Sehr langes Laden von Webseiten und sehr hoher Ping

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:08 on 13/02/2015 (Alex)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-02-2015
Ran by Alex (administrator) on ALEX-PC on 13-02-2015 22:00:00
Running from C:\Users\Alex\Downloads
Loaded Profiles: Alex (Available profiles: Alex)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Advanced Micro Devices) C:\Program Files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
() C:\Windows\System32\PnkBstrA.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Program Files (x86)\SPEEDLINK\VIRTUIS Advanced Gaming Keyboard\Monitor.EXE
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Mindjet) C:\Program Files (x86)\Mindjet\MindManager 15\MmReminderService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\MOM.exe
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
(ATI Technologies Inc.) C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\CCC.exe
() C:\Program Files (x86)\SPEEDLINK\VIRTUIS Advanced Gaming Keyboard\OSD.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe
(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe
(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3Di SBX Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [976896 2012-11-28] (Creative Technology Ltd)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM-x32\...\Run: [SL-6481 Gaming Keyboard] => C:\Program Files (x86)\SPEEDLINK\VIRTUIS Advanced Gaming Keyboard\Monitor.exe [1976832 2013-09-30] ()
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [MMReminderService] => C:\Program Files (x86)\Mindjet\MindManager 15\MMReminderService.exe [115552 2014-09-04] (Mindjet)
HKLM-x32\...\Run: [Raptr] => C:\Program Files (x86)\Raptr\raptrstub.exe [55568 2015-01-30] (Raptr, Inc)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\AMD\ATI.ACE\Core-Static\amd64\CLIStart.exe [767176 2014-11-20] (Advanced Micro Devices, Inc.)
HKU\S-1-5-21-672128-2782778396-1146651854-1000\...\Run: [EADM] => C:\Program Files (x86)\Origin\Origin.exe [3619160 2015-01-28] (Electronic Arts)
HKU\S-1-5-21-672128-2782778396-1146651854-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [30877280 2014-12-11] (Skype Technologies S.A.)
HKU\S-1-5-21-672128-2782778396-1146651854-1000\...\Run: [GoogleChromeAutoLaunch_AD2529C7DB5B63D28C23362385276129] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [843592 2015-02-04] (Google Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{401FADAA-1C16-4721-9F02-19067E1A1CA8}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-672128-2782778396-1146651854-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-672128-2782778396-1146651854-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: CmjBrowserHelperObject Object -> {6FE6A929-59D1-4763-91AD-29B61CFFB35B} -> C:\Program Files (x86)\Mindjet\MindManager 15\Mm8InternetExplorer.dll (Mindjet)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\elcasej8.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll ()
FF Plugin: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelogx64.dll No File
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll (EA Digital Illusions CE AB)
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn/npbattlelog,version=2.5.0 -> C:\Program Files (x86)\Battlelog Web Plugins\2.5.0\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com ()
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Alex\AppData\Roaming\Mozilla\Firefox\Profiles\elcasej8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-08-08]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Ngăn chặn trang web nguy hiểm - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Bàn phím ảo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Công cụ kiểm tra liên kết của Kaspersky - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Chặn quảng cáo - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-08-24]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: An toàn giao dịch tài chính - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-08-24]

Chrome: 
=======
CHR HomePage: Default -> hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=48&cc=&mi=781df08b000000000000f6b7e2ed8655
CHR StartupUrls: Default -> "https://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}{google:prefetchQuery}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-08]
CHR Extension: (Google Drive) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-08]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-03]
CHR Extension: (IPFuck) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjgmbpodpcgmnpfjmigcckcjfldcicnd [2014-10-04]
CHR Extension: (YouTube) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-08-08]
CHR Extension: (Google-Suche) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-08-08]
CHR Extension: (Kaspersky Protection) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2014-08-24]
CHR Extension: (AdBlock) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-08-08]
CHR Extension: (Google Wallet) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-08]
CHR Extension: (Google Mail) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-08-08]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpusrsvc; C:\Program Files\AMD\{920DEC42-4CA5-4d1d-9487-67BE645CDDFC}\amdacpusrsvc.exe [116224 2014-11-20] (Advanced Micro Devices) [File not signed]
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64624 2014-06-12] (CyberGhost S.R.L)
S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-08-02] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-08-02] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [423424 2012-10-08] (Creative Technology Ltd) [File not signed]
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [103936 2013-08-20] (Creative Technology Ltd)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-20] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1910128 2015-01-28] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2014-09-08] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75136 2014-09-02] ()
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [343040 2013-08-08] (Qualcomm Atheros) [File not signed]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 amdacpksd; C:\Windows\system32\drivers\amdacpksd.sys [294600 2014-11-21] (Advanced Micro Devices)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 ATITool; C:\Windows\System32\DRIVERS\ATITool64.sys [30720 2006-11-10] () [File not signed]
R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [67888 2013-02-13] (Qualcomm Atheros, Inc.)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1049880 2013-08-20] (Creative Technology Ltd)
R3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [154320 2013-03-20] (Qualcomm Atheros, Inc.)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [141320 2014-10-08] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [793800 2014-10-08] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55904 2014-03-25] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
S3 RTCore64; C:\Program Files (x86)\MSI Afterburner\RTCore64.sys [13368 2013-03-11] ()
R0 TPkd; C:\Windows\SysWow64\Drivers\TPkd.sys [93336 2012-05-16] (PACE Anti-Piracy, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 gdrv; \??\C:\Windows\gdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-13 21:58 - 2015-02-13 21:58 - 00000470 _____ () C:\Users\Alex\Desktop\defogger_disable.log
2015-02-13 21:58 - 2015-02-13 21:58 - 00000000 _____ () C:\Users\Alex\defogger_reenable
2015-02-13 21:57 - 2015-02-13 21:57 - 00050477 _____ () C:\Users\Alex\Downloads\Defogger.exe
2015-02-13 21:57 - 2015-02-13 21:57 - 00050477 _____ () C:\Users\Alex\Desktop\Defogger.exe
2015-02-13 21:44 - 2015-02-13 21:44 - 00028193 _____ () C:\ComboFix.txt
2015-02-13 21:37 - 2015-02-13 21:44 - 00000000 ____D () C:\Windows\erdnt
2015-02-13 21:32 - 2015-02-13 21:32 - 05611771 _____ (Swearware) C:\Users\Alex\Downloads\ComboFix.exe
2015-02-13 21:26 - 2015-02-13 21:26 - 00852594 _____ () C:\Users\Alex\Downloads\SecurityCheck.exe
2015-02-13 21:26 - 2015-02-13 21:26 - 00852594 _____ () C:\Users\Alex\Desktop\SecurityCheck.exe
2015-02-13 18:08 - 2015-02-13 18:08 - 02347384 _____ (ESET) C:\Users\Alex\Downloads\esetsmartinstaller_deu.exe
2015-02-13 18:04 - 2015-02-13 18:04 - 00001299 _____ () C:\Users\Alex\Desktop\JRT.txt
2015-02-13 18:00 - 2015-02-13 17:51 - 01388274 _____ (Thisisu) C:\Users\Alex\Desktop\JRT.exe
2015-02-13 17:51 - 2015-02-13 17:51 - 01388274 _____ (Thisisu) C:\Users\Alex\Downloads\JRT.exe
2015-02-13 17:51 - 2015-02-13 17:51 - 00034764 _____ () C:\Users\Alex\Downloads\Addition.txt
2015-02-13 17:50 - 2015-02-13 22:00 - 00024064 _____ () C:\Users\Alex\Downloads\FRST.txt
2015-02-13 17:50 - 2015-02-13 22:00 - 00000000 ____D () C:\FRST
2015-02-13 17:50 - 2015-02-13 17:50 - 02134016 _____ (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2015-02-13 17:50 - 2015-02-13 17:50 - 02112512 _____ () C:\Users\Alex\Downloads\AdwCleaner_4.110.exe
2015-02-13 16:30 - 2015-02-13 16:33 - 00000000 ____D () C:\Users\Alex\Desktop\Skifahren
2015-02-12 18:00 - 2015-02-12 18:17 - 650514432 _____ () C:\Users\Alex\Downloads\rescue-system.iso
2015-02-12 18:00 - 2015-02-12 18:01 - 04831232 _____ (Geza Kovacs) C:\Users\Alex\Downloads\unetbootin-windows-608.exe
2015-02-12 15:47 - 2015-02-13 21:51 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-12 15:47 - 2015-02-12 15:47 - 00001098 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-02-12 15:47 - 2015-02-12 15:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-02-12 15:47 - 2015-02-12 15:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-02-12 15:47 - 2015-02-12 15:47 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-02-12 15:47 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-02-12 15:47 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-02-12 15:47 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-02-12 15:45 - 2015-02-12 15:47 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-2.0.4.1028.exe
2015-02-12 15:33 - 2015-02-12 15:33 - 00000000 ____D () C:\ProgramData\Licenses
2015-02-12 15:30 - 2015-02-12 15:30 - 01203488 _____ () C:\Users\Alex\Downloads\Trojan Remover - CHIP-Installer.exe
2015-02-12 15:24 - 2015-02-12 15:24 - 00003120 _____ () C:\Windows\System32\Tasks\{6D70DA78-9595-40AB-B44E-643C3762B95A}
2015-02-12 15:16 - 2015-02-12 15:24 - 00015544 _____ () C:\Users\Alex\Downloads\hijackthis.log
2015-02-12 15:16 - 2015-02-12 15:16 - 00388608 _____ (Trend Micro Inc.) C:\Users\Alex\Downloads\HijackThis.exe
2015-02-12 14:45 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-02-12 14:45 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 14:45 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-02-12 14:45 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 19:14 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 19:14 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 19:14 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 19:14 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-02-11 19:14 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-02-11 19:14 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-02-11 19:14 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 19:14 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 19:14 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-02-11 19:14 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 19:14 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-02-11 19:14 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-02-11 19:14 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-02-11 19:14 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-02-11 19:14 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-02-11 19:14 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 19:14 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-02-11 19:14 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-02-11 19:14 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 19:14 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-02-11 19:14 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 19:14 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-02-11 19:14 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 19:14 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-02-11 19:14 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-02-11 19:14 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 19:14 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-02-11 19:14 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 19:14 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-02-11 19:14 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-02-11 19:14 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-02-11 19:14 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-02-11 19:14 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 19:14 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 19:14 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 19:14 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-02-11 19:14 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 19:14 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 19:14 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-02-11 19:14 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-02-11 19:14 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-02-11 19:14 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-02-11 19:14 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 19:14 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 19:14 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 19:14 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-02-11 19:14 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 19:14 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 19:14 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 19:14 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 19:14 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 19:14 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 19:13 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-02-11 19:13 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-02-11 19:13 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-02-11 19:13 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-02-11 19:13 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-02-11 19:13 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-02-11 19:13 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-02-11 19:13 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe
2015-02-11 19:13 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-02-11 19:13 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 19:13 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-02-11 19:13 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-02-11 19:13 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-02-11 19:13 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-02-11 19:13 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-02-11 19:13 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-02-11 19:13 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-02-11 19:13 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 19:13 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-02-11 19:13 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-02-11 19:13 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-02-11 19:13 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-02-11 19:05 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 19:05 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-02-11 19:05 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-02-11 19:05 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-02-11 19:05 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-02-11 19:05 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-02-11 19:05 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-02-11 19:05 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-02-11 19:05 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-02-11 19:05 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-02-11 19:05 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-02-11 19:05 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-02-11 19:05 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-02-11 19:05 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-02-11 19:05 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-02-11 19:05 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-02-11 19:05 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-02-11 19:05 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 19:05 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 19:05 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-02-11 19:05 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-02-11 19:05 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-02-11 19:05 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-02-11 19:05 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-02-11 19:05 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-02-11 19:05 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 19:05 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 19:05 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-02-11 19:05 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-02-11 19:05 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 19:05 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 19:05 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 19:05 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 19:05 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 19:05 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 19:05 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-02-11 19:05 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-02-11 19:05 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-02-11 19:05 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-02-11 19:05 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-02-11 19:03 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-08 13:24 - 2015-02-08 13:24 - 00583627 _____ () C:\Users\Alex\Downloads\Traincraft Mod Installer.zip
2015-02-08 13:19 - 2015-02-08 13:20 - 21752193 _____ () C:\Users\Alex\Downloads\traincraft-4.2.1_011.jar
2015-02-07 17:02 - 2015-02-07 17:02 - 01676703 _____ () C:\Users\Alex\Downloads\Railcraft_1.4.7-6.15.2.0.zip
2015-01-31 21:30 - 2015-01-31 22:03 - 1302669836 _____ () C:\Users\Alex\Downloads\Tiger Records Pres. Biggest Drops Ever - Various Artists.zip
2015-01-27 21:32 - 2015-01-27 21:32 - 00000222 _____ () C:\Users\Alex\Desktop\Unturned.url
2015-01-27 18:50 - 2015-01-27 18:51 - 00000000 ____D () C:\Users\Alex\Desktop\The Music of League
2015-01-27 18:38 - 2015-01-27 18:42 - 136020676 _____ () C:\Users\Alex\Downloads\The_Music_of_League_of_Legends_Volume_1.zip
2015-01-24 12:41 - 2015-01-24 12:42 - 01328724 _____ () C:\Users\Alex\Downloads\Mix Lab V3.1.zip
2015-01-18 14:50 - 2015-01-18 14:50 - 00004826 _____ () C:\Users\Alex\Downloads\Einverständniserklärung zur Zimmerteilung bei der Skifreizeit (1).odt
2015-01-18 14:50 - 2015-01-18 14:50 - 00004826 _____ () C:\Users\Alex\Downloads\Einverständniserklärung zur Zimmerteilung bei der Skifreizeit (1) (1).odt
2015-01-18 14:37 - 2015-01-18 14:37 - 00004826 _____ () C:\Users\Alex\Downloads\Einverständniserklärung zur Zimmerteilung bei der Skifreizeit.odt
2015-01-18 12:58 - 2015-01-18 12:58 - 00000000 ____D () C:\Users\Alex\AppData\Local\Serato
2015-01-14 16:28 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 16:28 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 16:28 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 16:28 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 16:28 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 16:28 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-13 21:58 - 2014-08-02 12:39 - 00000000 ____D () C:\Users\Alex
2015-02-13 21:57 - 2011-04-12 08:43 - 00699416 _____ () C:\Windows\system32\perfh007.dat
2015-02-13 21:57 - 2011-04-12 08:43 - 00149556 _____ () C:\Windows\system32\perfc007.dat
2015-02-13 21:57 - 2009-07-14 06:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-13 21:57 - 2009-07-14 05:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-02-13 21:57 - 2009-07-14 05:45 - 00028912 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-02-13 21:54 - 2014-08-02 12:39 - 01267000 _____ () C:\Windows\WindowsUpdate.log
2015-02-13 21:52 - 2014-11-26 18:40 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Raptr
2015-02-13 21:52 - 2014-08-17 11:34 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Skype
2015-02-13 21:52 - 2014-08-08 20:14 - 00000000 ____D () C:\ProgramData\Origin
2015-02-13 21:51 - 2014-08-24 12:35 - 00000000 ____D () C:\ProgramData\Kaspersky Lab
2015-02-13 21:51 - 2014-08-08 19:09 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-13 21:51 - 2014-08-02 13:33 - 00071136 _____ () C:\Windows\PFRO.log
2015-02-13 21:51 - 2014-08-02 13:33 - 00030560 _____ () C:\Windows\setupact.log
2015-02-13 21:51 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-02-13 21:50 - 2014-08-23 15:12 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2015-02-13 21:44 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default
2015-02-13 21:43 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini
2015-02-13 21:42 - 2014-08-02 13:33 - 00000000 ____D () C:\ProgramData\TEMP
2015-02-13 21:40 - 2014-08-08 19:33 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-13 21:33 - 2014-08-08 19:09 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-13 17:57 - 2014-08-02 13:32 - 00000000 ____D () C:\AdwCleaner
2015-02-13 15:25 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-13 14:53 - 2014-08-08 20:14 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-02-12 15:16 - 2014-08-02 12:39 - 00000000 ____D () C:\Users\Alex\AppData\Local\VirtualStore
2015-02-12 14:51 - 2014-08-17 20:43 - 00215416 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2015-02-12 14:51 - 2014-08-17 20:43 - 00215416 _____ () C:\Windows\SysWOW64\PnkBstrB.ex0
2015-02-12 14:15 - 2009-07-14 05:45 - 00342616 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-02-12 14:14 - 2014-12-13 14:05 - 00000000 ____D () C:\Windows\system32\appraiser
2015-02-12 14:14 - 2014-08-08 19:06 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-02-11 21:15 - 2014-08-30 16:48 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-11 21:15 - 2014-08-02 13:07 - 00000000 ____D () C:\ProgramData\Package Cache
2015-02-11 21:14 - 2014-09-01 21:36 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-11 21:13 - 2014-09-01 21:36 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 19:12 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-11 19:10 - 2014-08-08 20:17 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2015-02-08 13:15 - 2014-08-27 19:52 - 04620432 _____ () C:\Users\Alex\Desktop\TechnicLauncher.exe
2015-02-08 13:15 - 2014-08-27 19:52 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\.technic
2015-02-08 13:14 - 2009-07-14 06:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-02-07 20:28 - 2014-08-08 19:09 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-07 20:28 - 2014-08-08 19:09 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-07 16:40 - 2014-08-08 19:33 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-02-07 16:40 - 2014-08-08 19:33 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-02-07 16:40 - 2014-08-08 19:33 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-07 15:13 - 2014-08-08 19:10 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-02-07 15:12 - 2014-08-18 18:03 - 00000000 ____D () C:\Program Files (x86)\Raptr
2015-01-31 23:14 - 2014-12-23 16:53 - 00000000 ____D () C:\Users\Alex\Desktop\handy
2015-01-31 14:08 - 2014-08-02 12:49 - 01593956 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-01-30 20:04 - 2014-10-15 16:53 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-01-29 21:47 - 2014-08-09 12:26 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\TS3Client
2015-01-27 21:32 - 2014-10-30 16:06 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2015-01-19 19:31 - 2015-01-09 22:25 - 00000000 ____D () C:\Users\Alex\AppData\Local\Battle.net
2015-01-19 16:52 - 2014-08-27 19:51 - 00000000 ____D () C:\Users\Alex\AppData\Roaming\.minecraft

==================== Files in the root of some directories =======

2014-08-02 12:50 - 2014-08-02 12:50 - 0000000 _____ () C:\Users\Alex\AppData\Local\Driver_LOM_8161Present.flag
2014-10-12 21:29 - 2014-10-12 21:29 - 0000000 _____ () C:\Users\Alex\AppData\Local\{CE9D43AC-8F0B-4F97-A2AA-92DEE0969697}

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-13 15:18

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-02-2015
Ran by Alex at 2015-02-13 22:00:10
Running from C:\Users\Alex\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Kaspersky Internet Security (Disabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Disabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Disabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

ACP Application (Version: 2.15.10.0003 - Advanced Micro Devices, Inc.) Hidden
Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{F2A7CE36-57BF-5C86-952D-90DBF3746D82}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASIO4ALL (HKLM-x32\...\ASIO4ALL) (Version: 2.10 - Michael Tippach)
Assassin's Creed IV Black Flag (HKLM-x32\...\Uplay Install 273) (Version:  - Ubisoft)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.4.2.23831 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.6.2 - EA Digital Illusions CE AB)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands: The Pre-Sequel (HKLM-x32\...\Steam App 261640) (Version:  - 2K Australia)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version:  - Ubisoft)
Farming Simulator 15 (HKLM-x32\...\Steam App 313160) (Version:  - Giants Software)
FL Studio 11 (HKLM-x32\...\FL Studio 11) (Version:  - Image-Line)
FlowStone FL 3.0 (HKLM-x32\...\FlowStone) (Version:  - )
Fraps (HKLM-x32\...\Fraps) (Version:  - )
GIANTS Editor 6.0.2 64-bit (HKLM-x32\...\giants_editor_6.0.2_win64_is1) (Version: 6.0.2 - GIANTS Software GmbH)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
IL Download Manager (HKLM-x32\...\IL Download Manager) (Version:  - Image-Line)
IL Shared Libraries (HKLM-x32\...\IL Shared Libraries) (Version:  - Image-Line)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
League of Legends (HKLM-x32\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (x32 Version: 3.0.1 - Riot Games ) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mindjet MindManager 15 (HKLM-x32\...\{EF825A4F-DB90-4942-AF8E-3859BEE4B28D}) (Version: 15.0.160 - Mindjet)
MotioninJoy Gamepad tool 0.7.1001 (HKLM\...\{330DAC67-5B62-452A-A0E4-6B4A5923940F}_is1) (Version: 0.7.1001 - www.motioninjoy.com)
Mozilla Firefox 33.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 de)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.0 - Mozilla)
MSI Afterburner 4.0.0 (HKLM-x32\...\Afterburner) (Version: 4.0.0 - MSI Co., LTD)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
Origin (HKLM-x32\...\Origin) (Version: 9.4.20.386 - Electronic Arts, Inc.)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.991 - Even Balance, Inc.)
Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.0.30.1259 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer E220x Drivers (Version: 1.0.30.1259 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer Network Manager Suite (HKLM-x32\...\{FE5DFB80-6937-4154-A2C7-EF845C1301F8}) (Version: 1.0.30.1259 - Qualcomm Atheros)
Qualcomm Atheros Network Manager (Version: 1.0.30.1259 - Qualcomm Atheros) Hidden
Raptr (HKLM-x32\...\Raptr) (Version:  - )
reFX Nexus VSTi RTAS v2.2.0 (HKLM-x32\...\reFX Nexus_is1) (Version:  - )
RivaTuner Statistics Server 6.2.0 (HKLM-x32\...\RTSS) (Version: 6.2.0 - Unwinder)
Ryse: Son of Rome (HKLM-x32\...\Steam App 302510) (Version:  - Crytek)
Secure Download Manager (HKLM-x32\...\{C58626D6-7EBD-460D-8B6C-75B3C3464879}) (Version: 3.1.60 - Kivuto Solutions Inc.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
SONiVOX Twist 2 (HKLM-x32\...\SONiVOX Twist 2_is1) (Version:  - )
Sound Blaster Recon3Di (HKLM-x32\...\{918F3CE9-7164-4C6D-9530-66F12EFB4585}) (Version: 1.03.00 - Creative Technology Limited)
Sound Blaster Recon3Di Extras (HKLM-x32\...\{536BDBFC-CA1A-4AC0-A8EB-BB2D0F1F522E}) (Version: 1.0 - Creative Technology Limited)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM-x32\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
UninstallTpkdx64 (HKLM\...\Tpkdx64_is1) (Version:  - )
Unturned (HKLM-x32\...\Steam App 304930) (Version:  - Nelson Sexton)
Uplay (HKLM-x32\...\Uplay) (Version: 4.8 - Ubisoft)
VirtualDJ 8 (HKLM-x32\...\{85E12659-D3A1-4583-BA1C-95DF53C3C632}) (Version: 8.0.2087.0 - Atomix Productions)
VIRTUIS ADVANCED Gaming Keyboard Driver (HKLM-x32\...\{B3CDED64-7DC2-429D-A325-BBC3CF793AA6}) (Version: 1.0 - SPEEDLINK)
WinRAR 5.10 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)
Xpand!2 (HKLM-x32\...\{b3ae0823-4fb9-4eae-950c-acfda09bb938}) (Version: 2.2.1.18725 - AIR Music Tech GmbH)
Xpand!2 Authorizer (x32 Version: 2.2.1.18725 - AIR Music Tech GmbH) Hidden
Xpand!2 Content (x32 Version: 2.2.1.18725 - AIR Music Tech GmbH) Hidden
Xpand!2 Factory Content (x32 Version: 2.2.1.18725 - AIR Music Tech GmbH) Hidden
Xpand!2 VST 32 (x32 Version: 2.2.1.18725 - AIR Music Tech GmbH) Hidden
Xpand!2 VST 64 (x32 Version: 2.0.3.18725 - AIR Music Tech GmbH) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-672128-2782778396-1146651854-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points  =========================

13-02-2015 21:45:54 ComboFix created restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2015-02-13 21:43 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {36E0726F-9458-485F-95F7-07E02FB0B6E6} - System32\Tasks\{6D70DA78-9595-40AB-B44E-643C3762B95A} => pcalua.exe -a C:\Users\Alex\Downloads\HijackThis.exe -d C:\Users\Alex\Downloads
Task: {3FBDDB1B-08B1-4536-8E54-111A1055B507} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4221FB4C-52A9-439B-9368-B82D2AFAE14E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-08] (Google Inc.)
Task: {4C905AE4-109D-4F66-A47D-5433BF65B320} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {5054B470-04C9-40E2-9DA5-0D8C0AE303B4} - System32\Tasks\{CA78F62D-393B-4F47-A732-1FECF7407A42} => pcalua.exe -a C:\Users\Alex\AppData\Roaming\webssearches\UninstallManager.exe -c  -ptid=tugs <==== ATTENTION
Task: {73D94C6D-AB45-4362-8E0B-6CD9C7D6825A} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-08-08] (Google Inc.)
Task: {86303472-2AE2-44B5-8532-0993B2E84129} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-07] (Adobe Systems Incorporated)
Task: {FC6F173E-0A2B-45C1-94F0-7D870F6FD731} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 _____ () D:\Notepad++\NppShell_06.dll
2014-08-18 18:19 - 2014-09-08 17:15 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe
2013-08-08 13:30 - 2013-08-08 13:30 - 00283648 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
2014-09-08 17:12 - 2013-09-30 16:24 - 01976832 _____ () C:\Program Files (x86)\SPEEDLINK\VIRTUIS Advanced Gaming Keyboard\Monitor.EXE
2014-09-08 17:12 - 2013-07-11 08:38 - 00169984 _____ () C:\Program Files (x86)\SPEEDLINK\VIRTUIS Advanced Gaming Keyboard\OSD.exe
2014-07-31 11:16 - 2014-07-31 11:16 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-31 11:16 - 2014-07-31 11:16 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-03-06 14:00 - 2014-03-06 14:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2013-03-12 07:19 - 2013-03-12 07:19 - 00741376 _____ () C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\de-DE\SBRcni.resources.dll
2014-09-08 17:13 - 2013-08-17 13:13 - 00036864 _____ () C:\Program Files (x86)\SPEEDLINK\VIRTUIS Advanced Gaming Keyboard\Lang\Lang_EN.dll
2014-09-08 17:13 - 2012-11-05 07:37 - 00061440 _____ () C:\Program Files (x86)\SPEEDLINK\VIRTUIS Advanced Gaming Keyboard\hiddriver.dll
2014-09-04 11:26 - 2014-09-04 11:26 - 00151872 _____ () C:\Program Files (x86)\Mindjet\MindManager 15\zlib.dll
2015-02-07 15:13 - 2015-02-04 10:02 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libglesv2.dll
2015-02-07 15:13 - 2015-02-04 10:02 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\libegl.dll
2015-02-07 15:13 - 2015-02-04 10:02 - 09170760 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.111\pdf.dll
2010-11-22 23:56 - 2010-11-22 23:56 - 00087040 _____ () C:\Program Files (x86)\Raptr\_ctypes.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00043008 _____ () C:\Program Files (x86)\Raptr\_socket.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00805376 _____ () C:\Program Files (x86)\Raptr\_ssl.pyd
2014-05-14 00:26 - 2014-05-14 00:26 - 05812736 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtGui.pyd
2014-05-14 00:26 - 2014-05-14 00:26 - 00067584 _____ () C:\Program Files (x86)\Raptr\sip.pyd
2014-05-14 00:26 - 2014-05-14 00:26 - 01662464 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtCore.pyd
2014-05-14 00:26 - 2014-05-14 00:26 - 00494592 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtNetwork.pyd
2010-11-22 23:57 - 2010-11-22 23:57 - 00096256 _____ () C:\Program Files (x86)\Raptr\win32api.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00110592 _____ () C:\Program Files (x86)\Raptr\pywintypes26.dll
2010-11-22 23:56 - 2010-11-22 23:56 - 00010240 _____ () C:\Program Files (x86)\Raptr\select.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00356864 _____ () C:\Program Files (x86)\Raptr\_hashlib.pyd
2010-11-22 23:57 - 2010-11-22 23:57 - 00036352 _____ () C:\Program Files (x86)\Raptr\win32process.pyd
2010-11-22 23:57 - 2010-11-22 23:57 - 00111104 _____ () C:\Program Files (x86)\Raptr\win32file.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00044544 _____ () C:\Program Files (x86)\Raptr\_sqlite3.pyd
2011-02-15 19:17 - 2011-02-15 19:17 - 00417501 _____ () C:\Program Files (x86)\Raptr\sqlite3.dll
2010-11-22 23:57 - 2010-11-22 23:57 - 00167936 _____ () C:\Program Files (x86)\Raptr\win32gui.pyd
2014-05-14 00:26 - 2014-05-14 00:26 - 00313856 _____ () C:\Program Files (x86)\Raptr\PyQt4.QtWebKit.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00127488 _____ () C:\Program Files (x86)\Raptr\pyexpat.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00009216 _____ () C:\Program Files (x86)\Raptr\winsound.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00354304 _____ () C:\Program Files (x86)\Raptr\pythoncom26.dll
2010-11-22 23:57 - 2010-11-22 23:57 - 00016384 _____ () C:\Program Files (x86)\Raptr\win32trace.pyd
2014-08-14 01:37 - 2014-08-14 01:37 - 00113171 _____ () C:\Program Files (x86)\Raptr\libvlc.dll
2014-08-14 01:37 - 2014-08-14 01:37 - 02396691 _____ () C:\Program Files (x86)\Raptr\libvlccore.dll
2010-11-22 23:56 - 2010-11-22 23:56 - 00583680 _____ () C:\Program Files (x86)\Raptr\unicodedata.pyd
2010-11-22 23:57 - 2010-11-22 23:57 - 00263168 _____ () C:\Program Files (x86)\Raptr\win32com.shell.shell.pyd
2010-11-22 23:56 - 2010-11-22 23:56 - 00324608 _____ () C:\Program Files (x86)\Raptr\PIL._imaging.pyd
2013-11-21 01:05 - 2013-11-21 01:05 - 00256000 _____ () C:\Program Files (x86)\Raptr\amd_ags.dll
2010-11-22 23:57 - 2010-11-22 23:57 - 00141312 _____ () C:\Program Files (x86)\Raptr\gobject._gobject.pyd
2014-06-18 01:56 - 2014-06-18 01:56 - 02717595 _____ () C:\Program Files (x86)\Raptr\heliotrope._purple.pyd
2011-02-15 19:17 - 2011-02-15 19:17 - 01213633 _____ () C:\Program Files (x86)\Raptr\libxml2-2.dll
2010-11-23 00:06 - 2010-11-23 00:06 - 00055808 _____ () C:\Program Files (x86)\Raptr\zlib1.dll
2013-05-10 00:52 - 2013-05-10 00:52 - 00495680 _____ () C:\Program Files (x86)\Raptr\plugins\libaim.dll
2013-05-10 00:52 - 2013-05-10 00:52 - 01183699 _____ () C:\Program Files (x86)\Raptr\liboscar.dll
2013-05-10 00:52 - 2013-05-10 00:52 - 00483306 _____ () C:\Program Files (x86)\Raptr\plugins\libicq.dll
2013-05-03 19:57 - 2013-05-03 19:57 - 00655356 _____ () C:\Program Files (x86)\Raptr\plugins\libirc.dll
2013-05-03 19:56 - 2013-05-03 19:56 - 01306387 _____ () C:\Program Files (x86)\Raptr\plugins\libmsn.dll
2013-05-03 19:56 - 2013-05-03 19:56 - 00565461 _____ () C:\Program Files (x86)\Raptr\plugins\libxmpp.dll
2013-05-03 19:57 - 2013-05-03 19:57 - 01640221 _____ () C:\Program Files (x86)\Raptr\libjabber.dll
2013-05-03 19:56 - 2013-05-03 19:56 - 00506276 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoo.dll
2013-05-03 19:57 - 2013-05-03 19:57 - 01053730 _____ () C:\Program Files (x86)\Raptr\libymsg.dll
2013-05-03 19:57 - 2013-05-03 19:57 - 00497782 _____ () C:\Program Files (x86)\Raptr\plugins\libyahoojp.dll
2013-05-03 19:57 - 2013-05-03 19:57 - 00603326 _____ () C:\Program Files (x86)\Raptr\plugins\ssl-nss.dll
2013-05-03 19:57 - 2013-05-03 19:57 - 00474199 _____ () C:\Program Files (x86)\Raptr\plugins\ssl.dll
2014-08-02 12:49 - 2013-09-16 11:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-672128-2782778396-1146651854-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-672128-2782778396-1146651854-500 - Administrator - Disabled)
Alex (S-1-5-21-672128-2782778396-1146651854-1000 - Administrator - Enabled) => C:\Users\Alex
Gast (S-1-5-21-672128-2782778396-1146651854-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: SM-Bus-Controller
Description: SM-Bus-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: SAMSUNG Mobile USB Composite Device 
Description: SAMSUNG Mobile USB Composite Device 
Class Guid: {36fc9e60-c465-11cf-8056-444553540000}
Manufacturer: SAMSUNG Electronics Co., Ltd. 
Service: dg_ssudbus
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/13/2015 09:53:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (02/13/2015 09:43:54 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (02/13/2015 09:43:32 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (02/13/2015 09:42:23 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.


Microsoft Office Sessions:
=========================
Error: (02/13/2015 09:53:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2015-02-13 21:51:12.854
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ATITool64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 21:51:12.822
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ATITool64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 21:43:32.634
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 21:43:32.604
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 17:58:27.885
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ATITool64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 17:58:27.854
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\ATITool64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2015-02-13 14:59:46.830
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 14:59:46.828
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 14:57:47.515
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2015-02-13 14:57:47.506
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 27%
Total physical RAM: 8068.73 MB
Available physical RAM: 5878.36 MB
Total Pagefile: 16135.66 MB
Available Pagefile: 13235.23 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:21.46 GB) NTFS
Drive d: (Elements) (Fixed) (Total:1863.01 GB) (Free:1825.07 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 38B4BB88)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=232.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 00050FB0)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-13 22:05:14
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Samsung_SSD_840_EVO_250GB rev.EXT0BB6Q 232,89GB
Running: Gmer-19357.exe; Driver: C:\Users\Alex\AppData\Local\Temp\kxldrpog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe[1260] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey                 00000000777afaa8 5 bytes JMP 0000000171a42e10
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe[1260] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory          00000000777b0038 5 bytes JMP 0000000171a42dd0
.text  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe[1260] C:\Windows\syswow64\USER32.dll!UserClientDllInitialize + 779  000000007531b9f8 4 bytes [10, 3D, A4, 71]
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                    0000000075c11401 2 bytes JMP 756bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                      0000000075c11419 2 bytes JMP 756bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                    0000000075c11431 2 bytes JMP 75738ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                    0000000075c1144a 2 bytes CALL 756948ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                 * 9
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                       0000000075c114dd 2 bytes JMP 757387a2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                0000000075c114f5 2 bytes JMP 75738978 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                       0000000075c1150d 2 bytes JMP 75738698 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                0000000075c11525 2 bytes JMP 75738a62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                      0000000075c1153d 2 bytes JMP 756afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                           0000000075c11555 2 bytes JMP 756b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                    0000000075c1156d 2 bytes JMP 75738f61 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                      0000000075c11585 2 bytes JMP 75738ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                         0000000075c1159d 2 bytes JMP 7573865c C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                      0000000075c115b5 2 bytes JMP 756afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                    0000000075c115cd 2 bytes JMP 756bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                0000000075c116b2 2 bytes JMP 75738e24 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2072] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                0000000075c116bd 2 bytes JMP 757385f1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                      0000000075c11401 2 bytes JMP 756bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                        0000000075c11419 2 bytes JMP 756bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                      0000000075c11431 2 bytes JMP 75738ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                      0000000075c1144a 2 bytes CALL 756948ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                 * 9
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                         0000000075c114dd 2 bytes JMP 757387a2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                  0000000075c114f5 2 bytes JMP 75738978 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                         0000000075c1150d 2 bytes JMP 75738698 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                  0000000075c11525 2 bytes JMP 75738a62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                        0000000075c1153d 2 bytes JMP 756afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                             0000000075c11555 2 bytes JMP 756b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                      0000000075c1156d 2 bytes JMP 75738f61 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                        0000000075c11585 2 bytes JMP 75738ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                           0000000075c1159d 2 bytes JMP 7573865c C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                        0000000075c115b5 2 bytes JMP 756afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                      0000000075c115cd 2 bytes JMP 756bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                  0000000075c116b2 2 bytes JMP 75738e24 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2172] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                  0000000075c116bd 2 bytes JMP 757385f1 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                      0000000075c11401 2 bytes JMP 756bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                        0000000075c11419 2 bytes JMP 756bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                      0000000075c11431 2 bytes JMP 75738ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                      0000000075c1144a 2 bytes CALL 756948ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                 * 9
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                         0000000075c114dd 2 bytes JMP 757387a2 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                  0000000075c114f5 2 bytes JMP 75738978 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                         0000000075c1150d 2 bytes JMP 75738698 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                  0000000075c11525 2 bytes JMP 75738a62 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                        0000000075c1153d 2 bytes JMP 756afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                             0000000075c11555 2 bytes JMP 756b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                      0000000075c1156d 2 bytes JMP 75738f61 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                        0000000075c11585 2 bytes JMP 75738ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                           0000000075c1159d 2 bytes JMP 7573865c C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                        0000000075c115b5 2 bytes JMP 756afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                      0000000075c115cd 2 bytes JMP 756bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                  0000000075c116b2 2 bytes JMP 75738e24 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\PnkBstrA.exe[2296] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                  0000000075c116bd 2 bytes JMP 757385f1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                             0000000075c11401 2 bytes JMP 756bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                               0000000075c11419 2 bytes JMP 756bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                             0000000075c11431 2 bytes JMP 75738ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                             0000000075c1144a 2 bytes CALL 756948ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                 * 9
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                0000000075c114dd 2 bytes JMP 757387a2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                         0000000075c114f5 2 bytes JMP 75738978 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                0000000075c1150d 2 bytes JMP 75738698 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                         0000000075c11525 2 bytes JMP 75738a62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                               0000000075c1153d 2 bytes JMP 756afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                    0000000075c11555 2 bytes JMP 756b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                             0000000075c1156d 2 bytes JMP 75738f61 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                               0000000075c11585 2 bytes JMP 75738ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                  0000000075c1159d 2 bytes JMP 7573865c C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                               0000000075c115b5 2 bytes JMP 756afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                             0000000075c115cd 2 bytes JMP 756bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                         0000000075c116b2 2 bytes JMP 75738e24 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2460] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                         0000000075c116bd 2 bytes JMP 757385f1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                          0000000075c11401 2 bytes JMP 756bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                            0000000075c11419 2 bytes JMP 756bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                          0000000075c11431 2 bytes JMP 75738ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                          0000000075c1144a 2 bytes CALL 756948ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                 * 9
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                             0000000075c114dd 2 bytes JMP 757387a2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                      0000000075c114f5 2 bytes JMP 75738978 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                             0000000075c1150d 2 bytes JMP 75738698 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                      0000000075c11525 2 bytes JMP 75738a62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                            0000000075c1153d 2 bytes JMP 756afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                 0000000075c11555 2 bytes JMP 756b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                          0000000075c1156d 2 bytes JMP 75738f61 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                            0000000075c11585 2 bytes JMP 75738ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                               0000000075c1159d 2 bytes JMP 7573865c C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                            0000000075c115b5 2 bytes JMP 756afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                          0000000075c115cd 2 bytes JMP 756bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                      0000000075c116b2 2 bytes JMP 75738e24 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[2580] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                      0000000075c116bd 2 bytes JMP 757385f1 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!DispatchMessageW                                                                   000000007531787b 5 bytes JMP 0000000159f2a040
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!DispatchMessageA                                                                   0000000075317bbb 5 bytes JMP 0000000159f2a010
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                    0000000075318a29 5 bytes JMP 0000000159f2aa20
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!SetWindowPos                                                                       0000000075318e4e 5 bytes JMP 0000000159f2a1a0
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!DestroyWindow                                                                      0000000075319a55 5 bytes JMP 0000000159f2a170
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!CreateWindowExA                                                                    000000007531d22e 5 bytes JMP 0000000159f2a8e0
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!PeekMessageW                                                                       00000000753205ba 5 bytes JMP 0000000159f2a360
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!ShowWindow                                                                         0000000075320dfb 5 bytes JMP 0000000159f2a070
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!EndPaint                                                                           0000000075321341 5 bytes JMP 0000000159f2a440
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!BeginPaint                                                                         0000000075321361 5 bytes JMP 0000000159f2a3e0
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!UpdateLayeredWindowIndirect                                                        00000000753228da 5 bytes JMP 0000000159f2a860
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!SetCursor                                                                          00000000753241f6 5 bytes JMP 0000000159f29920
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!PeekMessageA                                                                       0000000075325f74 5 bytes JMP 0000000159f2a300
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!BringWindowToTop                                                                   0000000075327b3b 5 bytes JMP 0000000159f2a3c0
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!AnimateWindow                                                                      000000007532b531 5 bytes JMP 0000000159f2a210
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!UpdateLayeredWindow                                                                000000007532ba4a 5 bytes JMP 0000000159f2a790
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!WindowFromPoint                                                                    000000007533ed12 5 bytes JMP 0000000159f29940
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!SetCapture                                                                         000000007533ed56 5 bytes JMP 0000000159f2a2e0
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\USER32.dll!SetForegroundWindow                                                                000000007533f170 5 bytes JMP 0000000159f2a2a0
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\GDI32.dll!BitBlt                                                                              0000000075b05ea6 5 bytes JMP 0000000159f29970
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\GDI32.dll!StretchBlt                                                                          0000000075b0b895 5 bytes JMP 0000000159f29be0
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17                                                           0000000075c11401 2 bytes JMP 756bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17                                                             0000000075c11419 2 bytes JMP 756bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17                                                           0000000075c11431 2 bytes JMP 75738ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42                                                           0000000075c1144a 2 bytes CALL 756948ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                 * 9
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17                                                              0000000075c114dd 2 bytes JMP 757387a2 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17                                                       0000000075c114f5 2 bytes JMP 75738978 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17                                                              0000000075c1150d 2 bytes JMP 75738698 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17                                                       0000000075c11525 2 bytes JMP 75738a62 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17                                                             0000000075c1153d 2 bytes JMP 756afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17                                                                  0000000075c11555 2 bytes JMP 756b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17                                                           0000000075c1156d 2 bytes JMP 75738f61 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17                                                             0000000075c11585 2 bytes JMP 75738ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17                                                                0000000075c1159d 2 bytes JMP 7573865c C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17                                                             0000000075c115b5 2 bytes JMP 756afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17                                                           0000000075c115cd 2 bytes JMP 756bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20                                                       0000000075c116b2 2 bytes JMP 75738e24 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr.exe[7024] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31                                                       0000000075c116bd 2 bytes JMP 757385f1 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                        0000000075c11401 2 bytes JMP 756bb21b C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                          0000000075c11419 2 bytes JMP 756bb346 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                        0000000075c11431 2 bytes JMP 75738ea9 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                        0000000075c1144a 2 bytes CALL 756948ad C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                 * 9
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                           0000000075c114dd 2 bytes JMP 757387a2 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                    0000000075c114f5 2 bytes JMP 75738978 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                           0000000075c1150d 2 bytes JMP 75738698 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                    0000000075c11525 2 bytes JMP 75738a62 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                          0000000075c1153d 2 bytes JMP 756afca8 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                               0000000075c11555 2 bytes JMP 756b68ef C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                        0000000075c1156d 2 bytes JMP 75738f61 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                          0000000075c11585 2 bytes JMP 75738ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                             0000000075c1159d 2 bytes JMP 7573865c C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                          0000000075c115b5 2 bytes JMP 756afd41 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                        0000000075c115cd 2 bytes JMP 756bb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                    0000000075c116b2 2 bytes JMP 75738e24 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~2\Raptr\raptr_im.exe[5328] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                    0000000075c116bd 2 bytes JMP 757385f1 C:\Windows\syswow64\kernel32.dll

---- EOF - GMER 2.1 ----