3ACB301139F, 202A0542BEA33C5F78A406EF9479EB7BD42FCBEAC9F49F38F6ECC48554117811 ] G:\Program Files (x86)\lg_fwupdate\lgfw.exe
20:38:24.0982 0x7020  LGODDFU - ok
20:38:24.0997 0x7020  [ 4C06A4210D028192A88F41013A72163B, 622B631CE0B98F199668670C586A972EE808016DB79ACF67C31BBCB1F157C03D ] G:\Program Files (x86)\VMware\VMware Player\hqtray.exe
20:38:25.0009 0x7020  VMware hqtray - ok
20:38:25.0059 0x7020  [ 09E60B4FE341A94A300830C008907099, 5F07868953FAA8FFA9E6477F6BAC52DEEDF3EA4A3F8AF5B4E15878D8240223AB ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
20:38:25.0075 0x7020  APSDaemon - ok
20:38:25.0126 0x7020  [ 99ED63F28119F7FA7363413CDE52FD3C, 4DA3DB18CA208C38E8A609A160C565468B3D6F62A7B47EDBC81F9BD92DED26EF ] G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
20:38:25.0150 0x7020  PowerDVD12DMREngine - ok
20:38:25.0178 0x7020  [ CB68255C007A74B9747D53F960970466, 299882CC6D319C0F59F1EC03FE1A8FC1E209FE1E393441D4056D2B454F73E233 ] G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe
20:38:25.0197 0x7020  PowerDVD12Agent - ok
20:38:25.0219 0x7020  [ 2A21FE60A9BC5247BD8C57409A2B97F8, 6C9851684FB90AB6038A326F4B362C1948DF2173063CA198DCEAEA6BFAC636E0 ] G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
20:38:25.0235 0x7020  VirtualCloneDrive - ok
20:38:25.0347 0x7020  [ 33E7824BD9A4D774E0D161FFDD6FF9AA, 18E556163E1C33C8D097E5D0BEE8BD94254566CAA9C67EBE08770DEE27D1DAA5 ] G:\Program Files (x86)\Nuance\OmniPage18\OmniPage18.exe
20:38:25.0436 0x7020  OmniPage Preload - ok
20:38:25.0467 0x7020  [ 49A2682E0033D20FE9BB4563B84AF7BE, A510945FDA3B476CE51F6BDAFE1BC3FD35FCCA698A30AEF4AA63F5D0DCE2765D ] G:\Program Files (x86)\Nuance\OmniPage18\Ereg\Ereg.exe
20:38:25.0485 0x7020  Nuance OmniPage 18-reminder - ok
20:38:25.0586 0x7020  [ 68B741770130B3621CAC647C06A6606E, 4D7A4DAC7C8638E10EF93563E526DE6023B092B8882FEBD6FE254711570D257C ] G:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
20:38:25.0659 0x7020  KeePass 2 PreLoad - detected UnsignedFile.Multi.Generic ( 1 )
20:38:28.0398 0x7020  Detect skipped due to KSN trusted
20:38:28.0398 0x7020  KeePass 2 PreLoad - ok
20:38:28.0446 0x7020  [ 0EF0822810009D58118CCDFD098FA9F4, 9FAA263057898BCDBCB0A064C463F48D149474AA339A3C4C47626CC118750D2D ] G:\Program Files (x86)\iTunes\iTunesHelper.exe
20:38:28.0463 0x7020  iTunesHelper - ok
20:38:28.0510 0x7020  [ 271B0D188430670509CB9943D5229205, 74CB5A9D8B5988AE08C0F65C601FC54F8745BAB6825B6FEEFBA8F068D656D8D7 ] C:\Program Files (x86)\QuickTime\QTTask.exe
20:38:28.0537 0x7020  QuickTime Task - detected UnsignedFile.Multi.Generic ( 1 )
20:38:31.0277 0x7020  Detect skipped due to KSN trusted
20:38:31.0277 0x7020  QuickTime Task - ok
20:38:31.0352 0x7020  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:38:31.0430 0x7020  Sidebar - ok
20:38:31.0455 0x7020  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:38:31.0492 0x7020  mctadmin - ok
20:38:31.0522 0x7020  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:38:31.0568 0x7020  Sidebar - ok
20:38:31.0575 0x7020  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:38:31.0596 0x7020  mctadmin - ok
20:38:31.0662 0x7020  [ E3BF29CED96790CDAAFA981FFDDF53A3, 76CB27EF7B27E5636EDA9D95229519B2A2870729A0BB694F1FD11CD602BAC4DC ] C:\Program Files\Windows Sidebar\sidebar.exe
20:38:31.0723 0x7020  Sidebar - ok
20:38:31.0776 0x7020  [ 10035E4C014522FE740172FF0B4FF43E, B09DCF7E147990C723EF044FB064D8793D18131519D292D88B71920C127AEF86 ] C:\Windows\ehome\ehTray.exe
20:38:31.0802 0x7020  ehTray.exe - ok
20:38:31.0889 0x7020  [ 2AD0F05760D8901DE213C0A666840DA5, 675DE8C585386733F8B2712FE3C76FB7BB77F25A610DE11D01360A49167C6760 ] C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
20:38:31.0957 0x7020  Remote Control Editor - detected UnsignedFile.Multi.Generic ( 1 )
20:38:34.0671 0x7020  Detect skipped due to KSN trusted
20:38:34.0671 0x7020  Remote Control Editor - ok
20:38:34.0716 0x7020  [ AFFE5666D886307C74C86859767EB61A, 6937EFCAACE139911BA82F60395251C94BB67033C58F38153DD044526FADFF9F ] G:\Program Files (x86)\STAMPIT\Binary\Stray.exe
20:38:34.0731 0x7020  STAMPIT-Tray - ok
20:38:34.0845 0x7020  [ C16858984A8BEC0DF5E46D8C6D591F85, 4FA744767882E05383C613051A5D6141B07BD260E168A39642B0FC709A5E752E ] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
20:38:34.0940 0x7020  LightScribe Control Panel - detected UnsignedFile.Multi.Generic ( 1 )
20:38:37.0647 0x7020  Detect skipped due to KSN trusted
20:38:37.0647 0x7020  LightScribe Control Panel - ok
20:38:37.0695 0x7020  [ BA7D51208ED1A5F2DAB4894C9717CBBD, 0341CC07EEEDB598F0EC68E1FE250F3FD73C099198B364E5877D5535D25BE26B ] G:\Program Files\Sandboxie\SbieCtrl.exe
20:38:37.0725 0x7020  SandboxieControl - ok
20:38:37.0778 0x7020  [ 8D4B9C3D641319CACDDBB5EF96B2DC98, 7EC631A41C82AD9FD88BD8A612765C998CFFE3D8A268134EE71F5679E5A0E737 ] G:\Program Files (x86)\RagTime Privat\Konni\KonniSymbol.exe
20:38:37.0798 0x7020  Konni Symbol Autostart - detected UnsignedFile.Multi.Generic ( 1 )
20:38:40.0700 0x7020  Konni Symbol Autostart ( UnsignedFile.Multi.Generic ) - warning
20:38:43.0462 0x7020  [ 40ECBE5FB9AF61FE1FF700397C6EC51F, 5790598DF7B082D79BCC72959EF8E7B77BAE645A3D3F9C9F588C312E6A744A16 ] G:\COOLSP~1\PERSON~1\PID.EXE
20:38:43.0497 0x7020  Personal ID - ok
20:38:43.0502 0x7020  OpAgent - ok
20:38:43.0583 0x7020  [ D3F0452392C45081D8866A92C86D1C7C, A746ED0D69FC51D974B445AB387C7315B70D7555B7499945A1D64F3E8A865340 ] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
20:38:43.0603 0x7020  ISUSPM - ok
20:38:43.0646 0x7020  [ 028E0C76ACE34B5F974B8A3DA77D85F1, 33E1696BB5042D721A3A71837EB9DE95B75A2E5971CA5E98259B2308908E92DF ] G:\Program Files (x86)\applord GmbH\ecoDMS - Client\runcon.bat
20:38:43.0727 0x7020  ecoprint - detected UnsignedFile.Multi.Generic ( 1 )
20:38:47.0674 0x7020  ecoprint ( UnsignedFile.Multi.Generic ) - warning
20:38:50.0586 0x7020  [ 14EF06B1EA531D681B5738F37388B99C, AB74735A3569B7995572FD7B0D026919CADA27C43A6AD0503659CE7CA3FF6B84 ] G:\Program Files (x86)\CCleaner\CCleaner64.exe
20:38:50.0753 0x7020  CCleaner Monitoring - ok
20:38:50.0929 0x7020  [ 2E0CF98623181D40BF79558387875F35, BC0E204D36CAF4864FD93A8FE260468320B7F5936ED338DF77DDE9A774C8C964 ] G:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
20:38:51.0004 0x7020  FileHippo.com - ok
20:38:51.0054 0x7020  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:38:51.0099 0x7020  Sidebar - ok
20:38:51.0117 0x7020  [ 10035E4C014522FE740172FF0B4FF43E, B09DCF7E147990C723EF044FB064D8793D18131519D292D88B71920C127AEF86 ] C:\Windows\ehome\ehTray.exe
20:38:51.0136 0x7020  ehTray.exe - ok
20:38:51.0190 0x7020  [ 2AD0F05760D8901DE213C0A666840DA5, 675DE8C585386733F8B2712FE3C76FB7BB77F25A610DE11D01360A49167C6760 ] C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
20:38:51.0240 0x7020  Remote Control Editor - detected UnsignedFile.Multi.Generic ( 1 )
20:38:51.0240 0x7020  Detect skipped due to KSN trusted
20:38:51.0240 0x7020  Remote Control Editor - ok
20:38:51.0258 0x7020  [ AFFE5666D886307C74C86859767EB61A, 6937EFCAACE139911BA82F60395251C94BB67033C58F38153DD044526FADFF9F ] G:\Program Files (x86)\STAMPIT\Binary\Stray.exe
20:38:51.0270 0x7020  STAMPIT-Tray - ok
20:38:51.0356 0x7020  [ C16858984A8BEC0DF5E46D8C6D591F85, 4FA744767882E05383C613051A5D6141B07BD260E168A39642B0FC709A5E752E ] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
20:38:51.0431 0x7020  LightScribe Control Panel - detected UnsignedFile.Multi.Generic ( 1 )
20:38:51.0432 0x7020  Detect skipped due to KSN trusted
20:38:51.0432 0x7020  LightScribe Control Panel - ok
20:38:51.0468 0x7020  [ BA7D51208ED1A5F2DAB4894C9717CBBD, 0341CC07EEEDB598F0EC68E1FE250F3FD73C099198B364E5877D5535D25BE26B ] G:\Program Files\Sandboxie\SbieCtrl.exe
20:38:51.0497 0x7020  SandboxieControl - ok
20:38:51.0499 0x7020  MyKey - ok
20:38:51.0515 0x7020  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:38:51.0538 0x7020  mctadmin - ok
20:38:51.0570 0x7020  FlashPlayerUpdate - ok
20:38:51.0600 0x7020  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
20:38:51.0646 0x7020  Sidebar - ok
20:38:51.0653 0x7020  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
20:38:51.0675 0x7020  mctadmin - ok
20:38:51.0738 0x7020  [ C16858984A8BEC0DF5E46D8C6D591F85, 4FA744767882E05383C613051A5D6141B07BD260E168A39642B0FC709A5E752E ] C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
20:38:51.0822 0x7020  LightScribe Control Panel - detected UnsignedFile.Multi.Generic ( 1 )
20:38:51.0822 0x7020  Detect skipped due to KSN trusted
20:38:51.0822 0x7020  LightScribe Control Panel - ok
20:38:51.0823 0x7020  Waiting for KSN requests completion. In queue: 4
20:38:52.0823 0x7020  Waiting for KSN requests completion. In queue: 4
20:38:53.0823 0x7020  Waiting for KSN requests completion. In queue: 2
20:38:54.0839 0x7020  AV detected via SS2: Norton Security, C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\WSCStub.exe ( 22.1.0.0 ), 0x51000 ( enabled : updated )
20:38:54.0840 0x7020  FW detected via SS2: Norton Security, C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\WSCStub.exe ( 22.1.0.0 ), 0x51010 ( enabled )
20:38:57.0498 0x7020  ============================================================
20:38:57.0498 0x7020  Scan finished
20:38:57.0498 0x7020  ============================================================
20:38:57.0505 0xde5c  Detected object count: 2
20:38:57.0505 0xde5c  Actual detected object count: 2
20:39:51.0789 0xde5c  Konni Symbol Autostart ( UnsignedFile.Multi.Generic ) - skipped by user
20:39:51.0789 0xde5c  Konni Symbol Autostart ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:39:51.0791 0xde5c  ecoprint ( UnsignedFile.Multi.Generic ) - skipped by user
20:39:51.0791 0xde5c  ecoprint ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Hoffe ich hab nix vergessen...

Gruß

Holger

Entschuldigung für die vielen Fehler, war etwas in Eile und finde leider die Funktion zum Bearbeiten der Beiträge nicht...

Hier nochmal der BSOD in lesbar:

hi,

Windows Bluescreen Absturz analysieren und beheben - so geht's - Anleitungen

Hallo Schrauber,

danke, dass Du mir hilfst. Was ist mit den zwei Dateien, die von TDSSkiller als suspekt bewertet wurden?

Gruß

Holger

log:

==================================================
Dump-Datei        : 021215-91453-01.dmp
Absturzzeit       : 12.02.2015 14:57:06
Fehlerprüfstring  : DRIVER_POWER_STATE_FAILURE
Fehlerprüfcode    : 0x0000009f
Parameter 1       : 00000000`00000004
Parameter 2       : 00000000`00000258
Parameter 3       : fffffa80`03a05040
Parameter 4       : fffff800`00b9c510
Verursachender Treiber: ntoskrnl.exe
Verursachende Adresse: ntoskrnl.exe+74ec0
Dateibeschreibung : NT Kernel & System
Produktname       : Microsoft® Windows® Operating System
Hersteller        : Microsoft Corporation
Dateiversion      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Prozessor         : 64-Bit
Absturzadresse    : ntoskrnl.exe+74ec0
Stapeladresse 1   : 
Stapeladresse 2   : 
Stapeladresse 3   : 
Computername      : 
Pfad              : C:\Windows\Minidump\021215-91453-01.dmp
CPUs              : 4
Hauptversion      : 15
Nebenversion      : 7601
Dump-Dateigröße   : 350.400
Dump-Dateizeit    : 12.02.2015 14:59:47
==================================================

==================================================
Dump-Datei        : 021215-114171-01.dmp
Absturzzeit       : 12.02.2015 04:56:41
Fehlerprüfstring  : DRIVER_POWER_STATE_FAILURE
Fehlerprüfcode    : 0x0000009f
Parameter 1       : 00000000`00000004
Parameter 2       : 00000000`00000258
Parameter 3       : fffffa80`039e6660
Parameter 4       : fffff800`00b9c510
Verursachender Treiber: ntoskrnl.exe
Verursachende Adresse: ntoskrnl.exe+76e80
Dateibeschreibung : NT Kernel & System
Produktname       : Microsoft® Windows® Operating System
Hersteller        : Microsoft Corporation
Dateiversion      : 6.1.7601.18717 (win7sp1_gdr.150113-1808)
Prozessor         : 64-Bit
Absturzadresse    : ntoskrnl.exe+76e80
Stapeladresse 1   : 
Stapeladresse 2   : 
Stapeladresse 3   : 
Computername      : 
Pfad              : C:\Windows\Minidump\021215-114171-01.dmp
CPUs              : 4
Hauptversion      : 15
Nebenversion      : 7601
Dump-Dateigröße   : 350.400
Dump-Dateizeit    : 12.02.2015 14:18:27
==================================================

==================================================
Dump-Datei        : 020915-120312-01.dmp
Absturzzeit       : 08.02.2015 20:35:15
Fehlerprüfstring  : DRIVER_POWER_STATE_FAILURE
Fehlerprüfcode    : 0x0000009f
Parameter 1       : 00000000`00000004
Parameter 2       : 00000000`00000258
Parameter 3       : fffffa80`039e7b50
Parameter 4       : fffff800`00b9c510
Verursachender Treiber: rspndr.sys
Verursachende Adresse: rspndr.sys+fe0f2b50
Dateibeschreibung : Link-Layer Topology Responder Driver for NDIS 6
Produktname       : Microsoft® Windows® Operating System
Hersteller        : Microsoft Corporation
Dateiversion      : 6.1.7600.16385 (win7_rtm.090713-1255)
Prozessor         : 64-Bit
Absturzadresse    : ntoskrnl.exe+76e80
Stapeladresse 1   : 
Stapeladresse 2   : 
Stapeladresse 3   : 
Computername      : 
Pfad              : C:\Windows\Minidump\020915-120312-01.dmp
CPUs              : 4
Hauptversion      : 15
Nebenversion      : 7601
Dump-Dateigröße   : 350.776
Dump-Dateizeit    : 09.02.2015 15:32:15
==================================================
         

Habe zwischenzeitlich Memtest86+ via hiren laufen lassen: keine Fehler.

Die sind in Ordnung. Bitte mal die Treiber kontrollieren, ob es vom Hersteller neuere gibt.

Hallo Schrauber,

habe den nVidia Treiber aktualisiert. Glaube aber das Problem liegt an einem USB Treiber. Der ist ein bischen schwierig zu deinstallieren. Arbeite dran. Melde mich morgen...

Holger

Chipsatz Treiber sollte helfen

o.k. werde mal schauen, obs aktuellere Treiber gibt. Der Rechner ist schon ziemlich alt..

Gruß
Holger

So, die gute Nachricht, habe die Chipset Treiber aktualisiert. Die schlechte Nachricht ist, dass ich dafür ein tool Namens "Driver Booster" verwendet habe. Das hat aber neben sich selbst auch noch so'n Mist Namens "Advanced System Care8" und vermutlich auch noch anderes Zeug isntalliert

Frage: Soll ich das "normal" über die Systemsteuerung wieder deinstallieren, oder besser mit einem Anti Malware tool, und wenn ja welches??

Danke!

Holger

PS: Sehe gerade, da wurde auch noch ein "IObit Uninstaller" installiert. Echt ärgerlich, dass man beim download über CHIP so einen Müll bekommt.

Alles deinstallieren was nicht hin soll, dann frische FRST Logs.

Und Finger weg von so Driver Software!

Deinstallation erfolgt.

FRST:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015
Ran by Holger (administrator) on HOLGER-QUADCORE on 16-02-2015 10:48:08
Running from C:\Users\Holger\Desktop
Loaded Profiles: Holger (Available profiles: Holger & Administrator)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(SurfRight B.V.) C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) G:\Program Files\Sandboxie\SbieSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(REINER SCT) C:\Windows\SysWOW64\cjpcsc.exe
(CyberLink) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
() G:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxServer64.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\pg_ctl.exe
(UltraVNC) G:\Program Files\UltraVNC\winvnc.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(UltraVNC) G:\Program Files\UltraVNC\winvnc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() G:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(PostgreSQL Global Development Group) G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\postgres.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(VMware, Inc.) G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Windows\SysWOW64\UMonit.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
() C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
(Deutsche Post AG) G:\Program Files (x86)\STAMPIT\Binary\STRAY.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Sandboxie Holdings, LLC) G:\Program Files\Sandboxie\SbieCtrl.exe
(Flexera Software, Inc.) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
() G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe
() G:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
(Samsung Electronics Co., Ltd.) C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe
(Acronis) G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(Space Sciences Laboratory) G:\Program Files (x86)\BOINC\boincmgr.exe
(Space Sciences Laboratory) G:\Program Files (x86)\BOINC\boinctray.exe
(VMware, Inc.) G:\Program Files (x86)\VMware\VMware Player\hqtray.exe
(CyberLink) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe
(CyberLink Corp.) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe
(Elaborate Bytes AG) G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Apple Inc.) G:\Program Files (x86)\iTunes\iTunesHelper.exe
(Space Sciences Laboratory) G:\Program Files (x86)\BOINC\boinc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Piriform Ltd) G:\Program Files (x86)\CCleaner\CCleaner64.exe
(CyberLink Corp.) G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(Microsoft Corporation) C:\Windows\System32\PrintIsolationHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [391296 2010-09-08] (Acronis)
HKLM\...\Run: [UMonit] => C:\Windows\SysWOW64\UMonit.exe [200704 2006-12-29] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13774040 2015-02-15] (Realtek Semiconductor)
HKLM\...\Run: [CDAServer] => C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe [462712 2012-03-09] ()
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585744 2015-02-05] (NVIDIA Corporation)
HKLM-x32\...\Run: [JMB36X IDE Setup] => C:\Windows\RaidTool\xInsIDE.exe [36864 2007-03-20] ()
HKLM-x32\...\Run: [TrueImageMonitor.exe] => G:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5514296 2010-09-08] (Acronis)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [boincmgr] => G:\Program Files (x86)\BOINC\boincmgr.exe [4793088 2009-11-06] (Space Sciences Laboratory)
HKLM-x32\...\Run: [boinctray] => G:\Program Files (x86)\BOINC\boinctray.exe [58112 2009-11-06] (Space Sciences Laboratory)
HKLM-x32\...\Run: [LGODDFU] => G:\Program Files (x86)\lg_fwupdate\lgfw.exe [27760 2012-08-11] (Bitleader)
HKLM-x32\...\Run: [VMware hqtray] => G:\Program Files (x86)\VMware\VMware Player\hqtray.exe [64112 2010-11-11] (VMware, Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [PowerDVD12DMREngine] => G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMR\PowerDVD12DMREngine.exe [505872 2012-09-19] (CyberLink)
HKLM-x32\...\Run: [PowerDVD12Agent] => G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\PowerDVD12Agent.exe [374560 2012-09-19] (CyberLink Corp.)
HKLM-x32\...\Run: [VirtualCloneDrive] => G:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [OmniPage Preload] => G:\Program Files (x86)\Nuance\OmniPage18\OmniPage18.exe [2987880 2011-07-28] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [Nuance OmniPage 18-reminder] => G:\Program Files (x86)\Nuance\OmniPage18\Ereg\Ereg.exe [333088 2011-05-16] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => G:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2109952 2014-10-07] (Dominik Reichl)
HKLM-x32\...\Run: [iTunesHelper] => G:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [] => [X]
Winlogon\Notify\ScCertProp: wlnotify.dll [X]
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [163328 2010-11-20] (Microsoft Corporation)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [Remote Control Editor] => C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1689088 2010-06-09] (Elgato Systems)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [STAMPIT-Tray] => G:\Program Files (x86)\STAMPIT\Binary\Stray.exe [83336 2010-06-11] (Deutsche Post AG)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2011-06-20] (Hewlett-Packard Company)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [SandboxieControl] => G:\Program Files\Sandboxie\SbieCtrl.exe [784904 2014-10-14] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [Konni Symbol Autostart] => [X]
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [Personal ID] => G:\coolspot AG\Personal ID\pid.exe [1134008 2009-03-04] (coolspot AG, Düsseldorf)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [OpAgent] => "OpAgent.exe" /agent
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [324976 2010-05-21] (Flexera Software, Inc.)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [ecoprint] => G:\Program Files (x86)\applord GmbH\ecoDMS - Client\runcon.bat [95 2013-12-21] ()
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [CCleaner Monitoring] => G:\Program Files (x86)\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Run: [FileHippo.com] => G:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()
HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\MountPoints2: {b0c0aea2-36ae-11df-b355-806e6f6e6963} - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL I:\ubcd\website\index.html
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Network PC Fax.lnk
ShortcutTarget: Samsung Network PC Fax.lnk -> C:\Windows\System32\spool\drivers\x64\3\NetFaxTray64.exe (Samsung Electronics Co., Ltd.)
Startup: C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Core Temp (2).lnk
ShortcutTarget: Core Temp (2).lnk -> G:\Program Files\Core Temp\Core Temp.exe ()
Startup: C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Versandhelfer.lnk
ShortcutTarget: Versandhelfer.lnk -> C:\Program Files (x86)\Versandhelfer\Versandhelfer.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-2149552335-4145356072-959976354-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2149552335-4145356072-959976354-1000 -> {47F43F50-68E2-4F28-B949-26EE0EC9C505} URL = hxxp://www.buyertools.net/cgi-bin/preispiraten_de/nph.fcgi?qry_str={searchTerms}&category=deutsch&how=and&searchtype=simple&Web=on&wiki_tab=on&wiki_tab_old=+CHECKED&ebay_tab=on&ebay_tab_old=+CHECKED&shoppingcom_tab=on&shoppingcom_tab_old=+CHECKED&pirat_tab=on&pirat_tab_old=+CHECKED&JavaScript=enabled&submit=SUCHEN
SearchScopes: HKU\S-1-5-21-2149552335-4145356072-959976354-1000 -> {65C238F8-3FA6-4AEC-914D-8CD376F70CC6} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> G:\Program Files (x86)\SnagIT\DLLx64\SnagitBHO64.dll (TechSmith Corporation)
BHO: ExplorerWnd Helper -> {10921475-03CE-4E04-90CE-E2E7EF20C814} -> C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll No File
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security\Engine64\22.1.0.9\coIEPlg.dll (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: SnagIt Toolbar Loader -> {00C6482D-C502-44C8-8409-FCE54AD9C208} -> G:\Program Files (x86)\SnagIT\SnagitBHO.dll (TechSmith Corporation)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\coIEPlg.dll (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Advanced SystemCare Surfing Protection -> {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} -> C:\Program Files (x86)\IObit\Surfing Protection\BrowerProtect\ASCPlugin_Protection.dll (IObit)
BHO-x32: Preispiraten -> {E9E027BF-C3F3-4022-8F6B-8F6D39A59684} -> G:\Program Files (x86)\Preispiraten6\IEButtonPPInterface.dll ()
Toolbar: HKLM - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - G:\Program Files (x86)\SnagIT\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine64\22.1.0.9\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll (TerraTec Electronic GmbH)
Toolbar: HKLM-x32 - Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - G:\Program Files (x86)\SnagIT\SnagitIEAddin.dll (TechSmith Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\coIEPlg.dll (Symantec Corporation)
Toolbar: HKU\S-1-5-21-2149552335-4145356072-959976354-1000 -> No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} -  No File
DPF: HKLM-x32 {62415890-4985-0825-2508-23487C2A845F} hxxp://192.168.178.130/en/cab/ipcamera.cab
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\..\Interfaces\{5F13DFFA-CEB5-450C-8AC0-7FB7FA277C11}: [NameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o
FF Homepage: about:home
FF NetworkProxy: "socks_remote_dns", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll No File
FF Plugin: synology.com/SurveillancePlugin_x86_64 -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.565\npSurveillancePlugin_x86_64.dll (Synology)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> G:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @qnap.com/MonitorPlayer -> C:\Program Files (x86)\QNAP\VioStorMonitor\npMonHost.dll ( QNAP System, Inc)
FF Plugin-x32: @videolan.org/vlc,version=0.9.9 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> G:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: synology.com/SurveillancePlugin -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.565\npSurveillancePlugin.dll (Synology)
FF Plugin HKU\S-1-5-21-2149552335-4145356072-959976354-1000: @hola.org/vlc,version=1.6.676 -> C:\Users\Holger\AppData\Local\Hola\firefox\app\vlc ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\searchplugins\firefox-add-ons.xml
FF SearchPlugin: C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\searchplugins\ixquick-https.xml
FF Extension: German Dictionary - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\de-DE@dictionaries.addons.mozilla.org [2014-06-08]
FF Extension: FoxyProxy Standard - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\foxyproxy@eric.h.jung [2015-02-06]
FF Extension: Advanced SystemCare Surfing Protection - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\iobitascsurfingprotection@iobit.com [2015-02-15]
FF Extension: Hola Better Internet - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\jid1-4P0kohSJxU1qGg@jetpack [2015-02-11]
FF Extension: KeeFox - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\keefox@chris.tomlinson [2015-01-17]
FF Extension: npIpcam - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\npapi@n.com [2013-07-01]
FF Extension: Flashblock - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-12-12]
FF Extension: Buyertools - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{411F2F11-830F-4AB5-B7F0-FBC77B870B5A} [2012-03-07]
FF Extension: WOT - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-12-03]
FF Extension: Preispiraten4 - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{A86278FF-6B63-446C-B109-DD4E1BAAC868} [2010-01-24]
FF Extension: Biet-O-Matic Firefox Erweiterung - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{B0D70E72-2FC1-4b9f-A3D4-5921C854D906} [2010-03-07]
FF Extension: Preispiraten 4 Kontextmenü - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{D2A8BC29-8CA3-4C0A-A206-631C44E9620F} [2009-12-08]
FF Extension: PassIFox - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\passifox@hanhuy.com.xpi [2014-08-17]
FF Extension: TrashMail.com - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\spam@trashmail.net.xpi [2011-03-27]
FF Extension: Password Exporter - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2014-08-17]
FF Extension: Adblock Plus - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-03-27]
FF Extension: DownThemAll! - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2011-05-17]
FF Extension: QuickJava - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{E6C1199F-E687-42da-8C24-E7770CC3AE66}.xpi [2015-02-07]
FF Extension: MyKey Interface - C:\Users\Holger\AppData\Roaming\Mozilla\Firefox\Profiles\default.e2o\Extensions\{FACC66B7-E49F-49ed-997E-66A221FD956D}.xpi [2011-04-01]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{2E6861CA-9A88-4B7B-B935-F810DE84D259} [2015-01-27]
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{3F4D6A2C-841D-403C-8CD8-48E54192DDEB} [2015-01-27]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-02-02]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.1.0.9\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NS_22.1.0.9\coFFPlgn [2015-02-16]

Chrome: 
=======
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\Exts\Chrome.crx [2015-01-24]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\Exts\Chrome.crx [2015-01-24]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - No Path

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 cjpcsc; C:\Windows\SysWOW64\cjpcsc.exe [506288 2011-02-08] (REINER SCT)
R2 CLHNServiceForPowerDVD12; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [90640 2012-09-19] (CyberLink Corp.)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [78352 2012-09-19] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [295440 2012-09-19] (CyberLink)
R2 DirMngr; G:\Program Files (x86)\GNU\GnuPG\dirmngr.exe [218112 2013-10-07] () [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2015-02-05] (NVIDIA Corporation)
R2 hmpalertsvc; C:\Program Files (x86)\HitmanPro.Alert\hmpalert.exe [1876816 2015-02-07] (SurfRight B.V.)
R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2011-06-20] (Hewlett-Packard Company) [File not signed]
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2724128 2015-01-16] (IObit)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-03-26] (Nitro PDF Software)
R2 NS; C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\NS.exe [282528 2014-12-10] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706128 2015-02-05] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833360 2015-02-05] (NVIDIA Corporation)
R2 Samsung Network Fax Server; C:\Windows\system32\spool\drivers\x64\3\NetFaxServer64.exe [508464 2013-07-01] (Samsung Electronics Co., Ltd.)
S3 SandraAgentSrv; G:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\RpcAgentSrv.exe [68760 2008-09-05] (SiSoftware) [File not signed]
R2 SbieSvc; G:\Program Files\Sandboxie\SbieSvc.exe [174600 2014-10-14] (Sandboxie Holdings, LLC)
S2 StarMoney 9.0 OnlineUpdate; G:\Program Files (x86)\StarMoney9.0\ouservice\StarMoneyOnlineUpdate.exe [697488 2014-07-04] (Star Finanz-Software Entwicklung und Vertriebs GmbH)
S2 SyncThru Admin 6; G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\syncthru6.exe [204800 2013-05-03] () [File not signed]
R2 SynoDrService; G:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe [404480 2010-03-24] () [File not signed]
S3 ufad-ws60; G:\Program Files (x86)\VMware\VMware Player\vmware-ufad.exe [191024 2010-08-19] (VMware, Inc.)
R2 uvnc_service; G:\Program Files\UltraVNC\WinVNC.exe [1793976 2009-12-07] (UltraVNC)
R2 VMAuthdService; G:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe [113264 2010-11-11] (VMware, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
R2 SyncThru Admin 6 Database; G:/Program Files (x86)/Samsung Network Printer Utilities/SyncThru Admin 6/UniThruTargetPlatform/PostgreSQL/engine/bin/pg_ctl.exe runservice -N "SyncThru Admin 6 Database" -D "G:/Program Files (x86)/Samsung Network Printer Utilities/SyncThru Admin 6/UniThruTargetPlatform/PostgreSQL/database"  -o "-p 5432" [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AVXBAR; C:\Windows\System32\DRIVERS\88xAXbar.sys [20544 2009-11-05] (DTV-DVB Technology, Inc.)
R3 BDATUNE; C:\Windows\System32\DRIVERS\88xBdaTune.sys [60096 2009-11-05] (DTV-DVB Technology, Inc.)
R1 BHDrvx64; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\BASHDefs\20150203.001\BHDrvx64.sys [1622744 2015-02-03] (Symantec Corporation)
R1 ccSet_NS; C:\Windows\system32\drivers\NSx64\1601000.009\ccSetx64.sys [165080 2014-09-09] (Symantec Corporation)
R3 cjusb; C:\Windows\System32\DRIVERS\cjusb.sys [34672 2011-03-29] (REINER SCT)
S3 cpudrv64; C:\Program Files (x86)\SystemRequirementsLab\cpudrv64.sys [17864 2009-12-18] ()
R3 CX23880; C:\Windows\System32\DRIVERS\88xAStream.sys [200896 2009-11-05] (DTV-DVB Technology, Inc.)
R3 CX88IR; C:\Windows\System32\DRIVERS\88xBdaIr.sys [28224 2009-11-05] (DTV-DVB Technology, Inc.)
R3 CXAVSTS; C:\Windows\System32\DRIVERS\88xBdaCap.sys [35648 2009-11-05] (DTV-DVB Technology, Inc.)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-11-25] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-11-25] (Symantec Corporation)
S3 FIXUSTOR; C:\Windows\System32\DRIVERS\fixustor.sys [18568 2006-11-28] (Genesys Logic)
S3 FIXUSTOR; C:\Windows\SysWOW64\DRIVERS\fixustor.sys [18568 2006-11-28] (Genesys Logic)
R2 hmpalert; C:\Windows\System32\drivers\hmpalert.sys [93144 2015-02-07] ()
R0 hotcore3; C:\Windows\SysWow64\drivers\hotcore3.sys [35096 2008-02-14] (Paragon Software Group)
R1 HWiNFO32; C:\Windows\SysWOW64\drivers\HWiNFO64A.SYS [26528 2015-02-15] (REALiX(tm))
R1 IDSVia64; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\IPSDefs\20150213.001\IDSvia64.sys [669400 2015-02-06] (Symantec Corporation)
S3 MEMSWEEP2; C:\Windows\system32\FF9A.tmp [6144 2010-05-26] (Sophos Plc) [File not signed]
R3 NAVENG; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\VirusDefs\20150215.024\ENG64.SYS [129752 2014-11-15] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Security\NortonData\22.1.0.9\Definitions\VirusDefs\20150215.024\EX64.SYS [2137304 2014-11-15] (Symantec Corporation)
R2 ntk_PowerDVD12; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [83704 2012-06-20] (Cyberlink Corp.)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
S3 RemoteControl-USBLAN; C:\Windows\System32\DRIVERS\rcblan.sys [46616 2007-01-24] (Belcarra Technologies)
S3 RTCore64; G:\Program Files (x86)\EVGA Precision X\RTCore64.sys [15176 2013-07-18] ()
S3 SANDRA; G:\Program Files\SiSoftware\SiSoftware Sandra Lite 2012.SP5c\WNt500x64\Sandra.sys [23112 2009-08-07] (SiSoftware)
R3 SbieDrv; G:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-10-14] (Sandboxie Holdings, LLC)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [34544 2015-02-15] (Synaptics Incorporated)
R3 SRTSP; C:\Windows\system32\drivers\NSx64\1601000.009\SRTSP64.SYS [914648 2014-12-02] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NSx64\1601000.009\SRTSPX64.SYS [42200 2014-12-02] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NSx64\1601000.009\SYMDS64.SYS [490712 2014-09-09] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NSx64\1601000.009\SYMEFA64.SYS [1151704 2014-09-09] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [102616 2015-01-24] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NSx64\1601000.009\Ironx64.SYS [271576 2014-09-09] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NSx64\1601000.009\SYMNETS.SYS [565464 2014-09-09] (Symantec Corporation)
S3 tap0801; C:\Windows\System32\DRIVERS\tap0801.sys [30720 2005-04-13] (The OpenVPN Project) [File not signed]
S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project)
R1 UGURU; C:\Windows\System32\drivers\uGuru.sys [22064 2006-09-20] (ABIT)
U5 UnlockerDriver5; G:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 usbser64; C:\Windows\System32\DRIVERS\usbser.sys [33280 2013-08-29] (Microsoft Corporation)
R2 vstor2-ws60; G:\Program Files (x86)\VMware\VMware Player\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R2 {73526619-C24F-470B-9BED-53D455FBB5C6}; G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\NavFilter\000.fcl [147704 2012-09-19] (CyberLink Corp.)
S3 ALSysIO; \??\C:\Users\Holger\AppData\Local\Temp\ALSysIO64.sys [X]
S3 EST_BusEnum; system32\DRIVERS\GenBus.sys [X]
S3 NUS_Bus; system32\DRIVERS\NUS_Bus.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 10:48 - 2015-02-16 10:50 - 00034365 _____ () C:\Users\Holger\Desktop\FRST.txt
2015-02-16 10:47 - 2015-02-16 10:47 - 00000000 ____D () C:\Users\Holger\Desktop\FRST-OlderVersion
2015-02-16 10:43 - 2015-02-16 10:43 - 00000022 _____ () C:\Windows\S.dirmngr
2015-02-16 10:42 - 2015-02-16 10:42 - 00000940 _____ () C:\Windows\PFRO.log
2015-02-15 19:25 - 2015-02-15 19:25 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_wacomrouterfilter_01009.Wdf
2015-02-15 19:09 - 2015-02-15 19:09 - 02333416 _____ (Intel) C:\Users\Holger\Downloads\Intel Driver Update Utility Installer.exe
2015-02-15 18:47 - 2015-02-15 18:47 - 00000000 ____H () C:\ProgramData\DP45977C.lfl
2015-02-15 18:44 - 2015-02-15 18:44 - 71040000 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoRes64.dat
2015-02-15 18:44 - 2015-02-15 18:44 - 05804772 _____ () C:\Windows\system32\Drivers\rtvienna.dat
2015-02-15 18:44 - 2015-02-15 18:44 - 04263128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\Drivers\RTKVHD64.sys
2015-02-15 18:44 - 2015-02-15 18:44 - 03186544 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkApi64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 02860760 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtPgEx64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 02827120 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RltkAPO64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 02162992 _____ (Yamaha Corporation) C:\Windows\system32\YamahaAE.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 02101848 _____ (Waves Audio Ltd.) C:\Windows\system32\WavesGUILib64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 01959128 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTSnMg64.cpl
2015-02-15 18:44 - 2015-02-15 18:44 - 01443340 _____ () C:\Windows\system32\Drivers\RTAIODAT.DAT
2015-02-15 18:44 - 2015-02-15 18:44 - 01411096 _____ (Synopsys, Inc.) C:\Windows\system32\SRRPTR64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 01361336 _____ (TOSHIBA Corporation) C:\Windows\system32\tosade.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 01287384 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RTCOM64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 01048824 _____ (SRS Labs, Inc.) C:\Windows\system32\slcnt64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00959704 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RCoInstII64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00947760 _____ (Sony Corporation) C:\Windows\system32\SFSS_APO.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00889592 _____ (DTS, Inc.) C:\Windows\system32\sl3apo64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00871856 _____ (TOSHIBA Corporation) C:\Windows\system32\tossaeapo64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00856992 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo264.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00724728 _____ (DTS, Inc.) C:\Windows\system32\sltech64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00629464 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtDataProc64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00582056 _____ (TOSHIBA Corporation) C:\Windows\system32\tosasfapo64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00451096 _____ (Synopsys, Inc.) C:\Windows\system32\SRAPO64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00375128 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEP64A.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00366104 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00331880 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtlCPAPI64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00326680 _____ (Synopsys, Inc.) C:\Windows\SysWOW64\SRCOM.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00326680 _____ (Synopsys, Inc.) C:\Windows\system32\SRCOM.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DHT64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00310104 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RP3DAA64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00246008 _____ (TODO: <Company name>) C:\Windows\system32\slprp64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00221024 _____ (Synopsys, Inc.) C:\Windows\system32\SFNHK64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00204120 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEED64A.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00162224 _____ (TOSHIBA Corporation) C:\Windows\system32\toseaeapo64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00149608 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCfg64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00148416 _____ (TOSHIBA Corporation) C:\Windows\system32\tadefxapo.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00101208 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEL64A.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00081248 _____ (Synopsys, Inc.) C:\Windows\system32\SFCOM64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00078688 _____ (Synopsys, Inc.) C:\Windows\system32\SFAPO64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00078680 _____ (Dolby Laboratories, Inc.) C:\Windows\system32\RTEEG64A.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00074064 _____ (Virage Logic Corporation / Sonic Focus) C:\Windows\SysWOW64\SFCOM.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00065944 _____ (TOSHIBA CORPORATION.) C:\Windows\system32\tepeqapo64.dll
2015-02-15 18:44 - 2015-02-15 18:44 - 00014952 _____ (Realtek Semiconductor Corp.) C:\Windows\system32\RtkCoLDR64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 14048512 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioRealtek64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 12967680 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO3064.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 07164176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEP64A.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 06218072 _____ (Dolby Laboratories) C:\Windows\system32\DDPP64A.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 05234952 _____ (Nahimic Inc) C:\Windows\system32\NAHIMICAPOlfx.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 02770976 _____ (Fortemedia Corporation) C:\Windows\system32\FMAPO64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 02041432 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioEQ64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01939800 _____ (Dolby Laboratories) C:\Windows\system32\DDPD64A.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01756264 _____ (DTS) C:\Windows\system32\DTSS2SpeakerDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01568360 _____ (DTS) C:\Windows\system32\DTSS2HeadphoneDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01550528 _____ (Conexant Systems Inc.) C:\Windows\system32\CX64APO.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01499984 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO5064.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01486952 _____ (DTS) C:\Windows\system32\DTSBoostDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01353472 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO6064.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01313904 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxSpeechAPO64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 01136728 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO4064.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00995120 _____ (Nahimic Inc) C:\Windows\system32\NahimicAPONSControl.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00979280 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVoiceAPO2064.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00922880 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPOShell64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00906800 _____ (Sony Corporation) C:\Windows\system32\MISS_APO.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00728680 _____ (DTS) C:\Windows\system32\DTSBassEnhancementDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00712296 _____ (DTS) C:\Windows\system32\DTSSymmetryDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00693352 _____ (DTS) C:\Windows\system32\DTSVoiceClarityDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00663296 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO30.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00662784 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxVolumeSDAPO.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00603984 _____ (Knowles Acoustics ) C:\Windows\system32\KAAPORT64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00560328 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAC64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00501184 _____ (DTS) C:\Windows\system32\DTSU2PLFX64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00491112 _____ (DTS) C:\Windows\system32\DTSNeoPCDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00487360 _____ (DTS) C:\Windows\system32\DTSU2PGFX64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00434960 _____ (Dolby Laboratories) C:\Windows\system32\R4EED64A.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00432744 _____ (DTS) C:\Windows\system32\DTSLimiterDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00428648 _____ (DTS) C:\Windows\system32\DTSGainCompensatorDLL64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00415680 _____ (DTS) C:\Windows\system32\DTSU2PREC64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00318808 _____ (Waves Audio Ltd.) C:\Windows\system32\MaxxAudioAPO20.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00315736 _____ (Dolby Laboratories) C:\Windows\system32\DDPO64A.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00303776 _____ (ICEpower a/s) C:\Windows\system32\ICEsoundAPO64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00261464 _____ (Dolby Laboratories) C:\Windows\system32\DDPA64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00242792 _____ (DTS) C:\Windows\system32\DTSLFXAPO64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00242792 _____ (DTS) C:\Windows\system32\DTSGFXAPO64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00241768 _____ (DTS) C:\Windows\system32\DTSGFXAPONS64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00141584 _____ (Dolby Laboratories) C:\Windows\system32\R4EEL64A.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00124176 _____ (Dolby Laboratories) C:\Windows\system32\R4EEA64A.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00113576 _____ (Real Sound Lab SIA) C:\Windows\system32\CONEQMSAPOGUILibrary.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00109848 _____ () C:\Windows\system32\AcpiServiceVnA64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00108640 _____ (Andrea Electronics Corporation) C:\Windows\system32\AERTAR64.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00096568 _____ () C:\Windows\system32\audioLibVc.dll
2015-02-15 18:43 - 2015-02-15 18:43 - 00075024 _____ (Dolby Laboratories) C:\Windows\system32\R4EEG64A.dll
2015-02-15 18:40 - 2015-02-15 18:40 - 01721576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\wdfcoinstaller01009.dll
2015-02-15 18:40 - 2015-02-15 18:40 - 00942808 _____ (Realtek ) C:\Windows\system32\Drivers\Rt64win7.sys
2015-02-15 18:40 - 2015-02-15 18:40 - 00073800 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RtNicProp64.dll
2015-02-15 18:40 - 2015-02-15 18:40 - 00034544 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel.sys
2015-02-15 18:40 - 2015-02-15 18:40 - 00015160 _____ (Wacom Technology) C:\Windows\system32\Drivers\wacomrouterfilter.sys
2015-02-15 18:40 - 2015-02-15 18:40 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_Smb_driver_Intel_01011.Wdf
2015-02-15 18:40 - 2015-02-15 18:40 - 00000000 ____D () C:\Program Files\Synaptics
2015-02-15 18:38 - 2015-02-15 18:38 - 00123704 _____ (JMicron Technology Corp.) C:\Windows\system32\Drivers\jraid.sys
2015-02-15 18:28 - 2015-02-15 18:28 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\ProductData
2015-02-15 18:27 - 2015-02-15 19:30 - 00002920 _____ () C:\Windows\System32\Tasks\Uninstaller_SkipUac_Holger
2015-02-15 18:27 - 2015-02-15 18:27 - 00000000 ____D () C:\Windows\Tasks\ImCleanDisabled
2015-02-15 18:27 - 2015-02-15 18:27 - 00000000 ____D () C:\ProgramData\{BAF091CA-86C4-4627-ADA1-897E2621C1B0}
2015-02-15 18:26 - 2015-02-16 10:35 - 00000000 ____D () C:\Program Files (x86)\IObit
2015-02-15 18:24 - 2015-02-15 19:30 - 00000000 ____D () C:\ProgramData\ProductData
2015-02-15 18:24 - 2015-02-15 19:30 - 00000000 ____D () C:\ProgramData\IObit
2015-02-15 18:24 - 2015-02-15 19:24 - 00002856 _____ () C:\Windows\System32\Tasks\Driver Booster SkipUAC (Holger)
2015-02-15 18:24 - 2015-02-15 18:28 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\IObit
2015-02-15 18:24 - 2015-02-15 18:24 - 00026528 _____ (REALiX(tm)) C:\Windows\SysWOW64\Drivers\HWiNFO64A.SYS
2015-02-15 18:02 - 2015-02-15 18:02 - 00000000 ____D () C:\Program Files\Intel
2015-02-15 18:00 - 2015-02-15 18:00 - 01203488 _____ () C:\Users\Holger\Downloads\Driver Booster Free - CHIP-Installer.exe
2015-02-15 17:59 - 2015-02-15 17:59 - 02894032 _____ (Intel(R) Corporation) C:\Users\Holger\Downloads\SetupChipset.exe
2015-02-15 17:57 - 2015-02-15 17:57 - 00000134 _____ () C:\Users\Holger\Downloads\inf_v9001007.zip
2015-02-12 20:42 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 20:42 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 20:42 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 20:42 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-12 18:11 - 2015-02-05 18:57 - 00621384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-02-12 18:07 - 2015-02-05 22:01 - 32106640 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 25460880 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 24768144 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 20466496 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 16017040 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 14119744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 13294528 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 13208200 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 10773704 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 10284872 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-02-12 18:07 - 2015-02-05 22:01 - 03610768 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 03247248 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434752.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 01557648 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434752.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00995248 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00969872 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00943760 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00929936 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00908104 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00877816 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00353224 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00305136 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2015-02-12 18:07 - 2015-02-05 22:01 - 00164752 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2015-02-12 18:04 - 2015-02-12 18:04 - 00000000 ____D () C:\NVIDIA
2015-02-12 17:59 - 2015-02-12 17:59 - 00640424 _____ (Akeo Consulting (hxxp://akeo.ie)) C:\Users\Holger\Downloads\rufus-1.4.12.exe
2015-02-12 17:55 - 2015-02-12 17:55 - 00000000 ____D () C:\Users\Holger\Downloads\grub4dos
2015-02-12 17:37 - 2015-02-12 18:00 - 00000000 ____D () C:\Users\Holger\Downloads\Hirens.BootCD.15.2
2015-02-12 17:32 - 2015-02-12 17:37 - 309136440 _____ (NVIDIA Corporation) C:\Users\Holger\Downloads\347.52-desktop-win8-win7-winvista-64bit-international-whql.exe
2015-02-12 17:26 - 2015-02-12 17:33 - 621283886 _____ () C:\Users\Holger\Downloads\Hirens.BootCD.15.2.zip
2015-02-12 17:11 - 2015-02-12 17:23 - 00000000 ____D () C:\Users\Holger\Downloads\bluescreenview-x64
2015-02-12 17:09 - 2015-02-12 17:09 - 00085380 _____ () C:\Users\Holger\Downloads\bluescreenview-x64.zip
2015-02-12 17:09 - 2015-02-12 17:09 - 00001672 _____ () C:\Users\Holger\Downloads\bluescreenview_german.zip
2015-02-11 22:33 - 2015-02-16 10:48 - 00000000 ____D () C:\FRST
2015-02-11 22:32 - 2015-02-16 10:47 - 02085888 _____ (Farbar) C:\Users\Holger\Desktop\FRST64.exe
2015-02-11 22:30 - 2015-02-11 22:30 - 00000000 _____ () C:\Users\Holger\defogger_reenable
2015-02-11 22:26 - 2015-02-12 18:18 - 00000000 ____D () C:\Users\Holger\Desktop\Virus
2015-02-11 22:23 - 2015-02-11 22:24 - 00380416 _____ () C:\Users\Holger\Desktop\Gmer-19357.exe
2015-02-11 22:22 - 2015-02-11 22:22 - 00050477 _____ () C:\Users\Holger\Desktop\Defogger.exe
2015-02-11 20:34 - 2015-02-11 20:35 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Holger\Desktop\tdsskiller.exe
2015-02-11 20:30 - 2015-02-11 20:33 - 00000335 _____ () C:\local.conf
2015-02-11 20:30 - 2015-02-11 20:33 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-02-11 20:29 - 2015-02-11 20:33 - 00000000 ____D () C:\Users\Holger\Desktop\mbar-1.08.3.1004
2015-02-11 20:27 - 2015-02-11 20:27 - 16466552 _____ (Malwarebytes Corp.) C:\Users\Holger\Desktop\mbar-1.08.3.1004.exe
2015-02-11 07:29 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 07:29 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 07:29 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 07:29 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 07:29 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 07:29 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 07:29 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 07:29 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 07:29 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 07:29 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 07:29 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 07:29 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 07:29 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 07:29 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 07:29 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 07:29 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 07:29 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 07:29 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 07:29 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 07:29 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 07:29 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 07:29 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 07:29 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 07:29 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 07:29 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 07:29 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 07:29 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 07:29 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 07:29 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 07:29 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 07:29 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 07:29 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 07:29 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 07:29 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 07:29 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 07:29 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 07:29 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 07:29 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 07:29 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 07:29 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 07:29 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 07:29 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 07:29 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 07:29 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 07:29 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 07:29 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 07:29 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 07:29 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 07:29 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 07:29 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 07:29 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 07:29 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 07:29 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 07:29 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 07:29 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 07:29 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 07:29 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 07:29 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 07:29 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 07:29 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 07:29 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 07:29 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 07:29 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 07:29 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 07:29 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 07:29 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 07:29 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 07:29 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 07:29 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 07:29 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 07:29 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 07:29 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 07:29 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 07:29 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 07:28 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 07:28 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 07:28 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 07:28 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 07:28 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 07:28 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 07:28 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 07:28 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 07:28 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 07:28 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 07:28 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 07:28 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 07:28 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 07:28 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 07:28 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 07:28 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 07:28 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 07:28 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 07:28 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 07:28 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 07:28 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 07:28 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 07:28 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 07:28 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 07:28 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 07:28 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 07:28 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-02-11 07:28 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 07:28 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 07:28 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 07:28 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 07:27 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 07:27 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 07:27 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 07:27 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 07:27 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 07:27 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 07:27 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 07:27 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-11 07:27 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 07:27 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-09 17:19 - 2015-02-09 17:19 - 00005398 _____ () C:\Users\Holger\Downloads\LAN24TB_20150209.dss
2015-02-08 19:42 - 2015-02-08 19:42 - 00000000 ____D () C:\Users\Holger\Downloads\qd560w550bger
2015-02-08 19:39 - 2015-02-08 19:40 - 03067440 _____ () C:\Users\Holger\Downloads\qd560w550bger.exe
2015-02-08 01:00 - 2015-02-16 10:45 - 01365646 _____ () C:\Windows\setupact.log
2015-02-08 01:00 - 2015-02-08 01:00 - 00000000 _____ () C:\Windows\setuperr.log
2015-02-07 19:34 - 2015-02-07 19:34 - 00000000 ____D () C:\Users\Holger\Downloads\Hola
2015-02-07 15:54 - 2015-02-07 15:54 - 00037970 _____ () C:\Users\Holger\Documents\cc_20150207_155358.reg
2015-02-07 15:54 - 2015-02-07 15:54 - 00024290 _____ () C:\Users\Holger\Documents\cc_20150207_155444.reg
2015-02-07 15:50 - 2015-02-07 15:50 - 05325208 _____ (Piriform Ltd) C:\Users\Holger\Downloads\ccsetup502.exe
2015-02-07 15:48 - 2015-02-07 15:48 - 00000000 ____D () C:\ProgramData\HitmanPro.Alert
2015-02-07 15:47 - 2015-02-16 10:45 - 00000000 ____D () C:\Windows\CryptoGuard
2015-02-07 15:47 - 2015-02-09 15:32 - 00000000 ____D () C:\Program Files (x86)\HitmanPro.Alert
2015-02-07 15:47 - 2015-02-07 19:34 - 00548424 _____ (SurfRight) C:\Windows\system32\hmpalert.dll
2015-02-07 15:47 - 2015-02-07 19:34 - 00477008 _____ (SurfRight) C:\Windows\SysWOW64\hmpalert.dll
2015-02-07 15:47 - 2015-02-07 19:34 - 00093144 _____ () C:\Windows\system32\Drivers\hmpalert.sys
2015-02-07 15:47 - 2015-02-07 15:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro.Alert
2015-02-07 15:46 - 2015-02-07 15:46 - 01889616 _____ (SurfRight B.V.) C:\Users\Holger\Downloads\hmpalert.exe
2015-02-07 15:45 - 2015-02-07 15:45 - 00000913 _____ () C:\Users\Holger\Desktop\FileHippo App Manager.lnk
2015-02-07 15:45 - 2015-02-07 15:45 - 00000913 _____ () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FileHippo App Manager.lnk
2015-02-07 15:45 - 2015-02-07 15:45 - 00000000 ____D () C:\ProgramData\IsolatedStorage
2015-02-07 15:41 - 2015-02-07 15:41 - 00849352 _____ () C:\Users\Holger\Downloads\AppManagerSetup_1.47.exe
2015-02-07 14:17 - 2015-02-07 14:17 - 00000000 ____D () C:\Windows\en
2015-02-07 14:16 - 2015-02-07 14:16 - 00001313 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Movie Maker.lnk
2015-02-07 14:16 - 2015-02-07 14:16 - 00000000 ____D () C:\Windows\de
2015-02-07 14:15 - 2015-02-07 14:15 - 00001382 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo Gallery.lnk
2015-02-07 14:11 - 2014-03-31 21:06 - 00058056 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fssfltr.sys
2015-02-07 14:08 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll
2015-02-07 14:08 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll
2015-02-07 14:08 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll
2015-02-07 14:08 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll
2015-02-07 14:08 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll
2015-02-07 14:08 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll
2015-02-07 14:04 - 2015-02-07 14:04 - 00002212 _____ () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-02-07 14:04 - 2015-02-07 14:04 - 00002128 _____ () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-02-07 14:04 - 2015-02-07 14:04 - 00002128 _____ () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-02-07 14:04 - 2015-02-07 14:04 - 00000000 ___RD () C:\Users\Holger\OneDrive
2015-02-07 14:04 - 2015-02-07 14:04 - 00000000 ____D () C:\ProgramData\Microsoft OneDrive
2015-02-07 14:04 - 2015-02-07 14:04 - 00000000 ____D () C:\Program Files (x86)\Microsoft OneDrive
2015-02-07 13:55 - 2015-02-07 13:56 - 01239752 _____ (Microsoft Corporation) C:\Users\Holger\Downloads\wlsetup-web(1).exe
2015-02-07 12:42 - 2015-02-07 12:42 - 00003206 _____ () C:\Windows\System32\Tasks\{00751C2C-0DE5-4235-8359-A01ADA1506E1}
2015-02-07 12:42 - 2015-02-07 12:42 - 00000093 _____ () C:\Windows\SysWOW64\FTCD2XXUN.ini
2015-02-07 12:42 - 2015-02-07 12:42 - 00000065 _____ () C:\Windows\SysWOW64\FTD2XXUN.ini
2015-02-07 12:42 - 2015-02-07 12:40 - 00420864 _____ (FTDI Ltd.) C:\Windows\SysWOW64\FTDIUNIN.exe
2015-02-07 12:39 - 2015-02-07 12:39 - 00000000 ____D () C:\Users\Holger\Downloads\FTClean
2015-02-07 12:36 - 2015-02-07 12:36 - 00452958 _____ () C:\Users\Holger\Downloads\FTClean.zip
2015-02-07 11:49 - 2015-02-07 11:49 - 156896601 _____ () C:\Users\Holger\Downloads\Wohnzimmer20150206-222956-1423258196.mp4
2015-02-07 11:48 - 2015-02-07 11:48 - 58965039 _____ () C:\Users\Holger\Downloads\Wohnzimmer20150206-222421-1423257861.mp4
2015-02-07 11:48 - 2015-02-07 11:48 - 169651682 _____ () C:\Users\Holger\Downloads\Wohnzimmer20150206-220453-1423256693.mp4
2015-02-07 11:09 - 2015-02-07 11:09 - 00000000 ____D () C:\Program Files (x86)\Synology
2015-02-07 09:50 - 2015-02-07 09:50 - 17465344 _____ () C:\Users\Holger\Downloads\SurveillancePlugin(1).msi
2015-02-06 20:43 - 2015-02-07 13:07 - 00000634 _____ () C:\Users\Holger\Desktop\SANUK Control 3.0.lnk
2015-02-06 20:43 - 2015-02-06 20:43 - 00000634 _____ () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\SANUK Control 3.0.lnk
2015-02-06 20:43 - 2015-02-06 20:43 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SANUK CyberControl 3.0
2015-02-06 20:42 - 2015-02-06 20:43 - 15209658 _____ () C:\Users\Holger\Downloads\scc_30_install(2).exe
2015-02-06 19:54 - 2015-02-06 19:55 - 15209658 _____ () C:\Users\Holger\Downloads\scc_30_install(1).exe
2015-02-05 07:07 - 2015-02-05 07:07 - 00004398 _____ () C:\Users\Holger\Desktop\eset.txt
2015-02-04 17:14 - 2015-02-04 17:14 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-02-04 15:56 - 2015-02-04 15:57 - 00001227 _____ () C:\DelFix.txt
2015-02-04 15:09 - 2015-02-04 15:09 - 00000331 _____ () C:\Users\Holger\Downloads\regfix(1).zip
2015-02-02 18:48 - 2015-02-02 18:48 - 00000000 ____D () C:\Users\Holger\Downloads\regfix
2015-02-02 18:47 - 2015-02-02 18:47 - 00000605 _____ () C:\Users\Holger\Downloads\regfix.zip
2015-02-01 14:17 - 2015-02-01 14:17 - 15209658 _____ () C:\Users\Holger\Downloads\scc_30_install.exe
2015-01-28 20:14 - 2015-01-28 20:14 - 00000000 ____D () C:\Users\Holger\AppData\Local\Hola
2015-01-28 19:19 - 2015-01-28 19:19 - 00000000 ____D () C:\Windows\system32\IO
2015-01-27 16:09 - 2015-01-28 20:05 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-25 21:10 - 2015-02-11 20:30 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-01-25 21:10 - 2015-02-11 20:30 - 00097496 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-01-25 21:10 - 2015-01-25 21:10 - 00000793 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-01-25 21:10 - 2015-01-25 21:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-01-25 21:10 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-01-25 21:10 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-01-24 15:09 - 2015-01-24 15:09 - 00000000 ____D () C:\Windows\System32\Tasks\Norton Security
2015-01-24 15:06 - 2015-01-24 15:06 - 00003214 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2015-01-24 15:05 - 2015-01-24 15:05 - 00102616 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2015-01-24 15:05 - 2015-01-24 15:05 - 00008214 _____ () C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2015-01-24 15:05 - 2015-01-24 15:05 - 00002457 _____ () C:\Users\Public\Desktop\Norton Security.lnk
2015-01-24 15:03 - 2015-01-24 15:05 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Security
2015-01-24 15:03 - 2015-01-24 15:03 - 00000000 ____D () C:\Program Files (x86)\Norton Security
2015-01-24 14:48 - 2015-01-24 14:49 - 08742712 _____ (Symantec Corporation) C:\Users\Holger\Desktop\NRnR.exe
2015-01-24 14:17 - 2015-01-13 05:15 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2015-01-24 14:17 - 2015-01-13 05:15 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll
2015-01-24 14:17 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-16 10:49 - 2010-03-23 20:26 - 01733911 _____ () C:\Windows\WindowsUpdate.log
2015-02-16 10:46 - 2010-07-28 14:02 - 00000000 ____D () C:\ProgramData\Temp
2015-02-16 10:44 - 2012-04-06 20:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-16 10:44 - 2010-10-21 14:11 - 00000000 ____D () C:\ProgramData\VMware
2015-02-16 10:42 - 2013-10-12 10:39 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-02-16 10:42 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-16 09:49 - 2014-11-20 17:32 - 00000000 ____D () C:\Program Files (x86)\Versandhelfer
2015-02-16 05:06 - 2010-03-23 21:24 - 00003962 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{424B6B76-676E-4BCF-A3EB-94365BADB9E1}
2015-02-15 19:31 - 2010-03-23 20:06 - 00016784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-15 19:31 - 2010-03-23 20:06 - 00016784 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-15 19:25 - 2010-07-29 15:06 - 00000372 _____ () C:\Windows\lgfwup.ini
2015-02-15 18:46 - 2010-03-23 20:06 - 00000000 ____D () C:\Windows\SysWOW64\RTCOM
2015-02-15 18:40 - 2010-01-06 00:39 - 00107552 _____ (Realtek Semiconductor Corporation) C:\Windows\system32\RTNUninst64.dll
2015-02-15 18:26 - 2009-08-11 14:33 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\Apple Computer
2015-02-15 18:01 - 2013-02-25 17:51 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-15 12:37 - 2010-09-29 12:52 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\vlc
2015-02-14 17:36 - 2011-02-26 20:56 - 00001824 _____ () C:\Windows\Sandboxie.ini
2015-02-13 12:38 - 2013-02-22 17:54 - 00000072 _____ () C:\Users\Public\LMDebug.log
2015-02-13 04:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 18:22 - 2014-08-17 14:37 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\KeePass
2015-02-12 18:13 - 2013-10-12 13:36 - 00001355 _____ () C:\Users\Public\Desktop\GeForce Experience.lnk
2015-02-12 18:12 - 2013-10-12 11:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-02-12 18:12 - 2010-07-29 15:06 - 00000000 ____D () C:\Temp
2015-02-12 18:04 - 2011-04-01 15:11 - 00000580 __RSH () C:\ProgramData\ntuser.pol
2015-02-12 18:02 - 2011-02-09 19:51 - 00000000 ____D () C:\Users\Holger\AppData\Local\CrashDumps
2015-02-12 17:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\GroupPolicy
2015-02-12 17:42 - 2011-04-24 11:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\IsoBuster
2015-02-12 17:30 - 2009-07-14 18:58 - 00752936 _____ () C:\Windows\system32\perfh007.dat
2015-02-12 17:30 - 2009-07-14 18:58 - 00171984 _____ () C:\Windows\system32\perfc007.dat
2015-02-12 17:30 - 2009-07-14 06:13 - 01759042 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-12 15:00 - 2010-06-12 16:24 - 00000000 ____D () C:\Windows\Minidump
2015-02-12 14:59 - 2012-10-19 11:35 - 00350400 _____ () C:\Windows\Minidump\021215-91453-01.dmp
2015-02-12 14:20 - 2009-07-14 05:45 - 02375592 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 14:18 - 2012-10-19 11:35 - 00350400 _____ () C:\Windows\Minidump\021215-114171-01.dmp
2015-02-12 04:45 - 2014-12-11 03:42 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 04:45 - 2014-05-07 02:04 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-12 04:45 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-12 03:41 - 2009-01-27 22:49 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-12 03:36 - 2013-08-16 02:02 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 03:23 - 2010-04-14 15:32 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 22:30 - 2010-03-23 20:08 - 00000000 ____D () C:\Users\Holger
2015-02-11 22:29 - 2013-03-16 17:33 - 00000032 _____ () C:\Users\Holger\AppData\Roaming\Network Meter_Usage.ini
2015-02-11 22:00 - 2013-03-13 14:51 - 00642325 _____ () C:\Users\Holger\Network_Meter_Data.js
2015-02-10 17:47 - 2013-02-22 21:37 - 00000000 ____D () C:\Users\Holger\Documents\Scan
2015-02-10 17:22 - 2013-10-15 19:17 - 00009011 _____ () C:\Users\Holger\IP_Log_Data.js
2015-02-09 15:56 - 2013-09-03 15:06 - 00000000 ____D () C:\Users\Administrator
2015-02-09 15:41 - 2012-09-25 19:42 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\Nitro PDF
2015-02-09 15:32 - 2012-10-19 11:35 - 00350776 _____ () C:\Windows\Minidump\020915-120312-01.dmp
2015-02-07 15:52 - 2010-09-26 16:40 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\FileZilla
2015-02-07 15:51 - 2010-11-20 18:49 - 00000730 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2015-02-07 14:16 - 2010-10-27 17:21 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live
2015-02-07 14:14 - 2010-10-27 17:24 - 00001466 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk
2015-02-07 14:13 - 2010-10-27 17:24 - 00002494 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk
2015-02-07 14:12 - 2010-10-27 17:21 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2015-02-07 14:11 - 2010-10-27 17:21 - 00000000 ____D () C:\Program Files\Windows Live
2015-02-07 14:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2015-02-06 20:31 - 2009-12-07 16:59 - 00000778 _____ () C:\Windows\HBCIKRNL.INI
2015-02-06 19:58 - 2010-10-09 12:23 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\TeamViewer
2015-02-05 22:01 - 2014-06-03 15:09 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-02-05 22:01 - 2014-06-03 15:09 - 01316184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-02-05 22:01 - 2014-03-12 17:05 - 00027441 _____ () C:\Windows\system32\nvinfo.pb
2015-02-05 22:01 - 2013-10-28 16:14 - 01514528 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-02-05 22:01 - 2013-10-28 16:14 - 01278920 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-02-05 22:01 - 2013-10-12 13:14 - 17253848 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-02-05 22:01 - 2013-10-12 13:14 - 10713256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-02-05 22:01 - 2013-10-12 13:14 - 02902784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-02-05 22:01 - 2012-10-19 16:05 - 18575880 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2015-02-05 22:01 - 2012-10-19 16:05 - 03299512 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll
2015-02-05 20:07 - 2013-10-12 10:39 - 00062792 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2015-02-05 20:07 - 2011-01-16 16:13 - 06861128 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2015-02-05 20:07 - 2011-01-16 16:13 - 03517584 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2015-02-05 20:07 - 2011-01-16 16:13 - 02558792 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2015-02-05 20:07 - 2011-01-16 16:13 - 00935056 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2015-02-05 20:06 - 2011-01-16 16:13 - 00385168 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2015-02-05 13:50 - 2013-10-12 11:21 - 04236870 _____ () C:\Windows\system32\nvcoproc.bin
2015-02-05 00:43 - 2012-04-06 20:12 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-05 00:43 - 2012-04-06 20:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 00:43 - 2011-05-17 16:03 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-29 17:52 - 2010-03-20 14:36 - 00000000 ____D () C:\Program Files (x86)\Java
2015-01-28 20:08 - 2012-05-03 18:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-01-25 21:10 - 2010-09-22 16:36 - 00000000 ____D () C:\Users\Holger\AppData\Roaming\Malwarebytes
2015-01-25 21:10 - 2010-09-22 16:36 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-24 15:05 - 2011-02-01 17:13 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2015-01-24 15:03 - 2011-02-01 17:12 - 00000000 ____D () C:\ProgramData\Norton

==================== Files in the root of some directories =======

2012-11-22 17:29 - 2012-11-22 17:29 - 0000545 _____ () C:\Users\Holger\AppData\Roaming\All CPU MeterV3_Settings.ini
2011-07-14 15:45 - 2012-01-27 18:51 - 0000412 _____ () C:\Users\Holger\AppData\Roaming\All CPU Meter_Settings.ini
2014-11-20 17:31 - 2014-11-20 17:31 - 0000353 _____ () C:\Users\Holger\AppData\Roaming\dpdhl.versandhelfer_state.xml
2012-03-04 17:31 - 2013-03-02 20:42 - 0000841 _____ () C:\Users\Holger\AppData\Roaming\Drives Meter_Settings.ini
2009-06-08 16:32 - 2012-02-04 12:35 - 0099384 _____ () C:\Users\Holger\AppData\Roaming\inst.exe
2011-07-14 15:47 - 2013-11-04 19:51 - 0001389 _____ () C:\Users\Holger\AppData\Roaming\Network Meter_Settings.ini
2013-03-16 17:33 - 2015-02-11 22:29 - 0000032 _____ () C:\Users\Holger\AppData\Roaming\Network Meter_Usage.ini
2009-06-08 16:32 - 2012-02-04 12:35 - 0007859 _____ () C:\Users\Holger\AppData\Roaming\pcouffin.cat
2009-06-08 16:32 - 2012-02-04 12:35 - 0001167 _____ () C:\Users\Holger\AppData\Roaming\pcouffin.inf
2009-06-08 16:33 - 2012-02-04 12:35 - 0000033 _____ () C:\Users\Holger\AppData\Roaming\pcouffin.log
2009-06-08 16:32 - 2012-02-04 12:35 - 0082816 _____ (VSO Software) C:\Users\Holger\AppData\Roaming\pcouffin.sys
2012-10-23 16:01 - 2012-10-27 17:16 - 11718656 _____ () C:\Users\Holger\AppData\Roaming\Sandra.mdb
2013-09-30 15:29 - 2013-10-05 15:10 - 0000676 _____ () C:\Users\Holger\AppData\Roaming\sqlite3Explorer.xml
2011-03-13 14:09 - 2013-12-12 17:22 - 0042744 _____ () C:\Users\Holger\AppData\Roaming\UserTile.png
2010-09-15 16:45 - 2014-07-27 16:49 - 0006144 _____ () C:\Users\Holger\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2010-09-27 14:58 - 2012-04-21 19:23 - 0000600 _____ () C:\Users\Holger\AppData\Local\PUTTY.RND
2013-10-29 12:39 - 2013-10-29 12:39 - 0001706 _____ () C:\Users\Holger\AppData\Local\recently-used.xbel
2010-04-07 14:59 - 2011-02-06 20:38 - 0007605 _____ () C:\Users\Holger\AppData\Local\resmon.resmoncfg
2012-02-04 11:43 - 2012-11-29 16:31 - 0000040 ___SH () C:\ProgramData\.zreglib
2015-02-15 18:47 - 2015-02-15 18:47 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2013-02-15 17:00 - 2013-03-13 14:41 - 0017571 _____ () C:\ProgramData\Network_Meter_Data.csv
2010-08-25 14:35 - 2010-08-25 14:35 - 0000000 _____ () C:\ProgramData\xml6380.tmp
2010-11-19 19:25 - 2010-11-19 19:25 - 0013869 _____ () C:\ProgramData\xmlC2E1.tmp
2010-06-19 15:09 - 2010-11-19 19:25 - 0005975 _____ () C:\ProgramData\xmlD137.tmp
2010-06-19 15:09 - 2010-08-25 14:35 - 0000000 _____ () C:\ProgramData\xmlD927.tmp
2010-06-19 15:09 - 2010-11-19 19:25 - 0001629 _____ () C:\ProgramData\xmlDA32.tmp

Files to move or delete:
====================
C:\Users\Holger\IP_Log_Data.js
C:\Users\Holger\Network_Meter_Data.js


Some content of TEMP:
====================
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.654.exe
C:\Users\Holger\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.6.676.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-13 00:41

==================== End Of Log ============================
         

--- --- ---

--- --- ---

Addition:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-02-2015
Ran by Holger at 2015-02-16 10:51:00
Running from C:\Users\Holger\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Norton Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.34 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0934-000001000000}) (Version: 9.34.00.0 - Igor Pavlov)
Acronis True Image Home 2011 (HKLM-x32\...\{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}) (Version: 14.0.5519 - Acronis)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Advanced Archive Password Recovery (HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\Advanced Archive Password Recovery) (Version: 4.53 - ElcomSoft Co. Ltd.)
Advanced Renamer (HKLM-x32\...\Advanced Renamer_is1) (Version: 3.64 - Hulubulu Software)
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Biet-O-Matic v2.12.7 (HKLM-x32\...\Biet-O-Matic v2.12.7) (Version: Biet-O-Matic v2.12.7 - BOM Development Team)
BOINC (HKLM-x32\...\{4D12D805-50B2-4287-B3B9-AD4D74F85693}) (Version: 6.10.18 - Space Sciences Laboratory, U.C. Berkeley)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother P-touch Address Book 1.1 (HKLM-x32\...\{B2023017-DEE4-44F7-8A71-CA6084BF534C}) (Version: 1.1.2201 - Brother Industries, Ltd.)
Brother P-touch Editor 5.1 (HKLM-x32\...\{39270390-A851-4E4B-94A9-D5C468216ED3}) (Version: 5.1.0200 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Einzelhandel [DEU] (HKLM-x32\...\{DF776DAE-575D-4E1B-A436-158549FD65E4}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Event-Planung [DEU] (HKLM-x32\...\{2B540B0C-8AC4-42BE-A597-FDD1A788A0F5}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Feier [DEU] (HKLM-x32\...\{0BE7832F-D842-4C1F-B910-E99790416EDA}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Geburtstag [DEU] (HKLM-x32\...\{B6D72A3F-B3C9-4C2E-B98C-A22F06529B8C}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Paketversand [DEU] (HKLM-x32\...\{5EFFE155-E75B-4816-82BB-67C76A7E2C09}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Editor Etikettenvorlagen - Warnung [DEU] (HKLM-x32\...\{6CEBCCA3-0F3F-4B1C-B0E9-4E6E14546651}) (Version: 1.0.001 - Brother Industries, Ltd.)
Brother P-touch Update Software (HKLM-x32\...\{08BAC163-A5E8-4838-90A9-8C9343400579}) (Version: 1.0.0030 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5000 - CDBurnerXP)
Cinergy S PCI V1.00.02.09c (HKLM-x32\...\Cinergy S PCI) (Version: 1.00.02.09c - )
Common Desktop Agent (Version: 1.62.0 - OEM) Hidden
Core Temp version 0.99.7 (HKLM\...\{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1) (Version: 0.99.7 - Arthur Liberman)
cyberJack Base Components (HKLM-x32\...\{FC338210-F594-11D3-BA24-00001C3AB4DF}) (Version: 6.9.10 - REINER SCT)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.2118a.57 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DreamBoxEdit -- The one and only settings editor for your Dreambox (HKLM-x32\...\DreamBoxEdit) (Version:  - )
DVDFab 9.0.7.2 (18/10/2013) (HKLM-x32\...\DVDFab 9_is1) (Version:  - Fengtao Software Inc.)
Easy RAR Recovery (HKLM-x32\...\Easy RAR Recovery) (Version: 2.0 - MunSoft)
EasyBCD 2.0 (HKLM-x32\...\EasyBCD) (Version: 2.0 - NeoSmart Technologies)
ecoDMS - Client (HKLM-x32\...\87CC2334-DF2E-4860-9651-8644F8C05DFC) (Version: 12.05 - applord GmbH)
ecoDMS - Printer (HKLM-x32\...\8A53B176-7CB8-49F8-AD87-F8A1625DDF01) (Version: 12.05 - applord gmbh)
ecoDMSOfficePlugin (HKLM-x32\...\{A0B706BC-10A3-4B35-8DE6-73AF8DBDE71F}) (Version: 1.9.5 - applord GmbH)
ecoDMSOfficePlugin (HKLM-x32\...\{A0B706BC-10A3-4B35-8DE6-73AF8DBDE72C}) (Version: 1.9.8 - applord GmbH)
ecoICE - Image Correction Editor (HKLM-x32\...\CA64A6D5-EDF0-4997-80E5-F9678C1AFCFB) (Version: 12.05 - applord GmbH)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
EVGA Precision X 4.2.1 (HKLM-x32\...\PrecisionX) (Version: 4.2.1 - EVGA Corporation)
ffdshow [rev 1723] [2007-12-24] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - )
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
FileZilla Client 3.9.0.5 (HKLM-x32\...\FileZilla Client) (Version: 3.9.0.5 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Free Disc Burner version 3.0.8.221 (HKLM-x32\...\Free Disc Burner_is1) (Version: 3.0.8.221 - DVDVideoSoft Ltd.)
Free DVD Video Burner version 3.2.6.430 (HKLM-x32\...\Free DVD Video Burner_is1) (Version: 3.2.6.430 - DVDVideoSoft Ltd.)
Free Studio version 4.3 (HKLM-x32\...\Free Studio_is1) (Version:  - DVDVideoSoft Limited.)
Free Video Dub version 2.0.8.504 (HKLM-x32\...\Free Video Dub_is1) (Version: 2.0.8.504 - DVDVideoSoft Ltd.)
FRITZ!Box-Fernzugang einrichten (HKLM-x32\...\{A79408B0-345D-42E8-8EB6-00597320B9E0}) (Version: 1.0.3 - AVM Berlin)
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 2.4.0.5 - Genesys Logic)
Gpg4win (2.2.1) (HKLM-x32\...\GPG4Win) (Version: 2.2.1 - The Gpg4win Project)
HELI-X 3.0 Demo (HKLM-x32\...\{7AEF3482-B7B7-4B94-AF63-B249B9BA9D7F}_is1) (Version:  - Michael Schreiner)
HitmanPro.Alert (HKLM\...\HitmanPro.Alert) (Version: 2.6.5.77 - SurfRight B.V.)
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.8.0 - LIGHTNING UK!)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.24 - Intel(R) Corporation) Hidden
IPCamSetup (HKLM-x32\...\{02C39DE9-B03A-4FE7-89F9-61E224FE65CC}) (Version: 1.00.0000 - FOSCAM)
IPCMonitor_en version 1.0.1.4 (HKLM-x32\...\{8EC13308-5065-43FA-A5E8-E225F18DAB89}_is1) (Version: 1.0.1.4 - IPCMonitor, Inc.)
iPhoneBrowser (HKLM-x32\...\{C1FCDCA1-2759-4E5E-84EE-3A665BB2F513}) (Version: 1.9.3 - Cranium Consulting and Custom Software)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.28 - Irfan Skiljan)
IsoBuster 3.5 (HKLM-x32\...\IsoBuster_is1) (Version: 3.5 - Smart Projects)
iSpy (HKLM-x32\...\{4D1DD276-902C-4665-ABBD-13EC01BAFC0E}) (Version: 4.7.7 - iSpy)
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
JMB36X Raid Configurer (HKLM-x32\...\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}) (Version: 1.00.0000 - JMICRON Technology Corp.)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
KeePass Password Safe 2.28 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.28 - Dominik Reichl)
LG Tool Kit (HKLM-x32\...\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )
LightScribe System Software (HKLM-x32\...\{2FA75B40-17C9-4D22-88CA-80A5D52FAB13}) (Version: 1.18.24.1 - LightScribe)
Logitech Harmony Remote Software 7 (HKLM-x32\...\{5C6F884D-680C-448B-B4C9-22296EE1B206}) (Version: 7.7.0.0 - Logitech)
MakeMKV v1.8.13 (HKLM-x32\...\MakeMKV) (Version: v1.8.13 - GuinpinSoft inc)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Media Add-ons für Acronis True Image Home 2011 (HKLM-x32\...\{9A5509EE-5579-46C1-B566-5065545547F9}) (Version: 14.0.5519 - Acronis)
MediaInfo 0.7.69 (HKLM\...\MediaInfo) (Version: 0.7.69 - MediaArea.net)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Access database engine 2010 (German) (HKLM-x32\...\{90140000-00D1-0407-0000-0000000FF1CE}) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0407-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-007A-0409-0000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Office Ultimate 2007 (HKLM-x32\...\ULTIMATER) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{09298F26-A95C-31E2-9D95-2C60F586F075}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.1.177.0 - Microsoft Corporation)
MKVToolNix 6.8.0 (32bit) (HKLM-x32\...\MKVtoolnix) (Version: 6.8.0 - Moritz Bunkus)
MobileMe Control Panel (HKLM\...\{41BC9E31-0D39-462E-8E4C-767B21A3B1C3}) (Version: 3.1.8.0 - Apple Inc.)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSXML 4.0 SP2 (KB941833) (HKLM-x32\...\{C523D256-313D-4866-B36A-F3DE528246EF}) (Version: 4.20.9849.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Neato Updater Tool v2 (HKLM-x32\...\{292156D3-43B5-4C96-B79A-94E40F8D8991}) (Version: 3.0 - Neato Robotics, Inc)
Nitro Reader 3 (HKLM\...\{4436B9BD-CA66-4D69-9091-2D2EB62F09AD}) (Version: 3.5.2.10 - Nitro)
Norton Security (HKLM-x32\...\NS) (Version: 22.1.0.9 - Symantec Corporation)
Nuance OmniPage 18 (HKLM-x32\...\{560C6F9C-8D5E-4EAF-B408-98850E5DF49C}) (Version: 18.1.0000 - Nuance Communications, Inc.)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.52 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.52 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Paragon Hard Disk Manager 2008 Professional (HKLM-x32\...\{E9E4BB29-FA98-401B-9EDE-9906906E33DE}) (Version:  - Paragon Software Group)
Parallels runtime modules (x32 Version: 1.00.0000 - Parallels) Hidden
Parallels USB Driver (x32 Version: 6.00.15055 - Parallels) Hidden
PDF Split And Merge Basic (HKLM\...\{C91B24F6-1629-11E2-B696-21676188709B}) (Version: 2.2.2 - Andrea Vacondio)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
PhoenixRC (HKLM-x32\...\{6D44070C-86F9-424A-B514-6907E4335BCE}) (Version: 3.00.16 - Ihr Firmenname)
PINs 4 (HKLM-x32\...\PINs 4) (Version: 4.50.0.86 - Mirek Wojtowicz)
Preispilot für Firefox (HKLM-x32\...\{0D8E6567-7082-48DB-A305-293873AC8B39}_is1) (Version: 2.0 - Preispilot)
Preispiraten (HKLM-x32\...\{5384EA8A-FECA-4D6E-B7B4-3D4D9D47E5DF}) (Version: 6 - metaspinner net GmbH)
PSPad editor (HKLM-x32\...\PSPad editor_is1) (Version:  - Jan Fiala)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QNAP Finder (HKLM-x32\...\QNAP_FINDER) (Version:  - )
QNAP Web Monitor Component (HKLM-x32\...\QNAPVioStorMonitor) (Version: 3.6.0.22010 - QNAP Systems, Inc.)
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
RagTime Privat (HKLM-x32\...\RagTime Privat) (Version:  - )
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7373 - Realtek Semiconductor Corp.)
Remote Control USB Driver (HKLM-x32\...\{8471021C-F529-43DE-84DF-3612E10F58C4}) (Version: 2.3.2.317 - )
RivaTuner Statistics Server 5.2.0 (HKLM-x32\...\RTSS) (Version: 5.2.0 - Unwinder)
Samsung CLX-6260 Series (HKLM-x32\...\Samsung CLX-6260 Series) (Version: 1.05 (16.10.2012) - Samsung Electronics Co., Ltd.)
Samsung Easy Color Manager (HKLM-x32\...\{778EACF8-06C1-47AA-9284-91550E9BAD39}) (Version: 3.02.04 - Samsung Electronics Co., Ltd.)
Samsung Easy Document Creator (HKLM-x32\...\Samsung Easy Document Creator) (Version: 1.05.78 (28.06.2013) - Samsung Electronics Co., Ltd.)
Samsung Easy Printer Manager (HKLM-x32\...\Samsung Easy Printer Manager) (Version: 1.03.58.00(17.07.2013) - Samsung Electronics Co., Ltd.)
Samsung Network PC Fax (HKLM-x32\...\Samsung Network PC Fax) (Version: 1.10.11 (01.07.2013) - Samsung Electronics Co., Ltd.)
Samsung OCR Software (HKLM-x32\...\Samsung OCR Software) (Version: 1.00.05 (10.07.2012) - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: 1.01.00:04(2013-04-22) - Samsung Electronics Co., Ltd.)
Samsung Scan Process Machine (x32 Version: 1.01.08.00 - Samsung Electronics Co., Ltd.) Hidden
Sandboxie 4.14 (64-bit) (HKLM\...\Sandboxie) (Version: 4.14 - Sandboxie Holdings, LLC)
SANUK CyberControl 3.0 (HKU\S-1-5-21-2149552335-4145356072-959976354-1000\...\SANUK CyberControl 3.0) (Version:  - )
ScanSnap (x32 Version: 5.1.30.19 - PFU Limited) Hidden
SDFormatter (HKLM-x32\...\{5A347920-4AFC-11D5-9FB0-800649886934}) (Version:  - )
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Silicon Laboratories CP210x USB to UART Bridge (Driver Removal) (HKLM-x32\...\SLABCOMM&10C4&EA60) (Version:  - Silicon Laboratories)
Silicon Laboratories CP210x VCP Drivers for Windows XP/2003 Server/Vista/7 (HKLM-x32\...\{5C3C3D8E-9C3F-4E44-95FF-9458B12C09CD}) (Version: 6.4 - Silicon Laboratories, Inc.)
SiSoftware Sandra Lite 2012.SP5c (HKLM\...\{C3113E55-7BCB-4de3-8EBF-60E6CE6B2396}_is1) (Version: 18.74.2012.10 - SiSoftware)
Snagit 9.1.3 (HKLM-x32\...\{5C47C8B6-77FF-4FC7-A388-66FCF9CFC24C}) (Version: 9.1.3.16 - TechSmith Corporation)
SnapAPI (x32 Version: 3.0.306 - Acronis) Hidden
SNS Upload for Easy Document Creator (HKLM-x32\...\{B6B5F07C-88D5-49D3-A1A7-A6D4BC37DCCC}) (Version: 1.0.0 - Samsung Electronics Co.,Ltd)
Sophos Anti-Rootkit 1.5.4 (HKLM-x32\...\Sophos-AntiRootkit) (Version: 1.5.4 - Sophos Plc)
Stampit Home (HKLM-x32\...\{B83AAFD3-D8DE-46CE-9351-70C21AC6704E}) (Version: 3.3 - Deutsche Post AG)
StarMoney (x32 Version: 2.0 - StarFinanz) Hidden
StarMoney (x32 Version: 3.0.1.31 - StarFinanz) Hidden
StarMoney (x32 Version: 4.0.0.203 - StarFinanz) Hidden
StarMoney 9.0 apoEdition (HKLM-x32\...\{D34405B6-6480-4228-B811-4181F38411F8}) (Version: 9.0 - Star Finanz GmbH)
Surfing Protection (HKLM-x32\...\IObit Surfing Protection_is1) (Version: 1.2 - IObit)
SurveillancePlugin (HKLM-x32\...\{970AE435-8AAE-4F5E-A754-880DAC8968C5}) (Version: 1.0.0.565 - Synology)
SyncThru Admin 6.0.2.319 (HKLM\...\SyncThru Admin) (Version: 6.0.2.319 - Samsung Electronics Co., Ltd.)
Synology Assistant (HKLM-x32\...\{C59ADB1C-0403-4A11-8930-9F81ABC71908}) (Version: 1.0.0.0 - Synology Inc.)
Synology Data Replicator  3 (HKLM-x32\...\{8E310838-457C-4269-B177-3EFB300CBDDC}) (Version: 1.0.0.0 - Synology Inc.)
Synology Download Redirector (HKLM-x32\...\{B1E9B7ED-8187-433a-9EAE-20DF1A8968B1}) (Version: 1.0.0.0 - Synology Inc.)
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version:  - )
System Requirements Lab for Intel (HKLM-x32\...\{F7FC9307-374E-4017-8E9D-DE1154780480}) (Version: 4.1.66.0 - Husdawg, LLC)
Tag&Rename 3.8.3 (HKLM-x32\...\Tag&Rename_is1) (Version: 3.8.3 - Softpointer Inc)
TagScanner 5.1.655 (HKLM-x32\...\TagScanner_is1) (Version:  - Sergey Serkov)
Tera Term 4.76 (HKLM-x32\...\Tera Term_is1) (Version:  - )
Tera Term Pro (HKLM-x32\...\Tera Term Pro) (Version:  - )
TerraTec Home Cinema (HKLM-x32\...\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}) (Version: 6.15.11 - )
theRenamer 7.58 (HKLM-x32\...\{55B6344C-AE4F-4DA8-BF32-D7AE0CB4D2BE}_is1) (Version:  - theRenamer)
Tinypic 3.15 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.15 - E. Fiedler)
Total Commander (Remove or Repair) (HKLM-x32\...\Totalcmd) (Version: 7.55 - Ghisler Software GmbH)
TotalPDFConverter (HKLM-x32\...\Total PDF Converter_is1) (Version: 2.8 - Softplicity, Inc.)
Trainingssoftware (HKLM-x32\...\{7C33F907-7A81-48B8-BD2D-D851C5FA9EFC}) (Version: 1.0.0 - IKE Software Solutions)
TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1 - TrueCrypt Foundation)
Ubisoft Game Launcher (HKLM-x32\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
UltraVNC 1.0.8.2 (HKLM\...\Ultravnc2_is1) (Version: 1.0.8.2 - 1.0.8.2)
Uninstall 1.0.0.1 (HKLM-x32\...\Uninstall_is1) (Version:  - )
Unlocker 1.9.0-x64 (HKLM\...\Unlocker) (Version: 1.9.0-x64 - Cedrick Collomb)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002E-0000-0000-0000000FF1CE}_ULTIMATER_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ULTIMATER_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ULTIMATER_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ULTIMATER_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ULTIMATER_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VCRedistSetup (x32 Version: 1.0.0 - Nero AG) Hidden
Versandhelfer (HKLM-x32\...\dpdhl.versandhelfer) (Version: 1.6 - Deutsche Post AG)
Versandhelfer (x32 Version: 1.6 - Deutsche Post AG) Hidden
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 3.1.3.14951 - VMware, Inc)
VMware Player (x32 Version: 3.1.3.14951 - VMware, Inc.) Hidden
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Installer Clean Up (HKLM-x32\...\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}) (Version: 3.00.00.0000 - Microsoft Corporation)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows XP Mode (HKLM\...\{1374CC63-B520-4f3f-98E8-E9020BF01CFF}) (Version: 1.3.7600.16422 - Microsoft Corporation)
Windows-Treiberpaket - Neato Robotics, Inc. (usbser64) Ports  (08/08/2009 1.0.0.0) (HKLM\...\02AF1A75FA8A484C4B36225C5CE9770ECD2C3F04) (Version: 08/08/2009 1.0.0.0 - Neato Robotics, Inc.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{5b55a44a-d008-49aa-9234-86fb7709bc0a}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{8235761D-4AF3-438A-B8E7-AFB83A927572}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\Windows Sidebar\Gadgets\NetGadget64.gadget\NETGAD~1.OCX (SystemGadgets.com)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-2149552335-4145356072-959976354-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Holger\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

13-02-2015 03:00:15 Windows Update
15-02-2015 18:37:34 Driver Booster : Intel(R) ICH9 Family 2 port Serial ATA Storage Controller 2 - 2926
15-02-2015 19:01:07 Windows-Sicherung

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 13:34 - 2013-03-02 20:52 - 00000914 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.94.0.1	client.openvpn.net


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01F93C8D-72DA-4E57-B961-B204BCCA9656} - System32\Tasks\{4D54EC34-A114-47F5-952E-10F0E05BCF9B} => pcalua.exe -a C:\Users\Holger\AppData\Local\Temp\SIT39039.tmp\setup.exe -d C:\Users\Holger\Desktop -c /web /createdtemp /noremove
Task: {1091566D-A4E4-4995-B338-CCD34725840B} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1326FA6F-AEF0-475A-BD26-83428EF7315A} - System32\Tasks\Norton Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\SymErr.exe [2014-12-03] (Symantec Corporation)
Task: {14E71595-B70E-41A3-BCC8-557806C68191} - System32\Tasks\{DDC1BE62-6BE1-4E05-A345-976F16016567} => \\LAN16TB\Qdownload\Software\AR-860\ar860_release_7.exe [2013-10-31] (Microsoft Corporation)
Task: {19555060-9BC6-488E-9FCF-3505C2DE4303} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe
Task: {1A35C5AC-FCDF-4B14-A0CD-4C6430DEF260} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)
Task: {1EFD2C33-571F-49C0-BF65-0D99D16BD107} - System32\Tasks\Norton Security\Norton Error Processor => C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\SymErr.exe [2014-12-03] (Symantec Corporation)
Task: {2241343D-42F7-4E1A-A6A1-AE45B4F0E8B7} - System32\Tasks\{00751C2C-0DE5-4235-8359-A01ADA1506E1} => pcalua.exe -a C:\Users\Holger\Downloads\FTClean\FTClean\FTClean.exe -d C:\Users\Holger\Downloads\FTClean\FTClean
Task: {25E66A45-3C7C-4380-948E-2F963151A51F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {29CE379D-6D8C-4D45-A749-6D094CC6BA2E} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {3A4CF5D8-438A-45AA-A311-F5F360CDD04E} - System32\Tasks\{4651B321-CCC4-4970-8378-F93F9AFFA6A7} => pcalua.exe -a C:\Users\Holger\Downloads\dotnetfx3setup.exe -d C:\Users\Holger\Downloads
Task: {60F27F98-C988-4900-8A80-B53174FC3F9A} - System32\Tasks\Driver Booster SkipUAC (Holger) => D:\Program Files (x86)\IObit\Driver Booster\DriverBooster.exe
Task: {66320C1B-F4C4-43C2-8E69-3560AE031B7F} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-01-29] (Microsoft Corporation)
Task: {712C6861-2B14-4E72-92BA-22B6921FE2B7} - System32\Tasks\Microsoft\Windows\Wired\GatherWiredInfo => C:\Windows\system32\gatherWiredInfo.vbs
Task: {773BEDA6-C413-472C-83DE-8B2ECFAA5841} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {8A622EE7-C862-4228-B29A-41297518F34F} - System32\Tasks\Paragon Archive name arc_200109222223769 => G:\Program Files (x86)\Paragon Hard Disk Manager\program\scripts.exe [2008-02-14] ()
Task: {8A7B74F6-81F3-4A1A-850E-CF707CFBF6D7} - System32\Tasks\{4656EB54-7DAF-4357-8EE8-713BC2D315B2} => pcalua.exe -a C:\NVIDIA\DisplayDriver\197.45\WinVista_Win7_64\International\setup.exe -d C:\NVIDIA\DisplayDriver\197.45\WinVista_Win7_64\International
Task: {8B07DE4F-6A77-4E53-9015-0A13C293BE27} - System32\Tasks\{55B1856F-FB6C-4B5C-9041-8BFE0BBF347C} => pcalua.exe -a C:\Users\Holger\Downloads\Data_Replicator_0142\install\Setup.exe -d C:\Users\Holger\Downloads\Data_Replicator_0142\install
Task: {9AECA740-CCE5-42A4-A8C3-3D0B8A77595F} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-01-29] (Microsoft Corporation)
Task: {9D79E829-BC19-4C6F-905D-49CE821E1AE6} - System32\Tasks\CCleanerSkipUAC => G:\Program Files (x86)\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {A64118A4-86B1-44A8-A4F9-50773F0A5934} - System32\Tasks\{9D7A00A4-9EA3-473E-98B9-2E43F8A8AE39} => pcalua.exe -a "C:\Program Files (x86)\InstallShield Installation Information\{579BA58C-F33D-4970-9953-B94B43768AC3}\setup.exe" -c -runfromtemp -l0x0007 -removeonly
Task: {B989BDDD-24E8-47A5-A441-911C0A96D24F} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.6.0.32\SymErr.exe
Task: {BEDAFA69-B89A-4FCD-AE9C-3FEB3CD707B3} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Security\Engine\22.1.0.9\WSCStub.exe [2014-12-10] (Symantec Corporation)
Task: {D256AC05-87E7-4042-AB83-B5BEBB1514F5} - System32\Tasks\Uninstaller_SkipUac_Holger => C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Task: {D99A0E12-1CED-42F2-B162-882C8021A86A} - System32\Tasks\{D0F106D5-7AE5-4C86-B881-DB7FD3469858} => pcalua.exe -a H:\Downloads\Graupner\REFLEX_SETUP_V5042DE.exe -d H:\Downloads\Graupner
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs
Task: {FAF6E5EE-5005-409E-867E-D38D4431DCB1} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-01-29] (Microsoft)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\Paragon Archive name arc_200109222223769.job => G:\Program Files (x86)\Paragon Hard Disk Manager\program\scripts.exe

==================== Loaded Modules (whitelisted) ==============

2013-10-12 10:39 - 2015-02-05 20:07 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-02-25 17:56 - 2013-12-03 21:51 - 00036680 _____ () C:\Windows\System32\dirport64.dll
2013-02-22 17:51 - 2012-01-10 05:15 - 00034304 _____ () C:\Windows\System32\ssy3clm.dll
2013-10-07 15:54 - 2013-10-07 15:54 - 00218112 _____ () G:\Program Files (x86)\GNU\GnuPG\dirmngr.exe
2014-05-01 20:29 - 2014-05-01 20:29 - 00098304 _____ () G:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2010-04-30 00:40 - 2010-04-30 00:40 - 00013312 _____ () G:\Program Files\Unlocker\UnlockerCOM.dll
2010-03-24 17:29 - 2010-03-24 17:29 - 00404480 _____ () G:\Program Files (x86)\Synology Data Replicator  3\SynoDrServicex64.exe
2008-12-25 23:40 - 2006-12-29 06:37 - 00200704 ____R () C:\Windows\SysWOW64\UMonit.exe
2012-03-09 08:58 - 2012-03-09 08:58 - 00462712 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe
2012-03-09 08:58 - 2012-03-09 08:58 - 00057208 _____ () C:\Program Files\Common Files\Common Desktop Agent\CDASrvPS.dll
2013-02-25 17:50 - 2013-12-03 21:50 - 00712520 _____ () G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecodmssinglesignon.exe
2015-01-27 13:18 - 2015-01-27 13:18 - 02926800 _____ () G:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
2015-01-21 03:06 - 2015-01-21 03:06 - 00057344 _____ () G:\Program Files (x86)\CCleaner\lang\lang-1031.dll
2013-02-22 17:51 - 2013-05-30 11:52 - 01371648 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\ssy3cdu.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-12-16 15:38 - 2007-05-31 07:38 - 00167936 ____N () C:\Windows\SysWOW64\SerialXP.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00221184 _____ () G:\Program Files (x86)\GNU\GnuPG\libksba-8.dll
2013-10-07 15:47 - 2013-10-07 15:47 - 00037888 _____ () G:\Program Files (x86)\GNU\GnuPG\libgpg-error-0.dll
2013-10-07 15:44 - 2013-10-07 15:44 - 00050176 _____ () G:\Program Files (x86)\GNU\GnuPG\libw32pth-0.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00069632 _____ () G:\Program Files (x86)\GNU\GnuPG\libassuan-0.dll
2013-10-07 15:49 - 2013-10-07 15:49 - 00628224 _____ () G:\Program Files (x86)\GNU\GnuPG\libgcrypt-11.dll
2014-09-06 17:44 - 2014-09-06 17:44 - 00035328 _____ () G:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00091648 _____ () G:\Program Files (x86)\FileZilla FTP Client\libgcc_s_sjlj-1.dll
2014-05-24 17:41 - 2014-05-24 17:41 - 00892416 _____ () G:\Program Files (x86)\FileZilla FTP Client\libstdc++-6.dll
2012-08-31 10:13 - 2012-08-31 10:13 - 00172032 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\LIBPQ.dll
2012-08-31 10:13 - 2012-08-31 10:13 - 00976384 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\libxml2.dll
2012-08-31 10:13 - 2012-08-31 10:13 - 00059904 _____ () G:\Program Files (x86)\Samsung Network Printer Utilities\SyncThru Admin 6\UniThruTargetPlatform\PostgreSQL\engine\bin\zlib1.dll
2010-11-11 13:31 - 2010-11-11 13:31 - 00970352 _____ () G:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2010-11-11 13:31 - 2010-11-11 13:31 - 00068720 _____ () G:\Program Files (x86)\VMware\VMware Player\zlib1.dll
2008-12-25 23:40 - 2006-06-07 12:17 - 00151552 ____R () C:\Windows\SysWOW64\ustor.dll
2010-06-11 09:56 - 2010-06-11 09:56 - 00029576 _____ () G:\Program Files (x86)\STAMPIT\Binary\SDSERROR.DLL
2010-06-11 09:56 - 2010-06-11 09:56 - 00087432 _____ () G:\Program Files (x86)\STAMPIT\Binary\SDSEVENT.DLL
2011-06-17 11:46 - 2011-06-17 11:46 - 02408448 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2011-06-17 11:46 - 2011-06-17 11:46 - 08626176 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2011-06-17 11:46 - 2011-06-17 11:46 - 00212992 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2013-02-25 17:50 - 2013-12-03 21:50 - 00076616 _____ () G:\Program Files (x86)\applord GmbH\ecoDMS - Client\classifyclient.dll
2013-02-25 17:50 - 2013-12-03 21:50 - 00065352 _____ () G:\Program Files (x86)\applord GmbH\ecoDMS - Client\ecoarchiveclient.dll
2012-04-10 15:42 - 2011-08-24 03:39 - 00081920 _____ () G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\koan\_ctypes.pyd
2012-04-10 15:42 - 2011-08-24 03:39 - 00053248 _____ () G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\Koan\_socket.pyd
2012-04-10 15:42 - 2011-08-24 03:39 - 00655360 _____ () G:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12\Common\Koan\_ssl.pyd
2009-08-18 11:02 - 2009-08-18 11:02 - 00061952 _____ () G:\Program Files (x86)\BOINC\zlib1.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:A303874F
AlternateDataStreams: C:\Users\Public\.DS_Store:AFP_AfpInfo

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-2149552335-4145356072-959976354-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Holger\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: IGDCTRL => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Launch LAN USB Utility.exe.lnk => C:\Windows\pss\Launch LAN USB Utility.exe.lnk.CommonStartup
MSCONFIG\startupreg: LAN USB Utility => "C:\Program Files (x86)\Sharkoon\LAN USB Utility\LAN USB Utility.exe" /h
MSCONFIG\startupreg: MyKey => G:\Program Files (x86)\CHIPDRIVE\CHIPDRIVE MyKey\MyKey\MyKey.exe

==================== Accounts: =============================

Administrator (S-1-5-21-2149552335-4145356072-959976354-500 - Administrator - Enabled) => C:\Users\Administrator
ASPNET (S-1-5-21-2149552335-4145356072-959976354-1002 - Limited - Enabled)
Gast (S-1-5-21-2149552335-4145356072-959976354-501 - Limited - Enabled)
Holger (S-1-5-21-2149552335-4145356072-959976354-1000 - Administrator - Enabled) => C:\Users\Holger
HomeGroupUser$ (S-1-5-21-2149552335-4145356072-959976354-1021 - Limited - Enabled)
Test (S-1-5-21-2149552335-4145356072-959976354-1009 - Limited - Enabled)
__vmware_user__ (S-1-5-21-2149552335-4145356072-959976354-1013 - Limited - Enabled)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2015 10:44:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/16/2015 10:43:37 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (02/16/2015 10:43:37 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (02/16/2015 10:43:37 AM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (02/16/2015 10:40:44 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/16/2015 10:40:44 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/16/2015 10:40:44 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/16/2015 10:40:44 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/16/2015 10:40:44 AM) (Source: PostgreSQL) (EventID: 0) (User: )
Description: FATAL:  terminating connection due to administrator command

Error: (02/15/2015 07:22:30 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (02/16/2015 10:46:48 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst ShellHWDetection erreicht.

Error: (02/16/2015 10:46:00 AM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/16/2015 10:46:00 AM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/16/2015 10:46:00 AM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/16/2015 10:45:59 AM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422

Error: (02/16/2015 10:44:34 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "StarMoney 9.0 OnlineUpdate" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/16/2015 10:44:34 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "SyncThru 6.0 management application" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/16/2015 10:44:10 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (02/16/2015 10:35:27 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Advanced SystemCare Service 8" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (02/15/2015 07:26:13 PM) (Source: WMPNetworkSvc) (EventID: 14338) (User: )
Description: 0x80070422


Microsoft Office Sessions:
=========================
Error: (07/05/2011 07:11:54 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6557.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 45 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (01/03/2010 05:04:45 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6514.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4562 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2015-02-16 10:42:47.062
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-16 10:40:33.039
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-16 10:34:49.963
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-15 19:19:43.831
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-15 18:01:23.750
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 19:49:14.870
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 12:54:24.831
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 12:38:39.963
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 12:10:53.820
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 03:19:16.406
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Windows\System32\hmpalert.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM)2 Quad CPU Q9300 @ 2.50GHz
Percentage of memory in use: 71%
Total physical RAM: 4094.49 MB
Available physical RAM: 1162.2 MB
Total Pagefile: 12281.66 MB
Available Pagefile: 9187.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Windows7) (Fixed) (Total:194.22 GB) (Free:32.32 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (BOOT) (Fixed) (Total:74.53 GB) (Free:35.46 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Data XP) (Fixed) (Total:298.68 GB) (Free:81.98 GB) NTFS
Drive g: (DataWindows7) (Fixed) (Total:63.47 GB) (Free:33.8 GB) NTFS
Drive h: (Temporary2) (Fixed) (Total:673.82 GB) (Free:611.83 GB) NTFS
Drive i: (Disc) (CDROM) (Total:4.1 GB) (Free:0 GB) UDF
Drive k: (HBCD 15_2) (Removable) (Total:7.47 GB) (Free:6.89 GB) FAT32
Drive l: (Temporary1) (Fixed) (Total:558.3 GB) (Free:546.64 GB) NTFS
Drive s: () (Network) (Total:1830.83 GB) (Free:1029.89 GB) 
Drive t: () (Network) (Total:1830.83 GB) (Free:420.13 GB) 
Drive w: () (Network) (Total:19223.53 GB) (Free:6428.57 GB) 
Drive x: () (Network) (Total:12927.97 GB) (Free:2353.64 GB) 
Drive y: () (Network) (Total:12927.97 GB) (Free:2353.64 GB) 
Drive z: () (Network) (Total:12927.97 GB) (Free:2353.64 GB) 

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 853C4862)
Partition 1: (Active) - (Size=194.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=63.5 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=673.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: FAB30BFC)
Partition 1: (Active) - (Size=74.5 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=298.7 GB) - (Type=05)
Partition 3: (Not Active) - (Size=558.3 GB) - (Type=07 NTFS)

========================================================
Disk: 6 (Size: 7.5 GB) (Disk ID: 00A6C339)
Partition 1: (Active) - (Size=7.5 GB) - (Type=0C)

==================== End Of Log ============================
         

Gruß

Holger

Bestehen jetzt aktuell noch Probleme mit dem System?