| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Windows 7: Zeitweise (sehr) hoher PingWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
02.06.2015, 00:20
| #1 |
 |  Windows 7: Zeitweise (sehr) hoher Ping Hallo, ich habe seit längerem (bestimmt einige Monate) hin und wieder das Problem beim online spielen, dass mein Ping auf Werte bis 800ms steigt. Manchmal sinkt er recht schnell (1-2 Minuten) wieder, manchmal hält das Problem den ganzen Tag an. Das Internet an sich (Browser etc.) kommt mir dann auch langsamer vor, dort habe ich aber nie meinen Ping gecheckt. Avira hat keine "Funde" zu melden, löschte aber, wie ich gesehen habe, alle 30 Tage die Logs. Defogger Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 00:57 on 02/06/2015 (Steffen)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 29-05-2015
Ran by Steffen (administrator) on SCHABERNACK-PC2 on 02-06-2015 00:58:56
Running from C:\Users\Steffen\Desktop\viren
Loaded Profiles: Steffen (Available Profiles: Steffen)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanNetService.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Ruiware LLC) C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\ScanToPCActivationApp.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(AVM Berlin) C:\Program Files (x86)\avmwlanstick\WLanGUI.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HPNetworkCommunicatorCom.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TeamSpeak Systems GmbH) C:\Program Files\TeamSpeak 3 Client\ts3client_win64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Valve Corporation) C:\Games\Steam\Steam.exe
(Valve Corporation) C:\Games\Steam\bin\steamwebhelper.exe
(Valve Corporation) C:\Games\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [8294680 2014-02-28] (Logitech Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AVMWlanClient] => C:\Program Files (x86)\avmwlanstick\wlangui.exe [1904640 2009-03-20] (AVM Berlin)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl8] => C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-07-16] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] => C:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2009-08-28] (cyberlink)
HKLM-x32\...\Run: [LGODDFU] => C:\Program Files (x86)\lg_fwupdate\lgfw.exe [27760 2014-10-21] (Bitleader)
HKLM-x32\...\Run: [UpdatePSTShortCut] => C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe [210216 2009-10-23] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\Run: [Pidgin] => C:\Program Files (x86)\Pidgin\pidgin.exe [60216 2014-02-03] (The Pidgin developer community)
HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\Run: [WinPatrol] => C:\Program Files (x86)\Ruiware\WinPatrol\winpatrol.exe [1154112 2014-07-21] (Ruiware LLC)
HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [31280256 2015-04-17] (Skype Technologies S.A.)
HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\Run: [HP Officejet 6500 E710a-f (NET)] => C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\MountPoints2: {9cdd2555-ac4e-11e3-a1b2-1c6f65464a44} - E:\pushinst.exe
HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [241664 2010-11-21] (Microsoft Corporation)
Startup: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet 6500 E710a-f (Network).lnk [2014-10-21]
ShortcutTarget: Monitor Ink Alerts - HP Officejet 6500 E710a-f (Network).lnk -> C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk [2015-02-27]
ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe ()
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
URLSearchHook: HKLM-x32 - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 -> DefaultScope value is missing
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-21] (Oracle Corporation)
BHO-x32: best-markit -> {9959B382-75C6-E6A5-EFB8-94CA19A6265B} -> C:\Program Files (x86)\best-markit\171.dll No File
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-21] (Oracle Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{2C3588B3-EE80-4C3B-95EC-DC8898B1DE85}: [NameServer] 10.10.1.1
FireFox:
========
FF ProfilePath: C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default
FF Homepage: spiegel.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-15] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-15] ()
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-21] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-21] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-17] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2013-07-31] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3734315880-2873885967-1594469601-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-05-01] ()
FF SearchPlugin: C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\searchplugins\google-bersetzer.xml [2014-06-20]
FF SearchPlugin: C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\searchplugins\google-images.xml [2014-12-21]
FF SearchPlugin: C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\searchplugins\google-maps.xml [2014-12-21]
FF SearchPlugin: C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\searchplugins\leo-eng-deu-v20.xml [2014-12-15]
FF SearchPlugin: C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\searchplugins\magiccardsinfo.xml [2014-04-30]
FF SearchPlugin: C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\searchplugins\youtube-videosuche.xml [2014-04-20]
FF Extension: Avira Browser Safety - C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\Extensions\abs@avira.com [2015-05-29]
FF Extension: Classic Theme Restorer (Customize UI) - C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\Extensions\ClassicThemeRestorer@ArisT2Noia4dev.xpi [2014-05-10]
FF Extension: Image Zoom - C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\Extensions\{1A2D0EC4-75F5-4c91-89C4-3656F6E44B68}.xpi [2014-04-25]
FF Extension: ProxTube - C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\Extensions\{2541D29A-DB9E-4c1e-949A-31EFB4AEF4E7}.xpi [2014-08-19]
FF Extension: Adblock Plus - C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-25]
FF HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\Firefox\Extensions: [{5EF2604F-E14D-DBD2-CF5E-55804DEE7647}] - C:\Program Files (x86)\best-markit\171.xpi
FF HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\Firefox\Extensions: [cliqz@cliqz.com] - C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Profiles\8f13rrcu.default\extensions\cliqz@cliqz.com
Chrome:
=======
CHR Profile: C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-07]
CHR Extension: (Google Docs) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-10-07]
CHR Extension: (Google Drive) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-10-07]
CHR Extension: (YouTube) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-10-07]
CHR Extension: (Google Search) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-10-07]
CHR Extension: (Tampermonkey) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2014-12-15]
CHR Extension: (Google Sheets) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-07]
CHR Extension: (LoungeDestroyer) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghahcnmfjfckcedfajbhekgknjdplfcl [2015-01-26]
CHR Extension: (AdBlock) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-12-16]
CHR Extension: (Bookmark Manager) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-24]
CHR Extension: (CSGO Lounge Bot status indicator) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\inakkfgnoajfhlnlcknnllnnibejhocd [2014-12-17]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-29]
CHR Extension: (Steam Trader Helper) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhoahihokddepjlegpenefeaahdkojog [2015-05-17]
CHR Extension: (Google Wallet) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-10-07]
CHR Extension: (Gmail) - C:\Users\Steffen\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-10-07]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.) [File not signed]
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 AVM WLAN Connection Service; C:\Program Files (x86)\avmwlanstick\WlanNetService.exe [368640 2009-03-20] (AVM Berlin) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2014-09-30] ()
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-08-08] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-20] (Advanced Micro Devices)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [14120 2009-03-20] (AVM Berlin)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
S3 AX88178; C:\Windows\System32\DRIVERS\ax88178.sys [64000 2013-08-01] (ASIX Electronics Corp.)
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [460800 2009-03-20] (AVM GmbH)
R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
R3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [41752 2013-05-30] (Logitech Inc.)
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
S3 XSplit_Dummy; C:\Windows\System32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited)
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}; C:\Program Files (x86)\CyberLink\PowerDVD8\000.fcl [146928 2009-08-28] (CyberLink Corp.)
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-02 00:58 - 2015-06-02 00:58 - 00000000 ____D () C:\FRST
2015-06-02 00:57 - 2015-06-02 00:57 - 00000000 _____ () C:\Users\Steffen\defogger_reenable
2015-06-02 00:55 - 2015-06-02 00:58 - 00000000 ____D () C:\Users\Steffen\Desktop\viren
2015-05-15 17:43 - 2015-05-15 17:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-13 03:02 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 03:02 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-12 21:06 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-12 21:06 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-12 21:06 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-12 21:06 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-12 21:06 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-12 21:06 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-12 21:06 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-12 21:06 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-12 21:06 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-12 21:06 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-12 21:06 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-12 21:06 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-12 21:06 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-12 21:06 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-12 21:06 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-12 21:06 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-12 21:06 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-12 21:06 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-12 21:06 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-12 21:06 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-12 21:06 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-12 21:06 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-12 21:06 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-12 21:06 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-12 21:06 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-12 21:06 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-12 21:06 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-12 21:06 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-12 21:06 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-12 21:06 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-12 21:06 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-12 21:06 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-12 21:06 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-12 21:06 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-12 21:06 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-12 21:06 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-12 21:06 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-12 21:06 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-12 21:06 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-12 21:06 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-12 21:06 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-12 21:06 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-12 21:06 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-12 21:06 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-12 21:06 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-12 21:06 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-12 21:06 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-12 21:06 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-12 21:06 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-12 21:06 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-12 21:06 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-12 21:06 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-12 21:06 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-12 21:06 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-12 21:06 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-12 21:06 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-12 21:06 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-12 21:06 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-12 21:06 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-12 21:06 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-12 21:06 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-12 21:06 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-12 21:06 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-12 21:06 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-12 21:04 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-12 21:04 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-12 21:04 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-12 21:04 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-12 21:04 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-12 21:04 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-12 21:04 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-12 21:04 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-12 21:04 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-12 21:04 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-12 21:04 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-12 21:04 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-12 21:04 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-12 21:04 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-12 21:04 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-12 21:04 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-12 21:04 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-12 21:04 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-12 21:04 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-12 21:04 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-12 21:04 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-12 21:04 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-12 21:04 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-12 21:04 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-12 21:04 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-12 21:04 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-12 21:04 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-12 21:04 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-12 21:04 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-12 21:03 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-12 21:03 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-12 21:03 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-12 21:03 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-12 21:03 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-12 21:03 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-12 21:03 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-12 21:03 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-12 21:03 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-12 21:03 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-12 21:03 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-12 21:03 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-12 21:03 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-12 21:03 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-12 21:03 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-12 21:03 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-12 21:03 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-12 21:03 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-12 21:03 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-12 21:03 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-12 21:03 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-12 21:03 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-12 21:03 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-12 21:03 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-12 21:03 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-12 21:03 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-12 21:03 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-12 21:03 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-12 21:03 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-12 21:03 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-12 21:03 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-12 21:03 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-12 21:03 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-12 21:03 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-12 21:03 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-12 21:03 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-12 21:03 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-12 21:03 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-02 00:57 - 2014-03-14 17:45 - 00000000 ____D () C:\Users\Steffen
2015-06-02 00:53 - 2009-07-14 06:45 - 00021696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-02 00:53 - 2009-07-14 06:45 - 00021696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-02 00:50 - 2009-07-14 07:13 - 00785942 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-06-02 00:48 - 2014-03-14 17:44 - 01525467 _____ () C:\Windows\WindowsUpdate.log
2015-06-02 00:45 - 2014-05-02 21:57 - 00000000 ____D () C:\Users\Steffen\AppData\Roaming\TS3Client
2015-06-02 00:45 - 2014-03-18 19:18 - 00000000 ____D () C:\Users\Steffen\AppData\Roaming\Skype
2015-06-02 00:45 - 2014-03-14 21:56 - 00000000 ____D () C:\Users\Steffen\AppData\Roaming\.purple
2015-06-02 00:44 - 2014-10-21 01:08 - 00000344 _____ () C:\Windows\lgfwup.ini
2015-06-02 00:44 - 2014-10-21 01:08 - 00000000 ____D () C:\Program Files (x86)\lg_fwupdate
2015-06-02 00:44 - 2014-10-21 01:06 - 00000000 ____D () C:\Users\Steffen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite
2015-06-02 00:44 - 2014-10-07 02:57 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-02 00:44 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-06-02 00:44 - 2009-07-14 06:51 - 00083168 _____ () C:\Windows\setupact.log
2015-06-02 00:27 - 2014-10-07 02:57 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-02 00:17 - 2014-12-08 06:48 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-02 00:06 - 2014-08-28 03:47 - 00000000 ____D () C:\Users\Steffen\AppData\Local\Adobe
2015-05-30 05:59 - 2014-03-15 13:39 - 00000000 ____D () C:\Users\Steffen\AppData\Roaming\vlc
2015-05-30 04:53 - 2014-03-14 19:17 - 00000000 ____D () C:\ProgramData\TEMP
2015-05-21 12:27 - 2014-05-29 04:06 - 00001895 _____ () C:\Windows\cdplayer.ini
2015-05-21 02:36 - 2015-04-04 15:22 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-05-21 02:36 - 2015-04-04 15:22 - 00000000 ___SD () C:\Windows\system32\GWX
2015-05-17 20:16 - 2014-03-14 17:13 - 00000000 ____D () C:\Users\Steffen\Desktop\playlists
2015-05-17 14:04 - 2014-03-16 10:05 - 00000000 ____D () C:\Users\Steffen\Desktop\aTubeCatcher Stuff
2015-05-17 02:21 - 2014-10-07 02:57 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-17 02:21 - 2014-10-07 02:57 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-16 12:46 - 2014-03-14 17:49 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-15 23:37 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-15 00:38 - 2014-03-17 01:12 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-13 15:25 - 2014-11-26 13:39 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-13 15:25 - 2014-11-26 13:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 15:25 - 2009-07-14 06:45 - 00529352 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-13 04:01 - 2011-04-12 10:28 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-13 04:01 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\AdvancedInstallers
2015-05-13 03:13 - 2014-03-20 13:57 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-05-13 03:11 - 2014-03-14 18:33 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-13 03:05 - 2014-03-14 18:33 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 03:02 - 2014-11-26 13:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-08 12:47 - 2014-03-18 19:18 - 00000000 ____D () C:\ProgramData\Skype
2015-05-07 17:16 - 2014-03-14 18:09 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-07 17:16 - 2014-03-14 18:09 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-07 17:16 - 2014-03-14 18:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
==================== Files in the root of some directories =======
2014-10-21 13:54 - 2014-10-21 13:54 - 0000057 _____ () C:\ProgramData\Ament.ini
Some files in TEMP:
====================
C:\Users\Steffen\AppData\Local\Temp\atcMedia3511425051419.exe
C:\Users\Steffen\AppData\Local\Temp\atcMedia7671420417268.exe
C:\Users\Steffen\AppData\Local\Temp\avgnt.exe
C:\Users\Steffen\AppData\Local\Temp\jre-8u45-windows-au.exe
C:\Users\Steffen\AppData\Local\Temp\nsfF349.exe
C:\Users\Steffen\AppData\Local\Temp\nshFF39.exe
C:\Users\Steffen\AppData\Local\Temp\nsi8C8C.exe
C:\Users\Steffen\AppData\Local\Temp\nsj79B7.exe
C:\Users\Steffen\AppData\Local\Temp\nso9F04.exe
C:\Users\Steffen\AppData\Local\Temp\nss262F.exe
C:\Users\Steffen\AppData\Local\Temp\nsx208.exe
C:\Users\Steffen\AppData\Local\Temp\nsx2341.exe
C:\Users\Steffen\AppData\Local\Temp\paint.net.4.0.install.exe
C:\Users\Steffen\AppData\Local\Temp\Quarantine.exe
C:\Users\Steffen\AppData\Local\Temp\SimilarBundleGenericDl.exe
C:\Users\Steffen\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Steffen\AppData\Local\Temp\uninstall_flash_player.exe
C:\Users\Steffen\AppData\Local\Temp\utt1893.tmp.exe
C:\Users\Steffen\AppData\Local\Temp\uttF46E.tmp.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-05-25 17:16
==================== End of log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 29-05-2015
Ran by Steffen at 2015-06-02 00:59:36
Running from C:\Users\Steffen\Desktop\viren
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3734315880-2873885967-1594469601-500 - Administrator - Disabled)
Guest (S-1-5-21-3734315880-2873885967-1594469601-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3734315880-2873885967-1594469601-1002 - Limited - Enabled)
Steffen (S-1-5-21-3734315880-2873885967-1594469601-1000 - Administrator - Enabled) => C:\Users\Steffen
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
µTorrent (HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\...\uTorrent) (Version: 3.4.2.34024 - BitTorrent Inc.)
4K Video Downloader 3.2 (HKLM-x32\...\4K Video Downloader_is1) (Version: 3.2.0.1300 - Open Media LLC)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 17 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{308051DA-0048-7A07-FE8B-9B6EC119A9E8}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)
AMP WinOFF 5.0.1 (HKLM-x32\...\AMP WinOFF) (Version: 5.0.1 - Alberto Martinez Perez)
Android SDK Tools (HKLM-x32\...\Android SDK Tools) (Version: 1.16 - Google Inc.)
Antichamber (HKLM-x32\...\Steam App 219890) (Version: - Alexander Bruce)
aTube Catcher (HKLM-x32\...\aTube Catcher) (Version: 3.8.7955 - DsNET Corp)
aTube Catcher version 3.8 (HKLM-x32\...\{D43B360E-722D-421B-BC77-20B9E0F8B6CD}_is1) (Version: 3.8 - DsNET Corp)
Audiograbber 1.83 SE (HKLM-x32\...\Audiograbber) (Version: 1.83 SE - Audiograbber)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
AVM FRITZ!WLAN (HKLM-x32\...\AVMWLANCLI) (Version: - AVM Berlin)
Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games)
Castle Crashers (HKLM-x32\...\Steam App 204360) (Version: - The Behemoth)
Cliqz (HKLM-x32\...\{5A0C0737-6AFE-4DC6-A8B4-6DFE509ACD75}_is1) (Version: 0.5.53 - Cliqz.com)
Counter-Strike (HKLM-x32\...\Steam App 10) (Version: - Valve)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version: - Valve)
CyberLink Blu-ray Disc Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2806 - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3224 - CyberLink Corp.)
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.0.3228 - CyberLink Corp.)
DC++ 0.842 (HKLM-x32\...\DC++) (Version: 0.842 - Jacek Sieka)
Dolphin (HKLM-x32\...\Dolphin) (Version: 4.0.2 - Dolphin Development Team)
Element4l (HKLM-x32\...\Steam App 235820) (Version: - I-Illusions)
Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.05 - Ubisoft)
FarCry 4 (HKLM-x32\...\Uplay Install 420) (Version: - Ubisoft)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.81 - Google Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
HP Officejet 6500 E710a-f Basic Device Software (HKLM\...\{22FCD3B0-CAA7-444A-84AC-75716545EAB9}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6500 E710a-f Help (HKLM-x32\...\{037CD593-D760-4A00-B030-7BBAFA1123FE}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
LG Tool Kit (HKLM-x32\...\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )
LIMBO (HKLM-x32\...\Steam App 48000) (Version: - Playdead)
Logitech Gaming Software 8.52 (HKLM\...\Logitech Gaming Software) (Version: 8.52.15 - Logitech Inc.)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 24.5.0 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Mumble 1.2.5 (HKLM-x32\...\{871F39A1-1671-4161-A012-1D4820346A69}) (Version: 1.2.5 - Thorvald Natvig)
My Game Long Name (HKLM\...\UDK-71d78287-3f1f-47f9-9631-80822b6a6e1e) (Version: - Epic Games, Inc.)
My Game Long Name (HKLM\...\UDK-fb0596e1-28a2-44dc-bef0-d56e2c1284d4) (Version: - Epic Games, Inc.)
NaissanceE (HKLM-x32\...\Steam App 265690) (Version: - Limasse Five)
NVIDIA PhysX (HKLM-x32\...\{8A809006-C25A-4A3A-9DAB-94659BCDB107}) (Version: 9.10.0224 - NVIDIA Corporation)
paint.net (HKLM\...\{19BD2C33-16A8-4ED1-B9EA-D9E35B21EC42}) (Version: 4.0.5 - dotPDN LLC)
PdaNet+ for Android 4.15 (HKLM-x32\...\PdaNet_is1) (Version: - June Fabrics Technology Inc)
Pidgin (HKLM-x32\...\Pidgin) (Version: 2.10.9 - )
pidgin-otr 4.0.0-1 (HKLM-x32\...\pidgin-otr) (Version: 4.0.0-1 - Cypherpunks CA)
Portal 2 (HKLM-x32\...\Steam App 620) (Version: - Valve)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Race The Sun (HKLM-x32\...\Steam App 253030) (Version: - Flippfly LLC)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.6650 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Skype™ 7.4 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.4.102 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.28 - Piriform)
SpeedCommander 12 (x64) (HKLM\...\SpeedCommander 12 (x64)) (Version: 12 - SpeedProject)
StarCraft II (HKLM-x32\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM-x32\...\Steam) (Version: - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
The Bridge (HKLM-x32\...\Steam App 204240) (Version: - Ty Taylor and Mario Castañeda)
The Long Dark (HKLM-x32\...\Steam App 305620) (Version: - Hinterland Studio Inc.)
The Stanley Parable (HKLM-x32\...\Steam App 221910) (Version: - Galactic Cafe)
The Swapper (HKLM-x32\...\Steam App 231160) (Version: - Olli Harjola, Otto Hantula, Tom Jubert, Carlo Castellano)
Tomb Raider (HKLM-x32\...\Steam App 203160) (Version: - Crystal Dynamics)
Tomb Raider: Underworld (HKLM-x32\...\Steam App 8140) (Version: - Crystal Dynamics)
Universal Adb Driver (HKLM-x32\...\{D9C4202E-6D51-4B06-A8F1-22316E654BCA}) (Version: 1.0.0 - ClockworkMod)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
Vegas Pro 13.0 (64-bit) (HKLM\...\{3814DB30-091D-11E4-BDE0-F04DA23A5C58}) (Version: 13.0.373 - Sony)
VLC media player 2.0.8 (HKLM-x32\...\VLC media player) (Version: 2.0.8 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666 - Nullsoft, Inc)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows Driver Package - ASIX (AX88178) Net (07/12/2013 1.14.6.0) (HKLM\...\29D833C89C48AAD25433D33C7847A6E8E712F9D1) (Version: 07/12/2013 1.14.6.0 - ASIX)
Windows Driver Package - ASIX (AX88179) Net (05/23/2013 1.14.7.0) (HKLM\...\A4BF2BF16FB40322136D74F3D9F4E36CE0411697) (Version: 05/23/2013 1.14.7.0 - ASIX)
Windows Driver Package - ASIX (AX88772) Net (06/01/2011 3.14.3.6) (HKLM\...\6EDD36D0E16BBC3848B57933A5FC67BBDDB47238) (Version: 06/01/2011 3.14.3.6 - ASIX)
WinPatrol (HKLM\...\{6A206A04-6BC1-411B-AA04-4E52EDEEADF2}) (Version: 32.0.2014.5 - Ruiware)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== Restore Points =========================
ATTENTION: System Restore is disabled
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {1EE225F2-36F1-42D4-ADD6-B9C1363C1F63} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-15] (Adobe Systems Incorporated)
Task: {3D615040-51FC-4FD4-A759-F74ADD58155C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-07] (Google Inc.)
Task: {6167CF9D-B347-46DA-A564-A4F251ABF383} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {910540CC-3439-49B3-B4FF-1A7143AB01AD} - System32\Tasks\{130391E1-2237-4DDB-B602-29E162E7FC31} => pcalua.exe -a D:\software\WLAN_treiber\avm_fritz!wlan_usb_stick_x64_build_090320.exe -d D:\software\WLAN_treiber
Task: {BA318FD1-C827-4FF8-AE45-6D8F104401DF} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {BEAB8F47-73C8-4339-BFD5-C85139B38B6B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {DB4FA4C4-C803-43F1-AB61-6BB6BBB0E260} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {E5A6BB35-A60B-49EA-A187-2169BAE5F2C0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-07] (Google Inc.)
Task: {F1F55A85-32F7-4C6E-98A2-E606AA3BFFC6} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {FDE822AE-9688-481E-8D2A-BC45AD202ABC} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (Whitelisted) ==============
2013-12-06 17:06 - 2013-12-06 17:06 - 00127488 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-09-30 12:25 - 2014-09-30 12:25 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2013-12-06 17:06 - 2013-12-06 17:06 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-02-28 11:14 - 2014-02-28 11:14 - 00173568 _____ () C:\Program Files\TeamSpeak 3 Client\quazip.dll
2014-02-27 16:51 - 2014-02-27 16:51 - 01080832 _____ () C:\Program Files\TeamSpeak 3 Client\platforms\qwindows.dll
2014-02-27 16:51 - 2014-02-27 16:51 - 00833024 _____ () C:\Program Files\TeamSpeak 3 Client\sqldrivers\qsqlite.dll
2014-02-28 15:07 - 2014-02-28 15:07 - 00102344 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\directsound_win64.dll
2014-02-28 15:07 - 2014-02-28 15:07 - 00108488 _____ () C:\Program Files\TeamSpeak 3 Client\soundbackends\windowsaudiosession_win64.dll
2014-02-27 16:51 - 2014-02-27 16:51 - 00030208 _____ () C:\Program Files\TeamSpeak 3 Client\imageformats\qgif.dll
2014-02-27 16:51 - 2014-02-27 16:51 - 00233984 _____ () C:\Program Files\TeamSpeak 3 Client\imageformats\qjpeg.dll
2014-02-28 15:10 - 2014-02-28 15:10 - 00563656 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\clientquery_plugin.dll
2014-02-28 15:10 - 2014-02-28 15:10 - 00577480 _____ () C:\Program Files\TeamSpeak 3 Client\plugins\teamspeak_control_plugin.dll
2014-02-27 16:51 - 2014-02-27 16:51 - 00159232 _____ () C:\Program Files\TeamSpeak 3 Client\accessible\qtaccessiblewidgets.dll
2014-03-14 19:29 - 2015-04-16 19:40 - 00776192 _____ () C:\Games\Steam\SDL2.dll
2015-01-20 01:20 - 2015-04-23 04:16 - 04962816 _____ () C:\Games\Steam\v8.dll
2015-01-20 01:20 - 2015-04-23 04:16 - 01556992 _____ () C:\Games\Steam\icui18n.dll
2015-01-20 01:20 - 2015-04-23 04:16 - 01187840 _____ () C:\Games\Steam\icuuc.dll
2014-05-22 05:19 - 2015-05-15 03:58 - 02396352 _____ () C:\Games\Steam\video.dll
2014-09-01 02:57 - 2014-12-01 23:31 - 02396672 _____ () C:\Games\Steam\libavcodec-56.dll
2014-09-01 02:57 - 2014-12-01 23:31 - 00442880 _____ () C:\Games\Steam\libavutil-54.dll
2014-09-01 02:57 - 2014-12-01 23:31 - 00479744 _____ () C:\Games\Steam\libavformat-56.dll
2014-09-01 02:57 - 2014-12-01 23:31 - 00332800 _____ () C:\Games\Steam\libavresample-2.dll
2014-09-01 02:57 - 2014-12-01 23:31 - 00485888 _____ () C:\Games\Steam\libswscale-3.dll
2014-03-14 19:29 - 2015-05-15 03:57 - 00703168 _____ () C:\Games\Steam\bin\chromehtml.DLL
2014-03-14 19:29 - 2015-05-11 21:01 - 36302728 _____ () C:\Games\Steam\bin\libcef.dll
2015-05-15 00:28 - 2015-05-11 21:01 - 08958344 _____ () C:\Games\Steam\bin\pdf.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\ProgramData\TEMP:E7260698
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3734315880-2873885967-1594469601-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Steffen\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.178.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{F8B868F4-A71D-44C7-8D5F-F4EC0399C1D4}] => (Allow) C:\Games\Steam\Steam.exe
FirewallRules: [{F0C9F27D-5E66-4C6C-A492-47ABDF16CECD}] => (Allow) C:\Games\Steam\Steam.exe
FirewallRules: [{00D2E9A8-12D9-460F-8E8E-12B50F3DEA22}] => (Allow) C:\Games\Steam\SteamApps\common\Antichamber\Binaries\Win32\UDK.exe
FirewallRules: [{3588369E-12F9-48CA-ABCC-A89DFC964436}] => (Allow) C:\Games\Steam\SteamApps\common\Antichamber\Binaries\Win32\UDK.exe
FirewallRules: [{81CFECFD-8218-4569-9469-6038B2F09289}] => (Allow) C:\Games\Steam\SteamApps\common\Limbo\limbo.exe
FirewallRules: [{C7D0925C-0060-4FB0-9915-5C70CADCAE35}] => (Allow) C:\Games\Steam\SteamApps\common\Limbo\limbo.exe
FirewallRules: [{30612233-95D0-4A04-9FA7-703B9F4EB65E}] => (Allow) C:\Games\StarCraft II\Versions\Base15405\SC2.exe
FirewallRules: [{8E2F33E9-B60E-4372-979C-65BF6BA9D3B8}] => (Allow) C:\Games\StarCraft II\Versions\Base15405\SC2.exe
FirewallRules: [TCP Query User{373F88C3-02E8-4278-A82D-CA16341C07DE}C:\games\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe] => (Allow) C:\games\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe
FirewallRules: [UDP Query User{0DE8971D-322C-42BB-BEC0-A325C660C4F9}C:\games\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe] => (Allow) C:\games\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe
FirewallRules: [{6CB582CE-CFD2-4C76-9CCD-BAE0AB2E0DFC}] => (Block) C:\games\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe
FirewallRules: [{558077CB-5255-48F2-B1A1-0425E614D9D2}] => (Block) C:\games\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe
FirewallRules: [{D9BCBC53-3D37-4ABD-8B72-5867E9B3479B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1040\Agent.exe
FirewallRules: [{0E7C0460-AF25-4798-AD6E-EBC5430FD788}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1040\Agent.exe
FirewallRules: [{79DA3D9C-E3E0-40A2-9277-9416498CB36A}] => (Allow) C:\Games\StarCraft II\StarCraft II.exe
FirewallRules: [{11264827-D459-48E7-B1F4-7654EEC79FCC}] => (Allow) C:\Games\StarCraft II\StarCraft II.exe
FirewallRules: [{E66A2B39-2899-4761-AA90-81E230DC0FC6}] => (Allow) C:\Games\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [{CFC0B1CF-9B6A-42F1-BB38-FF64D7A0A55E}] => (Allow) C:\Games\StarCraft II\StarCraft II Public Test.exe
FirewallRules: [TCP Query User{ECBD30AC-770C-4B3C-A334-13063C9087D9}C:\games\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\games\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [UDP Query User{0E0355DC-B27F-4920-AEA9-0874B8E5C467}C:\games\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\games\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{6591FAEC-2A69-4B1C-B6A2-065DE81C7E2F}] => (Allow) C:\Games\Steam\SteamApps\common\Element4l\element4l.exe
FirewallRules: [{69E9C2A9-9906-4E83-A6FD-B6FDBD8DE110}] => (Allow) C:\Games\Steam\SteamApps\common\Element4l\element4l.exe
FirewallRules: [{42DF6662-6B5D-43C7-83F7-9392914CBEA5}] => (Allow) C:\Games\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{6D586A57-F802-4037-B91F-B9F8FEBF24CC}] => (Allow) C:\Games\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{48E51DD0-17E4-4E8D-9588-0B8B2D0CCC88}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{362020CD-EFCF-4F9E-9185-C22EB7549A76}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{1D689C72-A1CF-42A4-A234-9833F894A456}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{BBD49212-E2C6-47AD-A5F9-1DA132F9B42E}] => (Allow) C:\Games\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{E94D3C43-F242-4541-86AA-7EB188E2F205}] => (Allow) C:\Games\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{D605D13E-A053-43B9-95E6-C6C96881A2B6}] => (Allow) C:\Games\Steam\SteamApps\common\Tomb Raider Underworld\tru.exe
FirewallRules: [{726B12D9-EB3E-4693-9389-4F0932A9E8E2}] => (Allow) C:\Games\Steam\SteamApps\common\Tomb Raider Underworld\tru.exe
FirewallRules: [{526F55F4-A542-4DE0-A566-E606F36D4FDB}] => (Allow) C:\Games\Steam\SteamApps\common\The Swapper\TheSwapper.exe
FirewallRules: [{180625F5-BFE2-41CE-90E2-A29DC4E222F2}] => (Allow) C:\Games\Steam\SteamApps\common\The Swapper\TheSwapper.exe
FirewallRules: [{6FE6567B-CFD1-435C-BE59-6CF3944511D2}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{EFBAA6FD-474E-445B-A8CF-E6F0162CF61B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{6418D0DD-B2C0-4B76-8612-8E7D40CBE1D6}] => (Allow) C:\Games\Steam\SteamApps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{A34361BA-9BE7-4C86-A21C-8C7DEFBC6C58}] => (Allow) C:\Games\Steam\SteamApps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{EB59AEFD-8CAA-49A1-A0FB-85762BA1374B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2787\Agent.exe
FirewallRules: [{C38B14B7-1F70-430D-9B9D-A3638227091C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2787\Agent.exe
FirewallRules: [{362167BE-3C47-4A56-9B20-3834F41C2C74}] => (Allow) C:\Games\Steam\SteamApps\common\Tomb Raider\TombRaider.exe
FirewallRules: [{EDE3E294-224E-411E-B9F2-E686D9A7B2BD}] => (Allow) C:\Games\Steam\SteamApps\common\Tomb Raider\TombRaider.exe
FirewallRules: [TCP Query User{9E895FE5-47D9-44EC-ADB5-F8CD36CC6567}C:\program files\dc++\dcplusplus.exe] => (Allow) C:\program files\dc++\dcplusplus.exe
FirewallRules: [UDP Query User{DA4FD8D9-4110-4812-9E77-0E3EBAB5CA27}C:\program files\dc++\dcplusplus.exe] => (Allow) C:\program files\dc++\dcplusplus.exe
FirewallRules: [{6CB7CF6F-BAD0-4891-853F-34D5408CC9A6}] => (Allow) C:\Games\Steam\SteamApps\common\Half-Life\hl.exe
FirewallRules: [{D8D3EB50-ADD8-492D-A578-1A2F4B9FBA44}] => (Allow) C:\Games\Steam\SteamApps\common\Half-Life\hl.exe
FirewallRules: [{BDDDF143-3BAA-4FE4-9F46-06255410EA58}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{67D32E5C-69CF-4CCC-B047-A42DB7B00197}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{E8EE6DDF-CEE0-49AD-BF1E-F247CB69F64B}] => (Allow) C:\Games\Steam\SteamApps\common\RaceTheSun\RaceTheSun.exe
FirewallRules: [{0DCA372F-9ED5-424D-ACED-A89CB6D69DF2}] => (Allow) C:\Games\Steam\SteamApps\common\RaceTheSun\RaceTheSun.exe
FirewallRules: [{058CE09D-68DC-4456-92EE-6AE4B74F1777}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{AE7CEC2D-F6E1-43D2-8044-6E0DEBD52843}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{16B9D44C-16CF-4B0F-8703-7C821EAD4243}] => (Allow) C:\Games\Steam\SteamApps\common\The Stanley Parable\stanley.exe
FirewallRules: [{074BCA53-DD3E-493A-AD16-0BB2FDDF8D15}] => (Allow) C:\Games\Steam\SteamApps\common\The Stanley Parable\stanley.exe
FirewallRules: [{DE866C29-7CC2-45D0-B336-77C8E4BEEF5C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{079C533D-3C5B-40C3-88CD-FB38D4D365D0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3023\Agent.exe
FirewallRules: [{470B0E7E-EC3A-4CFD-9CFC-4A94D5C7CC71}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe
FirewallRules: [{65B53E5D-8254-4B6C-84DB-7DEB60B4FB45}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe
FirewallRules: [{342C03A4-709D-4FC8-9EB3-43BE732FD71F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{A088080A-F49B-4AC1-AA2A-B1B976EB3BFC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{CB71DDA0-161E-4A07-99CB-AF4AA47F574B}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{1D340309-582A-4C8E-A834-149F3527B833}] => (Allow) C:\Program Files (x86)\uTorrent\uTorrent.exe
FirewallRules: [{B058966B-7F3D-426F-94C9-E067BD7AA260}] => (Allow) C:\Users\Steffen\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{9B861AEE-27FC-4654-8650-E25B2113B6B8}] => (Allow) C:\Users\Steffen\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{B91B72CA-DD59-4407-B682-A9D0D75B16FC}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{4A53CACD-DDB6-4642-A71E-CF063CEA6AB8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{E23C8DC1-E840-4609-A9A1-D4612E8B425D}] => (Allow) C:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{026FD915-730B-4D86-BE27-FCF99321BD4B}] => (Allow) C:\Games\Steam\bin\steamwebhelper.exe
FirewallRules: [{26995A68-6983-4D6D-8AB5-DCBC32F27CEA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{BCBE126C-78D1-4EC0-BE80-C023DAB41D3B}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{EB676679-887D-4AD0-93BD-595D3BEA7616}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{6B604FF2-F5B7-4E69-BA16-D6EBF47C1478}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{7D224CEF-D900-4227-B732-527CB1BBFEEE}] => (Allow) C:\Games\Steam\SteamApps\common\TheBridge\The Bridge.exe
FirewallRules: [{2D205B21-7127-4E23-93C4-57C918E306A4}] => (Allow) C:\Games\Steam\SteamApps\common\TheBridge\The Bridge.exe
FirewallRules: [{0B0AC67A-F41B-4E56-8F14-2BBEEEC851C9}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{5D28AE45-C41D-4C24-9EB0-5C2B3711F16F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{B0FA20E5-E36D-4E24-AF3F-6E68FB7C41B3}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe
FirewallRules: [{C60B5262-F285-4B3B-89A9-BB7A1D17778D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3323\Agent.exe
FirewallRules: [{53A0A1FE-51E7-4927-B7C1-44D503A38841}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{BF4F2C04-98F0-44FC-B887-9AA995DE7A61}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{874ACAC7-C2D3-4F06-9D5E-B1F58FC9A3A7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3346\Agent.exe
FirewallRules: [{C51F4C22-1559-44CB-908B-233B0C4F7F33}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3346\Agent.exe
FirewallRules: [{3CC3F5F7-0FB0-4BB0-A84A-1703ECE26BA9}] => (Block) C:\games\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{23F35034-7A07-41CB-9E2C-EBF30CCCC0A3}] => (Block) C:\games\starcraft ii\versions\base28667\sc2.exe
FirewallRules: [{E1D74915-A023-4912-B4C8-7F724DDC39C5}] => (Allow) C:\Games\StarCraft II\Versions\Base32283\SC2.exe
FirewallRules: [{2C2787B1-89E5-4797-919E-57D0AAD39341}] => (Allow) C:\Games\StarCraft II\Versions\Base32283\SC2.exe
FirewallRules: [{0DC5AD96-3E90-45EF-B610-DCFD12DA9A25}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{4D7018CF-B6FB-4992-AD65-806835CBC6E8}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{BEBE44D8-90F9-4579-8889-F029C3A64F2C}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{C46E4C75-B386-4B52-B8CC-E9D7C0D3FB37}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{97E644B7-08C3-4DF2-87A5-33C8927824B9}] => (Allow) C:\Games\Far Cry 3\bin\farcry3.exe
FirewallRules: [{4FDB7DC3-B6C9-4001-A529-27E90901C21A}] => (Allow) C:\Games\Far Cry 3\bin\farcry3.exe
FirewallRules: [{24D14D2C-D62A-4AED-94F4-6678B0956F43}] => (Allow) C:\Games\Far Cry 3\bin\farcry3_d3d11.exe
FirewallRules: [{6E5B3E84-C2D6-4F7B-8EC9-C8D555B203C2}] => (Allow) C:\Games\Far Cry 3\bin\farcry3_d3d11.exe
FirewallRules: [{A4C7DC66-43E4-4E3F-9AC5-D3D9DFE014E1}] => (Allow) C:\Games\Far Cry 3\bin\FC3Updater.exe
FirewallRules: [{29FFBEEC-7EE4-4CBA-9FC6-ACB6C0FBC959}] => (Allow) C:\Games\Far Cry 3\bin\FC3Updater.exe
FirewallRules: [{0A0945CC-2B7F-4354-8DF4-359886B0885F}] => (Allow) C:\Games\Far Cry 3\bin\FC3Editor.exe
FirewallRules: [{6E8189B8-C983-4725-8A30-54B8E998D932}] => (Allow) C:\Games\Far Cry 3\bin\FC3Editor.exe
FirewallRules: [{356A6AEB-429D-458E-B7EB-6E430278F4A7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{5AB57B45-E59D-4096-8577-BC62C2FC250E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{9305E51C-0F4B-4E74-98EF-FB75582A6242}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [{37347CA5-4136-4CF1-A8E8-1E2EF44BEC82}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [TCP Query User{F70C3C4A-C8F1-40BD-A62D-CC2E8B6A71D0}C:\games\far cry 3\bin\farcry3_d3d11.exe] => (Allow) C:\games\far cry 3\bin\farcry3_d3d11.exe
FirewallRules: [UDP Query User{70DDE1C6-64C6-4DF6-940D-81CD36CBB541}C:\games\far cry 3\bin\farcry3_d3d11.exe] => (Allow) C:\games\far cry 3\bin\farcry3_d3d11.exe
FirewallRules: [{3825CCF0-3AB4-4CE7-8AC5-6025270F998F}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD8\PowerDVD8.EXE
FirewallRules: [{9152B09D-8916-4431-A691-509AF5784DDC}] => (Allow) C:\Program Files\HP\HP Officejet 6500 E710a-f\bin\FaxApplications.exe
FirewallRules: [{C7FBE8B8-F7F5-499A-B700-EF3D4C06FD5C}] => (Allow) C:\Program Files\HP\HP Officejet 6500 E710a-f\bin\DigitalWizards.exe
FirewallRules: [{2003FFE6-8771-4A27-9B2C-679204E56706}] => (Allow) C:\Program Files\HP\HP Officejet 6500 E710a-f\bin\SendAFax.exe
FirewallRules: [{13245FF3-7F44-4B67-BFE0-B3A8FFFC124C}] => (Allow) C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\DeviceSetup.exe
FirewallRules: [{8B373A03-2E64-4FEB-B48A-2ACD95DA0605}] => (Allow) C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HPNetworkCommunicator.exe
FirewallRules: [{01E92D9E-9687-44EC-848E-6C6A90C40D9E}] => (Allow) C:\Program Files\HP\HP Officejet 6500 E710a-f\Bin\HPNetworkCommunicatorCom.exe
FirewallRules: [{7D73B90C-1FC0-4ABA-89A8-EB38E32882A0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [{246E53B9-D395-4D7D-8AED-685B1316E86A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3427\Agent.exe
FirewallRules: [{E142B5AF-C070-400B-99AF-6849880577CD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{1C531777-517E-432E-B3DB-ABA07A8D2DF5}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3507\Agent.exe
FirewallRules: [{B6D70533-90DF-40A4-B984-1E703A40947A}] => (Allow) C:\Games\StarCraft II\Versions\Base32283\SC2.exe
FirewallRules: [{E86E2A17-34A8-43D4-A470-1CA1FF28E871}] => (Allow) C:\Games\StarCraft II\Versions\Base32283\SC2.exe
FirewallRules: [{D7290AAC-DA5B-49B0-B228-43034AD0B2F7}] => (Allow) C:\Games\Steam\SteamApps\common\CastleCrashers\castle.exe
FirewallRules: [{B4D73DEC-1AC0-4FED-BD3A-7DFD6825D3FC}] => (Allow) C:\Games\Steam\SteamApps\common\CastleCrashers\castle.exe
FirewallRules: [{D62297AA-957D-4D31-85AE-DAC3AFED0EC1}] => (Allow) C:\Games\Steam\SteamApps\common\NaissanceE\Binaries\Win32\UDK.exe
FirewallRules: [{1560BE9A-DD14-4EC3-A159-4DC25E34CE89}] => (Allow) C:\Games\Steam\SteamApps\common\NaissanceE\Binaries\Win32\UDK.exe
FirewallRules: [{8FA39740-26EC-4A16-A1D7-CDF7C85F7AB9}] => (Allow) C:\Games\Steam\SteamApps\common\TheLongDark\tld.exe
FirewallRules: [{2F40481B-E08B-4C25-BFCC-F2C0CF7C3FE4}] => (Allow) C:\Games\Steam\SteamApps\common\TheLongDark\tld.exe
FirewallRules: [{D368436C-13D4-49CB-B31D-8E1232731C74}] => (Allow) C:\Games\FarCry 4\bin\FarCry4.exe
FirewallRules: [{3F883A06-B691-4C65-B1ED-1FC28B4AAAF3}] => (Allow) C:\Games\FarCry 4\bin\FarCry4.exe
FirewallRules: [{5594F461-3BB8-4F48-BF61-0DD5E18F809D}] => (Allow) C:\Games\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{1F6A7B42-FE35-438E-B693-11658AA29009}] => (Allow) C:\Games\FarCry 4\bin\IGE_WPF64.exe
FirewallRules: [{40F6217B-E339-4008-9079-358CE2D0FFB9}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{20882E89-48E3-449D-9307-769109A548EC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{8A2F4B7F-93DD-46E1-A043-31CC028B139D}C:\games\farcry 4\bin\farcry4.exe] => (Allow) C:\games\farcry 4\bin\farcry4.exe
FirewallRules: [UDP Query User{108AA926-D5C0-406A-8433-FCC541CED442}C:\games\farcry 4\bin\farcry4.exe] => (Allow) C:\games\farcry 4\bin\farcry4.exe
FirewallRules: [{80E1CFDF-1F40-4717-8707-5F6A4D387F67}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{F2001165-31F9-4B38-83C1-60274D2115EA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [TCP Query User{C5A34D94-3720-436C-945C-84A9D7313087}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{AD1D72D6-C4FF-4D91-8C86-1D056AC2891B}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{10742816-B1EF-4898-BAE0-319916C34007}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Faulty Device Manager Devices =============
Name: Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC (NDIS 6.20)
Description: Realtek RTL8168D/8111D Family PCI-E Gigabit Ethernet NIC (NDIS 6.20)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Realtek
Service: RTL8167
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Universal Serial Bus (USB) Controller
Description: Universal Serial Bus (USB) Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/02/2015 00:45:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/02/2015 00:06:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: flashplayer17au_ha_install(2).exe, version: 1.0.0.14, time stamp: 0x55267d14
Faulting module name: flashplayer17au_ha_install(2).exe, version: 1.0.0.14, time stamp: 0x55267d14
Exception code: 0xc0000005
Fault offset: 0x00004cf7
Faulting process id: 0x15fc
Faulting application start time: 0xflashplayer17au_ha_install(2).exe0
Faulting application path: flashplayer17au_ha_install(2).exe1
Faulting module path: flashplayer17au_ha_install(2).exe2
Report Id: flashplayer17au_ha_install(2).exe3
Error: (06/02/2015 00:04:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/01/2015 04:30:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/01/2015 04:30:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (06/01/2015 04:20:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/31/2015 03:52:16 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (05/31/2015 03:52:15 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Error: (05/30/2015 10:39:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/30/2015 08:04:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (06/02/2015 00:44:48 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Avira Service Host service to connect.
Error: (05/30/2015 08:03:30 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (05/30/2015 08:03:29 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (05/30/2015 08:03:29 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (05/30/2015 08:03:28 PM) (Source: Disk) (EventID: 11) (User: )
Description: The driver detected a controller error on \Device\Harddisk1\DR1.
Error: (05/30/2015 01:57:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Steam Client Service service failed to start due to the following error:
%%1053
Error: (05/30/2015 01:57:02 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Steam Client Service service to connect.
Error: (05/17/2015 01:22:54 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Avira Service Host service to connect.
Error: (05/15/2015 04:30:27 PM) (Source: FWLANUSB) (EventID: 5002) (User: )
Description: AVM FRITZ!WLAN USB Stick v1.1 : Has determined that the network adapter is not functioning properly.
Error: (05/15/2015 03:41:01 PM) (Source: FWLANUSB) (EventID: 5002) (User: )
Description: AVM FRITZ!WLAN USB Stick v1.1 : Has determined that the network adapter is not functioning properly.
Microsoft Office:
=========================
Error: (06/02/2015 00:45:59 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/02/2015 00:06:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: flashplayer17au_ha_install(2).exe1.0.0.1455267d14flashplayer17au_ha_install(2).exe1.0.0.1455267d14c000000500004cf715fc01d09cb72c94778eD:\downloads\flashplayer17au_ha_install(2).exeD:\downloads\flashplayer17au_ha_install(2).exe6d98f413-08aa-11e5-9077-001f3f03bd32
Error: (06/02/2015 00:04:34 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (06/01/2015 04:30:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestc:\users\steffen\appdata\local\temp\is-p50u9.tmp\Offercast349_ATU3_.exe
Error: (06/01/2015 04:30:41 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestc:\users\steffen\appdata\local\temp\is-k6625.tmp\Offercast33_ATU3_.exe
Error: (06/01/2015 04:20:46 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/31/2015 03:52:16 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestc:\users\steffen\appdata\local\temp\is-p50u9.tmp\Offercast349_ATU3_.exe
Error: (05/31/2015 03:52:15 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestc:\users\steffen\appdata\local\temp\is-k6625.tmp\Offercast33_ATU3_.exe
Error: (05/30/2015 10:39:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (05/30/2015 08:04:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
==================== Memory info ===========================
Processor: AMD Phenom(tm) II X6 1055T Processor
Percentage of memory in use: 25%
Total physical RAM: 8188.54 MB
Available physical RAM: 6107.47 MB
Total Pagefile: 16375.28 MB
Available Pagefile: 14027.04 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: (system) (Fixed) (Total:247.92 GB) (Free:27.89 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:683.59 GB) (Free:43.61 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 11E3F74A)
Partition 1: (Active) - (Size=247.9 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=683.6 GB) - (Type=07 NTFS)
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-02 01:09:41
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-6 WDC_WD10EALS-002BA0 rev.05.01D05 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Steffen\AppData\Local\Temp\kxecrfog.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000757b1401 2 bytes JMP 75cfb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000757b1419 2 bytes JMP 75cfb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000757b1431 2 bytes JMP 75d78f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000757b144a 2 bytes CALL 75cd489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000757b14dd 2 bytes JMP 75d78822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757b14f5 2 bytes JMP 75d789f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000757b150d 2 bytes JMP 75d78718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000757b1525 2 bytes JMP 75d78ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000757b153d 2 bytes JMP 75cefca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000757b1555 2 bytes JMP 75cf68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000757b156d 2 bytes JMP 75d78fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000757b1585 2 bytes JMP 75d78b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000757b159d 2 bytes JMP 75d786dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000757b15b5 2 bytes JMP 75cefd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000757b15cd 2 bytes JMP 75cfb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000757b16b2 2 bytes JMP 75d78ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000757b16bd 2 bytes JMP 75d78671 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 0000000072aa17fa 2 bytes CALL 75cd11a9 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000072aa1860 2 bytes CALL 75cd11a9 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000072aa1942 2 bytes JMP 770b7089 C:\Windows\syswow64\WS2_32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 0000000072aa194d 2 bytes JMP 770bcba6 C:\Windows\syswow64\WS2_32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757b1401 2 bytes JMP 75cfb21b C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757b1419 2 bytes JMP 75cfb346 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757b1431 2 bytes JMP 75d78f29 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757b144a 2 bytes CALL 75cd489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757b14dd 2 bytes JMP 75d78822 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757b14f5 2 bytes JMP 75d789f8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757b150d 2 bytes JMP 75d78718 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757b1525 2 bytes JMP 75d78ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757b153d 2 bytes JMP 75cefca8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757b1555 2 bytes JMP 75cf68ef C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757b156d 2 bytes JMP 75d78fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757b1585 2 bytes JMP 75d78b42 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757b159d 2 bytes JMP 75d786dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757b15b5 2 bytes JMP 75cefd41 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757b15cd 2 bytes JMP 75cfb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757b16b2 2 bytes JMP 75d78ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1864] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757b16bd 2 bytes JMP 75d78671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757b1401 2 bytes JMP 75cfb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757b1419 2 bytes JMP 75cfb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757b1431 2 bytes JMP 75d78f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757b144a 2 bytes CALL 75cd489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757b14dd 2 bytes JMP 75d78822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757b14f5 2 bytes JMP 75d789f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757b150d 2 bytes JMP 75d78718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757b1525 2 bytes JMP 75d78ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757b153d 2 bytes JMP 75cefca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757b1555 2 bytes JMP 75cf68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757b156d 2 bytes JMP 75d78fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757b1585 2 bytes JMP 75d78b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757b159d 2 bytes JMP 75d786dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757b15b5 2 bytes JMP 75cefd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757b15cd 2 bytes JMP 75cfb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757b16b2 2 bytes JMP 75d78ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Ruiware\WinPatrol\WinPatrol.exe[2748] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757b16bd 2 bytes JMP 75d78671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757b1401 2 bytes JMP 75cfb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757b1419 2 bytes JMP 75cfb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757b1431 2 bytes JMP 75d78f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757b144a 2 bytes CALL 75cd489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757b14dd 2 bytes JMP 75d78822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757b14f5 2 bytes JMP 75d789f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757b150d 2 bytes JMP 75d78718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757b1525 2 bytes JMP 75d78ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757b153d 2 bytes JMP 75cefca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757b1555 2 bytes JMP 75cf68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757b156d 2 bytes JMP 75d78fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757b1585 2 bytes JMP 75d78b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757b159d 2 bytes JMP 75d786dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757b15b5 2 bytes JMP 75cefd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757b15cd 2 bytes JMP 75cfb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757b16b2 2 bytes JMP 75d78ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe[508] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757b16bd 2 bytes JMP 75d78671 C:\Windows\syswow64\kernel32.dll
---- EOF - GMER 2.1 ----
Steffen |
| Themen zu Windows 7: Zeitweise (sehr) hoher Ping |
| adware, antivir, antivirus, browser, desktop, downloader, failed, firefox, flash player, google, homepage, internet, launch, mozilla, officejet, problem, refresh, registry, required, rundll, scan, secur, software, stick, svchost.exe, system, teamspeak, udp, windows |
Baum-Darstellung