Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Firefox kommt auf Yahoo 404 - "page not found" (https://www.trojaner-board.de/157472-firefox-kommt-yahoo-404-page-not-found.html)

C.V.H. 11.08.2014 13:11
Firefox kommt auf Yahoo 404 - "page not found"
 
Hallo,
Ich habe seit einigen Tagen ein Problem.
Und zwar leitet mich Firefox manchmal beim aufrufen/einloggen einer neuen Seiteauf die Yahoo 404 - page not found Seite.Wisst ihr was das sein könnte?
Die FRST und GMER texte habe ich schon,poste ich wenn gewünscht.

Liebe Grüsse
Chris

schrauber 11.08.2014 13:15
hi,

dann poste mal :)

C.V.H. 11.08.2014 14:17
FRST

C.V.H. 11.08.2014 14:18
Und GMER

schrauber 11.08.2014 21:16
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

C.V.H. 11.08.2014 21:55
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-11 13:35:07
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000007e ST2000DM rev.CC29 1863,02GB
Running: wwmvbxht.exe; Driver: C:\Users\User\AppData\Local\Temp\kxldapob.sys


---- User code sections - GMER 2.1 ----

.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Windows\system32\Dwm.exe[1820] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes CALL 9000027
.text C:\Windows\Explorer.EXE[1884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes CALL 0
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef8f27b34 6 bytes JMP 0
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef8f303c0 6 bytes JMP 0
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\msi.dll!MsiSetInternalUI 000007fef1ff5cd0 6 bytes JMP c20158d0
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\msi.dll!MsiInstallProductA 000007fef2070f20 6 bytes {JMP QWORD [RIP+0x49f110]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\msi.dll!MsiInstallProductW 000007fef207faa8 6 bytes {JMP QWORD [RIP+0x650588]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007fefc943030 6 bytes {JMP QWORD [RIP+0x16fd000]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefc9445c1 5 bytes {JMP QWORD [RIP+0x160ba70]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\WS2_32.dll!listen 000007fefc948290 6 bytes {JMP QWORD [RIP+0x12b7da0]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefc96e0f0 6 bytes {JMP QWORD [RIP+0x15f1f40]}
.text C:\Windows\Explorer.EXE[1884] C:\Windows\system32\RASAPI32.dll!RasDialW + 1 000007fef1e596f5 5 bytes JMP 0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes [B5, 6F, 08]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef8f27b34 6 bytes {JMP QWORD [RIP+0x1684fc]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef8f303c0 6 bytes {JMP QWORD [RIP+0x17fc70]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007fefc943030 6 bytes {JMP QWORD [RIP+0x131d000]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefc9445c1 5 bytes {JMP QWORD [RIP+0x12bba70]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\WS2_32.dll!listen 000007fefc948290 6 bytes {JMP QWORD [RIP+0x12f7da0]}
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2380] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefc96e0f0 6 bytes {JMP QWORD [RIP+0x12b1f40]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes CALL 79000026
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\system32\ADVAPI32.dll!CreateServiceW 000007fefc9b55c8 6 bytes {JMP QWORD [RIP+0x122aa68]}
.text C:\Windows\system32\taskhost.exe[2404] C:\Windows\system32\ADVAPI32.dll!CreateServiceA 000007fefc9cb85c 6 bytes {JMP QWORD [RIP+0x11f47d4]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Program Files\Logitech\Gaming Software\LWEMon.exe[2516] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes [B5, 6F, 06]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 717e000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 717e000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 7175000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 7175000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7178000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7178000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 717b000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 717b000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7184000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7184000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 7181000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 7181000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 7172000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 7172000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 716f000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 716f000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007496575a 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\WS2_32.dll!connect 0000000074966bdd 6 bytes JMP 71ab000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\WS2_32.dll!listen 000000007496b001 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\WS2_32.dll!WSAConnect 000000007496cc3f 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 7193000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 718d000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 7190000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 7196000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 7199000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 7199000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 719f000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 719c000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7187000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 718a000a
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2532] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes [B5, 6F, 06]
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef8f27b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe[2544] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef8f303c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes [B5, 6F, 06]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef8f27b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[2560] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef8f303c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes [B5, 6F, 06]
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007fefc943030 6 bytes {JMP QWORD [RIP+0x16dd000]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefc9445c1 5 bytes {JMP QWORD [RIP+0x127ba70]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\WS2_32.dll!listen 000007fefc948290 6 bytes {JMP QWORD [RIP+0x12b7da0]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefc96e0f0 6 bytes {JMP QWORD [RIP+0x1271f40]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef8f27b34 6 bytes {JMP QWORD [RIP+0x884fc]}
.text C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[2672] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef8f303c0 6 bytes JMP 0
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076d51510 6 bytes {JMP QWORD [RIP+0x93eeb20]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile 0000000076d51520 6 bytes {JMP QWORD [RIP+0x944eb10]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile 0000000076d515e0 6 bytes {JMP QWORD [RIP+0x942ea50]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile 0000000076d51800 6 bytes {JMP QWORD [RIP+0x940e830]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtSetValueKey 0000000076d518b0 6 bytes {JMP QWORD [RIP+0x93ae780]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteValueKey 0000000076d51e40 6 bytes {JMP QWORD [RIP+0x93ce1f0]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076d527e0 6 bytes {JMP QWORD [RIP+0x946d850]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076bfdb80 6 bytes {JMP QWORD [RIP+0x95e24b0]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW + 357 000007fefbbc9055 3 bytes CALL 9000027
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorA 000007fef8f27b34 6 bytes JMP 300030
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\WINSPOOL.DRV!AddPrintProvidorW 000007fef8f303c0 6 bytes {JMP QWORD [RIP+0x9fc70]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\WS2_32.dll!WSALookupServiceBeginW 000007fefc943030 6 bytes {JMP QWORD [RIP+0x16dd000]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefc9445c1 5 bytes {JMP QWORD [RIP+0x127ba70]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\WS2_32.dll!listen 000007fefc948290 6 bytes {JMP QWORD [RIP+0x12b7da0]}
.text C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[2692] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefc96e0f0 6 bytes {JMP QWORD [RIP+0x1271f40]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 7145000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 7145000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 713c000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 713c000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 713f000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 713f000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7142000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7142000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7190000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7190000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 718d000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 718d000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes [38, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 7136000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 7136000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes {JMP QWORD [RIP+0x7195001e]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 719f000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes {JMP QWORD [RIP+0x7198001e]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes {JMP QWORD [RIP+0x719b001e]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes {JMP QWORD [RIP+0x71a1001e]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes [A4, 71]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes {JMP QWORD [RIP+0x71aa001e]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes {JMP QWORD [RIP+0x71a7001e]}
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007496575a 6 bytes JMP 712a000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\WS2_32.dll!connect 0000000074966bdd 6 bytes JMP 7133000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\WS2_32.dll!listen 000000007496b001 6 bytes JMP 712d000a
.text C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2392] C:\Windows\syswow64\WS2_32.dll!WSAConnect 000000007496cc3f 6 bytes JMP 7130000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 718a000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 718a000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 7181000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 7181000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7184000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7184000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7187000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7187000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7190000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7190000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 718d000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 718d000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 717e000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 717e000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 717b000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 717b000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 719f000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 7199000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 719c000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 71a2000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 71a5000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 71a5000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 71ab000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 71a8000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7193000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 7196000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007496575a 6 bytes JMP 716f000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\WS2_32.dll!connect 0000000074966bdd 6 bytes JMP 7178000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\WS2_32.dll!listen 000000007496b001 6 bytes JMP 7172000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\WS2_32.dll!WSAConnect 000000007496cc3f 6 bytes JMP 7175000a
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe[2476] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 718a000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 718a000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 7181000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 7181000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7190000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7190000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 718d000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 718d000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 717b000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 717b000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 719f000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 7199000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 719c000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 71a5000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 71a5000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 71ab000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7193000a
.text C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[2576] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 718a000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 718a000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 7181000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 7181000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7184000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7184000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7190000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7190000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 718d000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 718d000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 717b000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 717b000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 719f000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 7199000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 719c000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 71a5000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 71a5000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 71ab000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7193000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text

C.V.H. 11.08.2014 21:58
Teil 2

... * 2
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007496575a 6 bytes JMP 716f000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\WS2_32.dll!connect 0000000074966bdd 6 bytes JMP 7178000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\WS2_32.dll!listen 000000007496b001 6 bytes JMP 7172000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[3156] C:\Windows\syswow64\WS2_32.dll!WSAConnect 000000007496cc3f 6 bytes JMP 7175000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 717e000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 717e000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 7175000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 7175000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7178000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7178000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 717b000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 717b000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7184000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7184000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 7181000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 7181000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 7172000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 7172000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 716f000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 716f000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007496575a 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\WS2_32.dll!connect 0000000074966bdd 6 bytes JMP 71ab000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\WS2_32.dll!listen 000000007496b001 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\WS2_32.dll!WSAConnect 000000007496cc3f 6 bytes JMP 71a8000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 7193000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 718d000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 7190000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 7196000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 7199000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 7199000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 719f000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 719c000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7187000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 718a000a
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\AVG\AVG2014\avgui.exe[3556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 7178000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 7178000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 716f000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 716f000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7172000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7172000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7175000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7175000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 717e000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 717e000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 717b000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 717b000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 716c000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 716c000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 7169000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 7169000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 718d000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 7187000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 718a000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 7190000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 7193000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 7193000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 7199000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7181000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 7184000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\WS2_32.dll!WSALookupServiceBeginW 000000007496575a 6 bytes JMP 719c000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\WS2_32.dll!connect 0000000074966bdd 6 bytes JMP 71a5000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\WS2_32.dll!listen 000000007496b001 6 bytes JMP 719f000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\WS2_32.dll!WSAConnect 000000007496cc3f 6 bytes JMP 71a2000a
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[3616] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe[3784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe[3784] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 7184000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 7184000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 717b000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 717b000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 717e000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 717e000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7181000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7181000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 718a000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 718a000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 7187000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 7187000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 7178000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 7178000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 7175000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 7175000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 7199000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 7193000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 7196000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 719c000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 719f000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 719f000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 71a5000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 71a2000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 718d000a
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2912] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 7190000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 718a000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 718a000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 7181000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 7181000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7184000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7184000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7187000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7187000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7190000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7190000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 718d000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 718d000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 717e000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 717e000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 717b000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 717b000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 719f000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 7199000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 719c000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 71a2000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 71a5000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 71a5000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 71ab000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 71a8000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7193000a
.text C:\Windows\SysWOW64\ctfmon.exe[4856] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 7196000a
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[4680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[4680] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[7472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[7472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076211465 2 bytes [21, 76]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5364] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000762114bb 2 bytes [21, 76]
.text ... * 2
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 718a000a
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 718a000a
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes [80, 71]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes [83, 71]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7187000a
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7187000a
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes [8F, 71]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes [8C, 71]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes [7D, 71]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes [FF, 25, 1E]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes [7A, 71]
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes {JMP QWORD [RIP+0x7192001e]}
.text C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe[3636] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes {JMP QWORD [RIP+0x7195001e]}
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess 0000000076effc20 3 bytes JMP 718a000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtOpenProcess + 4 0000000076effc24 2 bytes JMP 718a000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile 0000000076effc38 3 bytes JMP 7181000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtSetInformationFile + 4 0000000076effc3c 2 bytes JMP 7181000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile 0000000076effd64 3 bytes JMP 7184000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtOpenFile + 4 0000000076effd68 2 bytes JMP 7184000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile 0000000076f000b4 3 bytes JMP 7187000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtCreateFile + 4 0000000076f000b8 2 bytes JMP 7187000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey 0000000076f001c4 3 bytes JMP 7190000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtSetValueKey + 4 0000000076f001c8 2 bytes JMP 7190000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey 0000000076f00a44 3 bytes JMP 718d000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtDeleteValueKey + 4 0000000076f00a48 2 bytes JMP 718d000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000076f01920 3 bytes JMP 717e000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread + 4 0000000076f01924 2 bytes JMP 717e000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000076733bbb 3 bytes JMP 717b000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW + 4 0000000076733bbf 2 bytes JMP 717b000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW + 493 0000000076342c9e 4 bytes CALL 71af0000
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!SendMessageW 0000000076569679 6 bytes JMP 719f000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!PostMessageW 00000000765712a5 6 bytes JMP 7199000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!PostMessageA 0000000076573baa 6 bytes JMP 719c000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!SendMessageA 000000007657612e 6 bytes JMP 71a2000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!SendInput 000000007658ff4a 3 bytes JMP 71a5000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!SendInput + 4 000000007658ff4e 2 bytes JMP 71a5000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!mouse_event 00000000765c027b 6 bytes JMP 71ab000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\USER32.dll!keybd_event 00000000765c02bf 6 bytes JMP 71a8000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceW 0000000074b270c4 6 bytes JMP 7193000a
.text C:\Users\User\Downloads\wwmvbxht.exe[7768] C:\Windows\syswow64\ADVAPI32.dll!CreateServiceA 0000000074b43264 6 bytes JMP 7196000a

---- Threads - GMER 2.1 ----

Thread C:\Windows\SysWOW64\ntdll.dll [3768:3796] 0000000001221c24
Thread C:\Windows\SysWOW64\ntdll.dll [3768:3996] 00000000655be6a6
Thread C:\Windows\SysWOW64\ntdll.dll [3768:4808] 00000000648a319b
Thread C:\Windows\SysWOW64\ntdll.dll [3768:6760] 00000000615f67e9
Thread C:\Windows\SysWOW64\ntdll.dll [3768:5160] 000000005fcbeea8
Thread C:\Windows\SysWOW64\ntdll.dll [3768:4900] 000000005fcbeea8
Thread C:\Windows\SysWOW64\ntdll.dll [3768:6508] 000000005fcbeea8
Thread C:\Windows\SysWOW64\ntdll.dll [3768:1852] 000000006ab01854
---- Processes - GMER 2.1 ----

Library C:\Users\User\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2476](2014-07-21 20:53:38) 0000000004240000
Library c:\users\user\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmmb8lz.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2476](2014-08-10 20:47:04) 00000000046a0000
Library C:\Users\User\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2476](2013-10-18 23:55:02) 0000000056790000
Library C:\Users\User\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe [2476] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00) 0000000055e00000

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{B138311B-F538-4AA5-BF90-BDB2D959CC61}\Connection@Name isatap.{6DC68DA2-3F3A-47BF-9C4A-B2C436865067}
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{760CAB91-9F3F-42ED-951B-0D932FA493D8}?\Device\{F46BE5F9-9786-4034-8258-AFFDA64A4306}?\Device\{B138311B-F538-4AA5-BF90-BDB2D959CC61}?\Device\{93A936EF-BB19-4300-874D-1465A40EB742}?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{760CAB91-9F3F-42ED-951B-0D932FA493D8}"?"{F46BE5F9-9786-4034-8258-AFFDA64A4306}"?"{B138311B-F538-4AA5-BF90-BDB2D959CC61}"?"{93A936EF-BB19-4300-874D-1465A40EB742}"?
Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{760CAB91-9F3F-42ED-951B-0D932FA493D8}?\Device\TCPIP6TUNNEL_{F46BE5F9-9786-4034-8258-AFFDA64A4306}?\Device\TCPIP6TUNNEL_{B138311B-F538-4AA5-BF90-BDB2D959CC61}?\Device\TCPIP6TUNNEL_{93A936EF-BB19-4300-874D-1465A40EB742}?
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\240a648b25dd
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{B138311B-F538-4AA5-BF90-BDB2D959CC61}@InterfaceName isatap.{6DC68DA2-3F3A-47BF-9C4A-B2C436865067}
Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{B138311B-F538-4AA5-BF90-BDB2D959CC61}@ReusableType 0
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\240a648b25dd (not active ControlSet)

---- EOF - GMER 2.1 ----
FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-08-2014 01
Ran by User (administrator) on USER-PC on 11-08-2014 12:49:48
Running from C:\Users\User\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Emsisoft GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Dropbox, Inc.) C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
() C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
() C:\Windows\SysWOW64\ASGT.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(DTS, Inc) C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_206.exe
(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
(Farbar) C:\Users\User\Downloads\FRST64(1).exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Start WingMan Profiler] => C:\Program Files\Logitech\Gaming Software\LWEMon.exe [190536 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7202520 2013-08-19] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-07] (Realtek Semiconductor)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2013-08-07] (Intel Corporation)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\btvstack.exe [1023104 2012-11-29] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\athbttray.exe [801920 2012-11-29] (Atheros Commnucations)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2352072 2014-05-30] (NVIDIA Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-07-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-12-21] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [emsisoft anti-malware] => c:\program files (x86)\emsisoft anti-malware\a2guard.exe [4841824 2014-07-09] (Emsisoft GmbH)
HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5187088 2014-07-10] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3873043628-1780199607-4098311539-1000\...\Run: [CAHeadless] => C:\Program Files (x86)\Adobe\Elements 12 Organizer\CAHeadless\ElementsAutoAnalyzer.exe [1400224 2013-09-03] (Adobe Systems Incorporated)
HKU\S-1-5-21-3873043628-1780199607-4098311539-1000\...\MountPoints2: {a6da1b58-cc5c-11e3-9437-806e6f6e6963} - D:\CH-Fahrschule.exe
HKU\S-1-5-21-3873043628-1780199607-4098311539-1000\...\MountPoints2: {eabf4717-cc57-11e3-a8d9-806e6f6e6963} - D:\.\Bin\ASSETUP.exe
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt1" -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt2" -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt3" -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt4" -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt5" -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt6" -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt7" -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: "DropboxExt8" -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6DE76A2ECC72CF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\coIEPlg.dll (Symantec Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 62.2.17.60 62.2.24.162 62.2.17.61 62.2.24.158

FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\l2fwmsro.default
FF SelectedSearchEngine: Google
FF Homepage: www.google.ch
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_206.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\l2fwmsro.default\searchplugins\trovi-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownThemAll! - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\l2fwmsro.default\Extensions\{DDC359D1-844A-42a7-9AA1-88A850A938A8}.xpi [2014-07-17]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\IPSFFPlgn
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\IPSFFPlgn [2014-05-18]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\coFFPlgn [2014-08-10]

Chrome:
=======
CHR HomePage: http:\/\/www.google.com\/
CHR StartupUrls: ""
CHR DefaultSearchKeyword: trovi.search
CHR DefaultNewTabURL:
CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-09]
CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-09]
CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-09]
CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-09]
CHR Extension: (Skype Click to Call) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-08-08]
CHR Extension: (Norton Security Toolbar) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-07-09]
CHR Extension: (Google Wallet) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-09]
CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-09]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\Exts\Chrome.crx [2014-05-18]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [4741384 2014-07-09] (Emsisoft GmbH)
R2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-21] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-21] (Avira Operations GmbH & Co. KG)
R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe [936728 2013-05-17] ()
R2 ASGT; C:\Windows\SysWOW64\ASGT.exe [55296 2012-01-17] () [File not signed]
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3244048 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-07-10] (AVG Technologies CZ, s.r.o.)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
R2 DTSAudioSvc; C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [240584 2012-10-02] (DTS, Inc)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2013-08-07] (Intel Corporation)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\ccSvcHst.exe [143928 2012-06-14] (Symantec Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1631008 2014-05-30] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21055432 2014-05-30] (NVIDIA Corporation)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [327296 2012-11-29] (Atheros)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [71472 2014-05-12] (Emsisoft GmbH)
R1 A2DDA; C:\Program Files (x86)\Emsisoft Anti-Malware\a2ddax64.sys [26176 2013-03-28] (Emsisoft GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [45208 2013-09-30] (Emsisoft GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [23088 2014-05-12] (Emsisoft GmbH)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2013-06-02] (Wondershare)
R0 asahci64; C:\Windows\System32\DRIVERS\asahci64.sys [47512 2013-01-10] (Asmedia Technology)
R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [15232 2013-05-17] ()
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [242968 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-06-17] (AVG Technologies CZ, s.r.o.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-09] (Avira Operations GmbH & Co. KG)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-06-17] (AVG Technologies CZ, s.r.o.)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-07-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-02-25] (Avira Operations GmbH & Co. KG)
R3 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\BASHDefs\20120615.003\BHDrvx64.sys [1377440 2012-06-11] (Symantec Corporation)
R3 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1400000.088\ccSetx64.sys [168608 2012-05-25] (Symantec Corporation)
R3 cleanhlp; C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [57024 2013-12-04] (Emsisoft GmbH)
R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [495376 2013-05-30] (Intel Corporation)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2013-08-07] (Intel Corporation)
R3 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\IPSDefs\20120611.002\IDSVia64.sys [509088 2012-06-11] (Symantec Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-03] (Intel Corporation)
S3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [8192 2005-03-29] ()
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20120616.009\ENG64.SYS [120440 2012-06-16] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.0.0.136\Definitions\VirusDefs\20120616.009\EX64.SYS [2068600 2012-06-16] (Symantec Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-05-30] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)
S3 SRTSP; C:\Windows\system32\drivers\NISx64\1400000.088\SRTSP64.SYS [753312 2012-05-25] (Symantec Corporation)
R3 SRTSPX; C:\Windows\system32\drivers\NISx64\1400000.088\SRTSPX64.SYS [37496 2012-01-11] (Symantec Corporation)
R3 SymDS; C:\Windows\system32\drivers\NISx64\1400000.088\SYMDS64.SYS [485024 2012-05-25] (Symantec Corporation)
R3 SymEFA; C:\Windows\system32\drivers\NISx64\1400000.088\SYMEFA64.SYS [1129120 2012-05-21] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2014-05-18] (Symantec Corporation)
R3 SymIRON; C:\Windows\system32\drivers\NISx64\1400000.088\Ironx64.SYS [222368 2012-05-25] (Symantec Corporation)
R3 SymNetS; C:\Windows\system32\drivers\NISx64\1400000.088\SYMNETS.SYS [431224 2012-05-09] (Symantec Corporation)
S3 cpuz137; \??\C:\Windows\TEMP\cpuz137\cpuz137_x64.sys [X]
S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]
R4 IOMap; \??\C:\Windows\system32\drivers\IOMap64.sys [X]
S0 PxHlpa64; System32\drivers\PxHlpa64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-11 12:49 - 2014-08-11 12:49 - 02099712 _____ (Farbar) C:\Users\User\Downloads\FRST64(1).exe
2014-08-10 22:47 - 2014-08-10 22:48 - 00043878 _____ () C:\Users\User\Downloads\Addition.txt
2014-08-10 22:44 - 2014-08-11 12:49 - 00024609 _____ () C:\Users\User\Downloads\FRST.txt
2014-08-10 22:44 - 2014-08-11 12:49 - 00000000 ____D () C:\FRST
2014-08-10 22:44 - 2014-08-10 22:44 - 00001970 _____ () C:\Windows\PFRO.log
2014-08-10 22:43 - 2014-08-10 22:44 - 02099712 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-08-09 15:19 - 2014-08-09 15:19 - 00069340 _____ () C:\Users\User\Documents\OS 737 land loww 29.frc
2014-08-09 15:14 - 2014-08-09 15:14 - 00000000 ____D () C:\ProgramData\Emsisoft
2014-08-09 15:06 - 2014-08-09 14:36 - 00000000 ____D () C:\Users\User\Desktop\Unbenannter Export
2014-08-09 15:03 - 2014-08-09 15:03 - 00000000 ____D () C:\Users\User\Documents\ProcAlyzer Dumps
2014-08-09 14:59 - 2014-08-09 14:59 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\User\Downloads\tdsskiller.exe
2014-08-09 14:59 - 2014-08-09 14:59 - 00192698 _____ () C:\Users\User\Documents\LX563 climbing.frc
2014-08-09 14:57 - 2011-10-26 14:54 - 14859848 _____ () C:\Users\User\Desktop\PMDG_737NGX_800WL_OS1.ptp
2014-08-09 14:55 - 2014-08-09 14:55 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVG2014
2014-08-09 14:54 - 2014-08-10 22:44 - 00000470 _____ () C:\Users\User\Desktop\defogger_disable.log
2014-08-09 14:53 - 2014-08-09 14:53 - 00050477 _____ () C:\Users\User\Desktop\Defogger(1).exe
2014-08-09 14:53 - 2014-08-09 14:53 - 00000981 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-08-09 14:53 - 2014-08-09 14:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-08-09 14:53 - 2014-08-09 14:53 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software
2014-08-09 14:53 - 2014-08-09 14:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-08-09 14:52 - 2014-08-09 14:52 - 00050477 _____ () C:\Users\User\Downloads\Defogger.exe
2014-08-09 14:52 - 2014-08-09 14:52 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-08-09 14:52 - 2014-08-09 14:52 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-08-09 14:52 - 2014-08-09 14:52 - 00000470 _____ () C:\Users\User\Downloads\defogger_disable.log
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\Users\User\AppData\Local\gtk-2.0
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\Users\User\.thumbnails
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Drzewiecki Design
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 _____ () C:\Users\User\defogger_reenable
2014-08-09 14:51 - 2014-08-09 15:06 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-09 14:51 - 2014-08-09 14:52 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-09 14:51 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-08-09 14:50 - 2014-08-09 15:23 - 00000000 ____D () C:\ProgramData\AVG2014
2014-08-09 14:50 - 2014-08-09 14:50 - 00051469 _____ () C:\Users\User\Documents\LX563 taxi to rwy.frc
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ___HD () C:\$AVG
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\Users\User\AppData\Roaming\Abelssoft
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\Users\User\AppData\Local\Abelssoft
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-08-09 14:49 - 2014-08-09 14:49 - 00001452 _____ () C:\Users\User\Desktop\Goodgame Empire.lnk
2014-08-09 14:49 - 2014-08-09 14:49 - 00001054 _____ () C:\Users\Public\Desktop\CHIP Updater.lnk
2014-08-09 14:49 - 2014-08-09 14:49 - 00000000 ____D () C:\Users\User\AppData\Roaming\DesktopIconGoodgame
2014-08-09 14:49 - 2014-08-09 14:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CHIP Updater
2014-08-09 14:49 - 2014-08-09 14:49 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-08-09 14:48 - 2014-08-09 14:48 - 01101648 _____ () C:\Users\User\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2014-08-09 14:48 - 2014-08-09 14:48 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-08-09 14:46 - 2014-08-11 12:47 - 00000000 ____D () C:\ProgramData\MFAData
2014-08-09 14:46 - 2014-08-09 15:00 - 00000000 ____D () C:\Users\User\AppData\Local\Avg2014
2014-08-09 14:46 - 2014-08-09 14:46 - 00000000 ____D () C:\Users\User\AppData\Local\MFAData
2014-08-09 14:46 - 2014-08-09 14:46 - 00000000 ____D () C:\Users\User\AppData\Local\gegl-0.2
2014-08-09 14:46 - 2014-08-09 14:42 - 00000000 ____D () C:\Users\User\.gimp-2.8
2014-08-09 14:44 - 2014-08-09 14:45 - 168801544 _____ (AVG Technologies) C:\Users\User\Downloads\avg_avct_x64_all_2014_4744a7830.exe
2014-08-09 14:44 - 2014-08-09 14:44 - 00000894 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-08-09 14:43 - 2014-08-10 22:48 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-08-09 14:43 - 2014-08-09 14:44 - 00000000 ____D () C:\Program Files\GIMP 2
2014-08-09 14:43 - 2014-08-09 14:43 - 00001095 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-08-09 14:43 - 2014-08-09 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-08-09 14:41 - 2014-08-09 14:43 - 201035376 _____ (Emsisoft GmbH ) C:\Users\User\Downloads\EmsisoftAntiMalwareSetup.exe
2014-08-09 14:41 - 2014-08-09 14:41 - 90396104 _____ (The GIMP Team ) C:\Users\User\Downloads\gimp-2.8.10-setup.exe
2014-08-09 14:31 - 2014-08-09 14:31 - 00001490 _____ () C:\Users\User\AppData\Local\recently-used.xbel
2014-08-09 14:28 - 2014-08-09 14:47 - 00019279 _____ () C:\Users\User\Documents\LX563 pushback.frc
2014-08-08 21:20 - 2014-08-08 20:39 - 00000000 ____D () C:\Users\User\AppData\Roaming\Virtuali
2014-08-08 21:18 - 2014-08-08 21:18 - 00000000 ____D () C:\ProgramData\Virtuali
2014-08-08 21:17 - 2014-08-08 21:18 - 18205840 _____ (VIRTUALI Sagl ) C:\Users\User\Downloads\setup_addonmanagerX.exe
2014-08-08 20:59 - 2014-08-08 20:59 - 00000000 ____D () C:\Users\User\AppData\Local\World_of_AI
2014-08-08 20:54 - 2014-08-09 14:57 - 00000000 ____D () C:\Users\User\Desktop\IG
2014-08-08 20:48 - 2014-08-09 14:52 - 00000000 ____D () C:\Users\User\Desktop\WoAI
2014-08-08 20:41 - 2014-08-08 20:42 - 00000000 ____D () C:\Gramblr
2014-08-08 20:41 - 2014-08-08 20:41 - 00000654 _____ () C:\Users\User\Desktop\Gramblr.lnk
2014-08-08 20:41 - 2014-08-08 20:41 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gramblr
2014-07-21 18:29 - 2014-07-21 18:29 - 00055761 _____ () C:\Users\User\Documents\ab 738 to 28.frc
2014-07-21 18:25 - 2014-07-21 18:25 - 00028159 _____ () C:\Users\User\Documents\ab 738.frc
2014-07-21 18:19 - 2014-07-21 18:19 - 00000000 ____D () C:\Program Files (x86)\PMDG Operations Center
2014-07-21 18:10 - 2014-07-21 18:10 - 00036780 _____ () C:\Users\User\Documents\AB 737 descent.frc
2014-07-21 18:01 - 2014-07-21 18:05 - 00009440 _____ () C:\Users\User\Desktop\AB B738 takeoff lszh.wlmp
2014-07-21 18:00 - 2014-07-21 18:00 - 00000000 ____D () C:\Users\User\AppData\Local\DriverToolkit
2014-07-21 17:59 - 2014-07-21 18:05 - 00000000 ____D () C:\Program Files (x86)\DriverToolkit
2014-07-21 17:59 - 2014-07-21 17:59 - 02395840 _____ (Megaify Software ) C:\Users\User\Downloads\driver_setup.exe
2014-07-21 17:59 - 2014-07-21 17:59 - 00061940 _____ () C:\Users\User\Documents\Ab 737 takeoff 28 lszh.frc
2014-07-21 17:57 - 2014-07-21 17:57 - 00000000 ____D () C:\Users\User\AppData\Local\Skype
2014-07-21 17:56 - 2014-08-09 15:15 - 00000000 ____D () C:\ProgramData\Skype
2014-07-21 17:56 - 2014-08-09 14:32 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-07-21 17:56 - 2014-07-21 17:56 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-07-21 17:55 - 2014-07-21 17:55 - 01677928 _____ (Skype Technologies S.A.) C:\Users\User\Downloads\SkypeSetup.exe
2014-07-21 17:52 - 2014-07-21 17:52 - 00022720 _____ () C:\Users\User\Documents\AB 737 pushback.frc
2014-07-17 12:33 - 2014-07-17 12:33 - 00112593 _____ () C:\Users\User\Documents\frfghjj.frc
2014-07-17 12:27 - 2014-07-17 12:27 - 00091207 _____ () C:\Users\User\Documents\AB2876 takeoff muc.frc
2014-07-17 12:26 - 2014-07-17 12:26 - 00098607 _____ () C:\Users\User\Documents\AB2876 landing ltaiä.frc
2014-07-17 12:13 - 2014-07-17 12:13 - 02050655 _____ (Anthony Ribeiro ) C:\Users\User\Downloads\Boeing 747-8i Lufthansa v1.00.exe
2014-07-17 12:12 - 2014-07-17 12:12 - 46507041 _____ (SkySpirit2012 ) C:\Users\User\Downloads\Boeing 747-8i Basepack v1.40.exe
2014-07-17 11:50 - 2014-07-17 11:50 - 00003480 ____N () C:\bootsqm.dat
2014-07-17 11:49 - 2014-07-17 11:49 - 00000000 __SHD () C:\found.000
2014-07-15 21:55 - 2014-07-15 21:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exif Viewer
2014-07-15 21:54 - 2014-07-15 21:54 - 00961360 _____ (Chip Digital GmbH) C:\Users\User\Downloads\Exif Viewer - CHIP-Installer.exe
2014-07-15 21:54 - 2014-07-15 21:54 - 00000000 ____D () C:\Windows\uninstall

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-11 12:50 - 2014-08-10 22:44 - 00024609 _____ () C:\Users\User\Downloads\FRST.txt
2014-08-11 12:49 - 2014-08-11 12:49 - 02099712 _____ (Farbar) C:\Users\User\Downloads\FRST64(1).exe
2014-08-11 12:49 - 2014-08-10 22:44 - 00000000 ____D () C:\FRST
2014-08-11 12:48 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-11 12:48 - 2009-07-14 06:45 - 00021888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-11 12:47 - 2014-08-09 14:46 - 00000000 ____D () C:\ProgramData\MFAData
2014-08-10 22:49 - 2014-05-19 20:36 - 01414223 _____ () C:\Windows\WindowsUpdate.log
2014-08-10 22:48 - 2014-08-10 22:47 - 00043878 _____ () C:\Users\User\Downloads\Addition.txt
2014-08-10 22:48 - 2014-08-09 14:43 - 00000000 ____D () C:\Program Files (x86)\Emsisoft Anti-Malware
2014-08-10 22:47 - 2014-07-09 20:59 - 00000000 ___RD () C:\Users\User\Dropbox
2014-08-10 22:47 - 2014-07-09 20:52 - 00000000 ____D () C:\Users\User\AppData\Roaming\Dropbox
2014-08-10 22:46 - 2014-05-19 20:33 - 00015076 _____ () C:\Windows\setupact.log
2014-08-10 22:46 - 2014-05-09 18:32 - 00001102 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-10 22:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-10 22:44 - 2014-08-10 22:44 - 00001970 _____ () C:\Windows\PFRO.log
2014-08-10 22:44 - 2014-08-10 22:43 - 02099712 _____ (Farbar) C:\Users\User\Downloads\FRST64.exe
2014-08-10 22:44 - 2014-08-09 14:54 - 00000470 _____ () C:\Users\User\Desktop\defogger_disable.log
2014-08-10 22:44 - 2014-04-25 12:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-10 22:44 - 2009-07-14 06:45 - 00628392 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-09 15:23 - 2014-08-09 14:50 - 00000000 ____D () C:\ProgramData\AVG2014
2014-08-09 15:22 - 2014-07-09 23:51 - 00000472 _____ () C:\Windows\Pitch Target
2014-08-09 15:22 - 2014-07-09 23:51 - 00000466 _____ () C:\Windows\Roll Target
2014-08-09 15:22 - 2014-07-09 23:51 - 00000462 _____ () C:\Windows\Roll Error
2014-08-09 15:22 - 2014-07-09 23:51 - 00000462 _____ () C:\Windows\Pitch Error
2014-08-09 15:22 - 2014-07-09 23:51 - 00000462 _____ () C:\Windows\Gyro Speed
2014-08-09 15:22 - 2014-07-09 23:51 - 00000423 _____ () C:\Windows\Mode2BTimer
2014-08-09 15:22 - 2014-07-09 23:51 - 00000423 _____ () C:\Windows\Mode2_AltGain_timer
2014-08-09 15:22 - 2014-07-09 23:51 - 00000419 _____ () C:\Windows\Mode2ATimer
2014-08-09 15:22 - 2014-07-09 23:51 - 00000271 _____ () C:\Windows\CDU.1
2014-08-09 15:22 - 2014-07-09 23:51 - 00000271 _____ () C:\Windows\CDU.0
2014-08-09 15:20 - 2014-05-01 20:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\aerosoft
2014-08-09 15:19 - 2014-08-09 15:19 - 00069340 _____ () C:\Users\User\Documents\OS 737 land loww 29.frc
2014-08-09 15:16 - 2014-05-03 12:33 - 00024400 _____ () C:\Users\User\AppData\Roaming\Notepad2.ini
2014-08-09 15:15 - 2014-07-21 17:56 - 00000000 ____D () C:\ProgramData\Skype
2014-08-09 15:15 - 2014-04-25 11:27 - 00167000 _____ () C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-09 15:14 - 2014-08-09 15:14 - 00000000 ____D () C:\ProgramData\Emsisoft
2014-08-09 15:06 - 2014-08-09 14:51 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-08-09 15:04 - 2014-05-09 18:32 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-09 15:03 - 2014-08-09 15:03 - 00000000 ____D () C:\Users\User\Documents\ProcAlyzer Dumps
2014-08-09 15:02 - 2014-05-03 12:04 - 00000000 ____D () C:\Users\User\AppData\Local\CrashDumps
2014-08-09 15:01 - 2014-05-02 21:45 - 00000000 ____D () C:\Users\User\Documents\Flight Simulator X-Dateien
2014-08-09 15:01 - 2014-05-02 12:32 - 00000000 ____D () C:\Program Files (x86)\FS Recorder for FSX
2014-08-09 15:01 - 2014-05-01 10:01 - 00000000 ____D () C:\ProgramData\TEMP
2014-08-09 15:00 - 2014-08-09 14:46 - 00000000 ____D () C:\Users\User\AppData\Local\Avg2014
2014-08-09 14:59 - 2014-08-09 14:59 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\User\Downloads\tdsskiller.exe
2014-08-09 14:59 - 2014-08-09 14:59 - 00192698 _____ () C:\Users\User\Documents\LX563 climbing.frc
2014-08-09 14:57 - 2014-08-08 20:54 - 00000000 ____D () C:\Users\User\Desktop\IG
2014-08-09 14:55 - 2014-08-09 14:55 - 00000000 ____D () C:\Users\User\AppData\Roaming\AVG2014
2014-08-09 14:53 - 2014-08-09 14:53 - 00050477 _____ () C:\Users\User\Desktop\Defogger(1).exe
2014-08-09 14:53 - 2014-08-09 14:53 - 00000981 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-08-09 14:53 - 2014-08-09 14:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-08-09 14:53 - 2014-08-09 14:53 - 00000000 ____D () C:\Users\User\AppData\Roaming\TuneUp Software
2014-08-09 14:53 - 2014-08-09 14:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG
2014-08-09 14:52 - 2014-08-09 14:52 - 00050477 _____ () C:\Users\User\Downloads\Defogger.exe
2014-08-09 14:52 - 2014-08-09 14:52 - 00001395 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-08-09 14:52 - 2014-08-09 14:52 - 00001383 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-08-09 14:52 - 2014-08-09 14:52 - 00000470 _____ () C:\Users\User\Downloads\defogger_disable.log
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\Users\User\AppData\Local\gtk-2.0
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\Users\User\.thumbnails
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Drzewiecki Design
2014-08-09 14:52 - 2014-08-09 14:52 - 00000000 _____ () C:\Users\User\defogger_reenable
2014-08-09 14:52 - 2014-08-09 14:51 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-08-09 14:52 - 2014-08-08 20:48 - 00000000 ____D () C:\Users\User\Desktop\WoAI
2014-08-09 14:50 - 2014-08-09 14:50 - 00051469 _____ () C:\Users\User\Documents\LX563 taxi to rwy.frc
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ___HD () C:\$AVG
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\Windows\System32\Tasks\Abelssoft
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\Users\User\AppData\Roaming\Abelssoft
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\Users\User\AppData\Local\Abelssoft
2014-08-09 14:50 - 2014-08-09 14:50 - 00000000 ____D () C:\ProgramData\XDMessagingv4
2014-08-09 14:49 - 2014-08-09 14:49 - 00001452 _____ () C:\Users\User\Desktop\Goodgame Empire.lnk
2014-08-09 14:49 - 2014-08-09 14:49 - 00001054 _____ () C:\Users\Public\Desktop\CHIP Updater.lnk
2014-08-09 14:49 - 2014-08-09 14:49 - 00000000 ____D () C:\Users\User\AppData\Roaming\DesktopIconGoodgame
2014-08-09 14:49 - 2014-08-09 14:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CHIP Updater
2014-08-09 14:49 - 2014-08-09 14:49 - 00000000 ____D () C:\Program Files (x86)\CHIP Updater
2014-08-09 14:49 - 2014-07-09 20:55 - 00000000 ____D () C:\Program Files\Adobe
2014-08-09 14:49 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-08-09 14:48 - 2014-08-09 14:48 - 01101648 _____ () C:\Users\User\Downloads\SpyBot Search Destroy - CHIP-Installer.exe
2014-08-09 14:48 - 2014-08-09 14:48 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-08-09 14:47 - 2014-08-09 14:28 - 00019279 _____ () C:\Users\User\Documents\LX563 pushback.frc
2014-08-09 14:46 - 2014-08-09 14:46 - 00000000 ____D () C:\Users\User\AppData\Local\MFAData
2014-08-09 14:46 - 2014-08-09 14:46 - 00000000 ____D () C:\Users\User\AppData\Local\gegl-0.2
2014-08-09 14:45 - 2014-08-09 14:44 - 168801544 _____ (AVG Technologies) C:\Users\User\Downloads\avg_avct_x64_all_2014_4744a7830.exe
2014-08-09 14:45 - 2014-07-09 21:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PMDG Simulations
2014-08-09 14:45 - 2014-04-25 11:15 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-08-09 14:44 - 2014-08-09 14:44 - 00000894 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-08-09 14:44 - 2014-08-09 14:43 - 00000000 ____D () C:\Program Files\GIMP 2
2014-08-09 14:43 - 2014-08-09 14:43 - 00001095 _____ () C:\Users\Public\Desktop\Emsisoft Anti-Malware.lnk
2014-08-09 14:43 - 2014-08-09 14:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Emsisoft Anti-Malware
2014-08-09 14:43 - 2014-08-09 14:41 - 201035376 _____ (Emsisoft GmbH ) C:\Users\User\Downloads\EmsisoftAntiMalwareSetup.exe
2014-08-09 14:42 - 2014-08-09 14:46 - 00000000 ____D () C:\Users\User\.gimp-2.8
2014-08-09 14:41 - 2014-08-09 14:41 - 90396104 _____ (The GIMP Team ) C:\Users\User\Downloads\gimp-2.8.10-setup.exe
2014-08-09 14:39 - 2014-07-09 23:13 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-08-09 14:39 - 2014-05-01 20:01 - 00000000 ____D () C:\Users\User\AppData\Roaming\uTorrent
2014-08-09 14:36 - 2014-08-09 15:06 - 00000000 ____D () C:\Users\User\Desktop\Unbenannter Export
2014-08-09 14:34 - 2014-07-09 16:47 - 00000000 ____D () C:\Users\User\AppData\Local\Sony
2014-08-09 14:34 - 2014-07-09 16:47 - 00000000 ____D () C:\Program Files\Sony
2014-08-09 14:34 - 2014-07-09 16:46 - 00000000 ____D () C:\ProgramData\Sony
2014-08-09 14:33 - 2014-05-18 19:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-08-09 14:32 - 2014-07-21 17:56 - 00000000 ____D () C:\Users\User\AppData\Roaming\Skype
2014-08-09 14:31 - 2014-08-09 14:31 - 00001490 _____ () C:\Users\User\AppData\Local\recently-used.xbel
2014-08-09 14:28 - 2014-05-18 19:41 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-08-09 14:28 - 2014-05-18 19:41 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-08-08 21:18 - 2014-08-08 21:18 - 00000000 ____D () C:\ProgramData\Virtuali
2014-08-08 21:18 - 2014-08-08 21:17 - 18205840 _____ (VIRTUALI Sagl ) C:\Users\User\Downloads\setup_addonmanagerX.exe
2014-08-08 21:18 - 2014-05-01 09:54 - 00000000 ____D () C:\ProgramData\Esellerate
2014-08-08 20:59 - 2014-08-08 20:59 - 00000000 ____D () C:\Users\User\AppData\Local\World_of_AI
2014-08-08 20:42 - 2014-08-08 20:41 - 00000000 ____D () C:\Gramblr
2014-08-08 20:41 - 2014-08-08 20:41 - 00000654 _____ () C:\Users\User\Desktop\Gramblr.lnk
2014-08-08 20:41 - 2014-08-08 20:41 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Gramblr
2014-08-08 20:39 - 2014-08-08 21:20 - 00000000 ____D () C:\Users\User\AppData\Roaming\Virtuali
2014-08-08 20:32 - 2014-04-30 21:35 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-07-21 18:40 - 2014-05-02 13:15 - 00000000 ____D () C:\Program Files (x86)\Microsoft Games
2014-07-21 18:39 - 2014-05-04 19:56 - 00000000 ____D () C:\Users\User\Desktop\Addons
2014-07-21 18:29 - 2014-07-21 18:29 - 00055761 _____ () C:\Users\User\Documents\ab 738 to 28.frc
2014-07-21 18:25 - 2014-07-21 18:25 - 00028159 _____ () C:\Users\User\Documents\ab 738.frc
2014-07-21 18:23 - 2014-07-09 22:00 - 00000000 ___HD () C:\Windows\msdownld.tmp
2014-07-21 18:23 - 2014-07-09 22:00 - 00000000 ____D () C:\Windows\SysWOW64\directx
2014-07-21 18:19 - 2014-07-21 18:19 - 00000000 ____D () C:\Program Files (x86)\PMDG Operations Center
2014-07-21 18:10 - 2014-07-21 18:10 - 00036780 _____ () C:\Users\User\Documents\AB 737 descent.frc
2014-07-21 18:05 - 2014-07-21 18:01 - 00009440 _____ () C:\Users\User\Desktop\AB B738 takeoff lszh.wlmp
2014-07-21 18:05 - 2014-07-21 17:59 - 00000000 ____D () C:\Program Files (x86)\DriverToolkit
2014-07-21 18:00 - 2014-07-21 18:00 - 00000000 ____D () C:\Users\User\AppData\Local\DriverToolkit
2014-07-21 17:59 - 2014-07-21 17:59 - 02395840 _____ (Megaify Software ) C:\Users\User\Downloads\driver_setup.exe
2014-07-21 17:59 - 2014-07-21 17:59 - 00061940 _____ () C:\Users\User\Documents\Ab 737 takeoff 28 lszh.frc
2014-07-21 17:57 - 2014-07-21 17:57 - 00000000 ____D () C:\Users\User\AppData\Local\Skype
2014-07-21 17:56 - 2014-07-21 17:56 - 00001137 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-07-21 17:56 - 2014-05-02 17:56 - 00000000 ____D () C:\ProgramData\Package Cache
2014-07-21 17:56 - 2014-05-02 17:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-07-21 17:56 - 2014-05-02 17:56 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-07-21 17:55 - 2014-07-21 17:55 - 01677928 _____ (Skype Technologies S.A.) C:\Users\User\Downloads\SkypeSetup.exe
2014-07-21 17:54 - 2014-07-09 20:59 - 00000976 _____ () C:\Users\User\Desktop\Dropbox.lnk
2014-07-21 17:54 - 2014-07-09 20:53 - 00000000 ____D () C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-07-21 17:52 - 2014-07-21 17:52 - 00022720 _____ () C:\Users\User\Documents\AB 737 pushback.frc
2014-07-21 17:49 - 2014-07-09 21:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-07-17 12:33 - 2014-07-17 12:33 - 00112593 _____ () C:\Users\User\Documents\frfghjj.frc
2014-07-17 12:27 - 2014-07-17 12:27 - 00091207 _____ () C:\Users\User\Documents\AB2876 takeoff muc.frc
2014-07-17 12:26 - 2014-07-17 12:26 - 00098607 _____ () C:\Users\User\Documents\AB2876 landing ltaiä.frc
2014-07-17 12:16 - 2014-07-09 20:59 - 00000000 ____D () C:\Lightroom 5
2014-07-17 12:15 - 2014-05-01 21:00 - 00000000 ____D () C:\Users\User\AppData\Local\Adobe
2014-07-17 12:13 - 2014-07-17 12:13 - 02050655 _____ (Anthony Ribeiro ) C:\Users\User\Downloads\Boeing 747-8i Lufthansa v1.00.exe
2014-07-17 12:12 - 2014-07-17 12:12 - 46507041 _____ (SkySpirit2012 ) C:\Users\User\Downloads\Boeing 747-8i Basepack v1.40.exe
2014-07-17 12:05 - 2014-04-25 11:05 - 00000000 ____D () C:\Users\User\AppData\Roaming\Adobe
2014-07-17 12:03 - 2014-07-09 21:00 - 00000000 ____D () C:\Users\User\Documents\Adobe
2014-07-17 11:58 - 2014-07-09 20:56 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-07-17 11:55 - 2014-05-01 21:00 - 00000000 ____D () C:\ProgramData\Adobe
2014-07-17 11:55 - 2014-05-01 21:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-07-17 11:50 - 2014-07-17 11:50 - 00003480 ____N () C:\bootsqm.dat
2014-07-17 11:50 - 2014-05-03 09:14 - 00042040 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-07-17 11:49 - 2014-07-17 11:49 - 00000000 __SHD () C:\found.000
2014-07-15 21:55 - 2014-07-15 21:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exif Viewer
2014-07-15 21:55 - 2014-05-16 15:48 - 00000000 ____D () C:\Program Files (x86)\Exif Viewer
2014-07-15 21:54 - 2014-07-15 21:54 - 00961360 _____ (Chip Digital GmbH) C:\Users\User\Downloads\Exif Viewer - CHIP-Installer.exe
2014-07-15 21:54 - 2014-07-15 21:54 - 00000000 ____D () C:\Windows\uninstall

Some content of TEMP:
====================
C:\Users\User\AppData\Local\Temp\avgnt.exe
C:\Users\User\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpmmb8lz.dll
C:\Users\User\AppData\Local\Temp\_is7005.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-08-09 15:26

==================== End Of Log ============================
--- --- ---

schrauber 12.08.2014 17:45
Und was ist mit der Addition.txt von FRST?

C.V.H. 12.08.2014 19:32
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-08-2014 01
Ran by User at 2014-08-10 22:47:56
Running from C:\Users\User\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKCU\...\uTorrent) (Version: 3.4.1.31139 - BitTorrent Inc.)
2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.83 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.83 - Adobe Systems Incorporated) Hidden
Adobe Download Assistant (HKLM-x32\...\com.adobe.downloadassistant.AdobeDownloadAssistant) (Version: 1.2.6 - Adobe Systems Incorporated)
Adobe Download Assistant (x32 Version: 1.2.6 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.206 - Adobe Systems Incorporated)
Aerosoft's - Airbus X Extended - FSX (HKLM-x32\...\Airbus X Extended - FSX) (Version: 1.16 - Aerosoft)
Aerosoft's - German Airports 1 - Friedrichshafen X (HKLM-x32\...\{411B6A8F-0088-496D-8A0A-1319BB825D7C}) (Version: 1.01 - Aerosoft)
AIDA64 Extreme v4.30 (HKLM-x32\...\AIDA64 Extreme_is1) (Version: 4.30 - FinalWire Ltd.)
Any Video Converter 5.5.9 (HKLM-x32\...\Any Video Converter_is1) (Version:  - Any-Video-Converter.com)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM106x SATA Host Controller Driver (HKLM-x32\...\{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}) (Version: 1.3.4.001 - Asmedia Technology)
ASUS GPU Tweak (HKLM-x32\...\InstallShield_{532F6E8A-AF97-41C3-915F-39F718EC07D1}) (Version: 2.4.9.2 - ASUSTek COMPUTER INC.)
ASUS GPU Tweak (x32 Version: 2.4.9.2 - ASUSTek COMPUTER INC.) Hidden
ASUS Product Register Program (HKLM-x32\...\{C87D79F6-F813-4812-B7A9-CCCAAB8B1188}) (Version: 1.0.025 - ASUSTek Computer Inc.)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.170 - Atheros)
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4744 - AVG Technologies)
AVG 2014 (Version: 14.0.4007 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4744 - AVG Technologies) Hidden
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
BOB Version 1.1 (HKCU\...\BOB Version 1.1) (Version:  - )
CHIP Updater (HKLM-x32\...\CHIP Updater_is1) (Version: 2.28 - Abelssoft)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)
Elements 12 Organizer (x32 Version: 12.0 - Ihr Firmenname) Hidden
Emsisoft Anti-Malware (HKLM-x32\...\{5502032C-88C1-4303-99FE-B5CBD7684CEA}_is1) (Version: 9.0 - Emsisoft GmbH)
Exif-Viewer 2.51  (HKLM-x32\...\Exif-Viewer) (Version: 2.51 - Ralf Bibinger)
FastStone Capture 5.3 (HKLM-x32\...\FastStone Capture) (Version: 5.3 - FastStone Soft)
Flight Simulator X (HKLM-x32\...\RTMshadow_{7D606567-5047-451A-B49E-29FCB6012B4E}) (Version:  - )
Flight Simulator X Service Pack 1 (HKLM-x32\...\SP1shadow_{7D606567-5047-451A-B49E-29FCB6012B4E}) (Version:  - )
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fraps (HKLM-x32\...\Fraps) (Version:  - )
Free YouTube to MP3 Converter version 3.12.34.430 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.34.430 - DVDVideoSoft Ltd.)
FS Recorder 2.16 alpha for FSX (HKLM-x32\...\{A4A23588-2A3B-4031-B907-48C2E814335C}) (Version: 2.1.6.0 - Matthias Neusinger)
FSX - Boeing 747-8i Basepack v1.40 (HKLM-x32\...\{D0E771B2-1830-455A-AC1B-328EDD57C7C5}_is1) (Version: v1.40 - SkySpirit2012)
FSX - Boeing 747-8i Lufthansa v1.00 (HKLM-x32\...\{C1137E29-8180-4D43-8CD0-4806AB04BE20}_is1) (Version: v1.00 - Anthony Ribeiro)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Gramblr (HKCU\...\Gramblr) (Version: 1.0.0 - Gramblr)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Network Connections 18.5.54.0 (HKLM\...\PROSetDX) (Version: 18.5.54.0 - Intel)
Intel(R) Network Connections 18.5.54.0 (Version: 18.5.54.0 - Intel) Hidden
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.0.1016 - Intel Corporation)
Intel(R) Rapid Storage Technology (Version: 12.8.0.1016 - Intel Corporation) Hidden
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.3.34 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.28.487.1 - Intel Corporation) Hidden
Logitech Gaming Software 5.10 (HKLM\...\{1444D2EE-C7AD-44A8-844F-2634B49353D1}) (Version: 5.10.127 - Logitech)
MAGIX Speed burnR (MSI) (HKLM-x32\...\MX.{294792A1-CA9A-459E-8F78-3C96FD3A3EC4}) (Version: 7.0.2.6 - MAGIX AG)
MAGIX Speed burnR (MSI) (Version: 7.0.2.6 - MAGIX AG) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Flight Simulator X (x32 Version: 10.0.60905 - Microsoft Game Studios) Hidden
Microsoft Flight Simulator X: Acceleration (HKLM-x32\...\FlightSim_{7D606567-5047-451A-B49E-29FCB6012B4E}) (Version: 10.0.61637.0 - Microsoft Game Studios)
Microsoft Flight Simulator X: Acceleration (x32 Version: 10.0.61637.0 - Microsoft Game Studios) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Hybrid 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{E75776B2-EAE5-42F9-A800-0A10763DEDF0}) (Version: 11.0.2318.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser und SDK (HKLM-x32\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Multi Crew Experience Aerosoft Airbus A320/321 (HKLM-x32\...\{3205D6A0-5329-42CD-896E-E3AFE32E606E}) (Version: 2.5.7.0 - FS++ Limited)
Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)
Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.9.2 - Nikon)
NL2000V4_Installer 4.0.58 (HKLM-x32\...\{1ce825d0-ab60-4770-833d-8af2036c8186}_is1) (Version: 4.0.58 - NL2000 scenery design team)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 20.0.0.136 - Symantec Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
Notepad2 (Notepad Replacement) (HKLM\...\Notepad2) (Version: 4.2.25  - Florian Balmer)
NVIDIA 3D Vision Controller-Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.30.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.30.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
NVIDIA ShadowPlay 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 337.88 (Version: 337.88 - NVIDIA Corporation) Hidden
NVIDIA Update 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 14.6.22 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) Hidden
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.214.2 - Tracker Software Products Ltd)
Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.5.1 - Nikon)
PSE12 STI Installer (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
RAAS Professional by FS2Crew (LOCKED) (HKLM-x32\...\RAAS Professional by FS2Crew (LOCKED)) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7023 - Realtek Semiconductor Corp.)
SHIELD Streaming (Version: 2.1.214 - NVIDIA Corporation) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_PROHYBRIDR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883030) 32-Bit Edition (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{F5DCAB53-C2FD-4E5A-8C83-0F37485E5E89}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VC_CRT_x64 (Version: 1.02.0000 - Intel Corporation) Hidden
ViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.9.2 - Nikon)
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VP Bank e-banking (HKLM-x32\...\VP Bank e-banking) (Version: 4.8.1 (Deutsch) - Verwaltungs- und Privat-Bank Aktiengesellschaft)
Windows Live Communications Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
WinRAR 5.10 beta 3 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.3 - win.rar GmbH)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3873043628-1780199607-4098311539-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\User\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)

==================== Restore Points  =========================

14-05-2014 17:26:49 Windows Update
14-05-2014 17:44:22 Installed PMDG 747-400/400F for FSX
18-05-2014 10:09:29 Installiert ASUS GPU Tweak
18-05-2014 10:10:18 Installed GPUTweakStreaming
18-05-2014 10:21:33 Windows Update
18-05-2014 10:27:54 Entfernt German Airports 1 - Stuttgart X
18-05-2014 10:28:56 Entfernt Gibraltar X
18-05-2014 10:29:30 Entfernt German Airports 1 - Friedrichshafen X
18-05-2014 18:33:33 Windows Update
18-05-2014 19:43:59 Installed Java 7 Update 55
19-05-2014 04:35:29 Windows Update
19-05-2014 04:46:24 Wiederherstellungsvorgang
19-05-2014 18:38:03 PCMark 8
19-05-2014 18:44:37 Removed Futuremark SystemInfo
19-05-2014 18:46:11 PCMark 8
19-05-2014 18:48:20 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
19-05-2014 18:48:41 Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
19-05-2014 18:49:11 DirectX wurde installiert
09-07-2014 14:00:03 Removed Vegas Pro 13.0 (64-bit)
09-07-2014 14:54:39 Installed QuickTime 7
09-07-2014 18:45:51 DirectX wurde installiert
09-07-2014 18:48:55 DirectX wurde installiert
09-07-2014 21:02:59 Installed Microsoft SQL Server 2012 Express LocalDB
09-07-2014 21:27:16 Windows Update
09-08-2014 12:31:14 Windows Update
09-08-2014 12:47:28 Removed Adobe Photoshop Lightroom 5.3 64-bit.
09-08-2014 12:47:47 Installed AVG 2014
09-08-2014 12:49:11 Installed AVG 2014
09-08-2014 13:15:15 Removed Skype™ 6.18
09-08-2014 13:16:41 Removed Skype Click to Call


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-07-17 12:10 - 00001132 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1                  activate.adobe.com
127.0.0.1                  practivate.adobe.com
127.0.0.1                  lmlicenses.wip4.adobe.com
127.0.0.1                  lm.licenses.adobe.com
127.0.0.1                  na1r.services.adobe.com
127.0.0.1                  hlrcv.stage.adobe.com


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0B4748C0-F7C7-4BCF-BE12-E752D02FC772} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-09] (Google Inc.)
Task: {208E976F-471B-4FD4-A2E9-0FEB8FE46433} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {35BD975E-2542-4ECF-977B-E849C9A164F0} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {620A22D7-ECFB-4995-82A3-193372687C7F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-09] (Google Inc.)
Task: {79CB57B4-B8F0-4C5B-9E4C-1FFB930EDB1D} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\SymErr.exe [2012-07-05] (Symantec Corporation)
Task: {8BCC5EEF-58B1-4C65-993F-2745876E2D35} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe [2014-08-07] (CHIP)
Task: {8DC26461-86FA-4DDB-B2DA-3C7491061559} - System32\Tasks\ASUS\ASUS Product Register Service => C:\Program Files (x86)\ASUS\APRP\aprp.exe [2013-08-27] (ASUSTek Computer Inc.)
Task: {966CC67F-FFA1-4366-9B77-E04133A3E508} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\SymErr.exe [2012-07-05] (Symantec Corporation)
Task: {C6AE49B2-5820-4404-B661-48010251C19A} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\20.0.0.136\WSCStub.exe [2012-07-25] (Symantec Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-04-25 12:56 - 2014-05-20 03:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-06-18 17:24 - 2012-06-18 17:24 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_05.dll
2014-04-25 11:08 - 2013-05-17 11:13 - 00936728 _____ () C:\Program Files (x86)\ASUS\AXSP\1.01.02\atkexComSvc.exe
2012-01-17 11:24 - 2012-01-17 11:24 - 00055296 _____ () C:\Windows\SysWOW64\ASGT.exe

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:00934A10
AlternateDataStreams: C:\ProgramData\TEMP:74603393

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: BingDesktopUpdate => 2
MSCONFIG\startupreg: BingDesktop => C:\Program Files (x86)\Microsoft\BingDesktop\BingDesktop.exe /fromkey
MSCONFIG\startupreg: Nikon Message Center 2 => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

==================== Faulty Device Manager Devices =============

Name: ASUS DRW-24F1ST  a SCSI CdRom Device
Description: CD-ROM-Laufwerk
Class Guid: {4d36e965-e325-11ce-bfc1-08002be10318}
Manufacturer: (Standard-CD-ROM-Laufwerke)
Service: cdrom
Problem: : Windows cannot load the device driver for this hardware. The driver may be corrupted or missing. (Code 39)
Resolution: Reasons for this error include a driver that is not present; a binary file that is corrupt; a file I/O problem, or a driver that references an entry point in another binary file that could not be loaded.
Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/09/2014 03:07:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SDUpdate.exe, Version 2.4.40.94 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1ff4

Startzeit: 01cfb3d28c08e669

Endzeit: 3

Anwendungspfad: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe

Berichts-ID: 0c0f56a9-1fc6-11e4-b524-bcee7b5d3155

Error: (08/09/2014 03:03:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm SDUpdate.exe, Version 2.4.40.94 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1be4

Startzeit: 01cfb3d2387a0f02

Endzeit: 3

Anwendungspfad: C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe

Berichts-ID: 8782e2e0-1fc5-11e4-b524-bcee7b5d3155

Error: (08/09/2014 03:01:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: fsx.exe, Version: 10.0.61637.0, Zeitstempel: 0x46fadb14
Name des fehlerhaften Moduls: ai_player.dll, Version: 10.0.61637.0, Zeitstempel: 0x46fadb57
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00037489
ID des fehlerhaften Prozesses: 0x16f4
Startzeit der fehlerhaften Anwendung: 0xfsx.exe0
Pfad der fehlerhaften Anwendung: fsx.exe1
Pfad des fehlerhaften Moduls: fsx.exe2
Berichtskennung: fsx.exe3

Error: (08/09/2014 02:30:49 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/09/2014 03:15:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: fsx.exe, Version: 10.0.61637.0, Zeitstempel: 0x46fadb14
Name des fehlerhaften Moduls: d3d9.dll, Version: 1.0.0.1, Zeitstempel: 0x48751493
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00006d1c
ID des fehlerhaften Prozesses: 0x16bc
Startzeit der fehlerhaften Anwendung: 0xfsx.exe0
Pfad der fehlerhaften Anwendung: fsx.exe1
Pfad des fehlerhaften Moduls: fsx.exe2
Berichtskennung: fsx.exe3

Error: (08/09/2014 02:29:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/09/2014 02:29:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: fsx.exe, Version: 10.0.61637.0, Zeitstempel: 0x46fadb14
Name des fehlerhaften Moduls: d3d9.dll, Version: 1.0.0.1, Zeitstempel: 0x48751493
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00006d1c
ID des fehlerhaften Prozesses: 0x1918
Startzeit der fehlerhaften Anwendung: 0xfsx.exe0
Pfad der fehlerhaften Anwendung: fsx.exe1
Pfad des fehlerhaften Moduls: fsx.exe2
Berichtskennung: fsx.exe3

Error: (08/09/2014 03:19:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: fsx.exe, Version: 10.0.61637.0, Zeitstempel: 0x46fadb14
Name des fehlerhaften Moduls: d3d9.dll, Version: 1.0.0.1, Zeitstempel: 0x48751493
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00006d1c
ID des fehlerhaften Prozesses: 0x1b60
Startzeit der fehlerhaften Anwendung: 0xfsx.exe0
Pfad der fehlerhaften Anwendung: fsx.exe1
Pfad des fehlerhaften Moduls: fsx.exe2
Berichtskennung: fsx.exe3

Error: (08/09/2014 02:37:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: fsx.exe, Version: 10.0.61637.0, Zeitstempel: 0x46fadb14
Name des fehlerhaften Moduls: d3d9.dll, Version: 1.0.0.1, Zeitstempel: 0x48751493
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00006d1c
ID des fehlerhaften Prozesses: 0x1888
Startzeit der fehlerhaften Anwendung: 0xfsx.exe0
Pfad der fehlerhaften Anwendung: fsx.exe1
Pfad des fehlerhaften Moduls: fsx.exe2
Berichtskennung: fsx.exe3

Error: (08/09/2014 02:29:55 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/09/2014 02:33:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Management and Security Application Local Management Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (08/09/2014 02:33:23 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Intel(R) Management and Security Application Local Management Service erreicht.

Error: (08/09/2014 02:31:15 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (08/09/2014 02:31:08 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PxHlpa64

Error: (08/09/2014 02:28:57 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎09.‎08.‎2014 um 15:09:58 unerwartet heruntergefahren.

Error: (08/09/2014 02:32:50 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Management and Security Application Local Management Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (08/09/2014 02:32:50 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Intel(R) Management and Security Application Local Management Service erreicht.

Error: (08/09/2014 02:31:02 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: ComputerstandardLokalAktivierung{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}{BC50CF2A-E12C-4F18-90CE-714CC8600CEE}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)

Error: (08/09/2014 02:30:43 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
PxHlpa64

Error: (08/09/2014 02:32:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Management and Security Application Local Management Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-08-09 14:44:47.552
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 15:24:52.714
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 15:15:35.843
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 15:01:48.679
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 14:48:47.408
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 14:28:07.855
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 15:06:25.089
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 14:38:50.508
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 14:30:33.736
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-08-09 15:03:51.511
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\sxs.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 56%
Total physical RAM: 8130.52 MB
Available physical RAM: 3539.87 MB
Total Pagefile: 16259.21 MB
Available Pagefile: 11790.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:1862.67 GB) (Free:1362.09 GB) NTFS
Drive e: (NIKON D5100) (Removable) (Total:14.81 GB) (Free:10.6 GB) FAT32
Drive i: (MY BOOK) (Fixed) (Total:465.76 GB) (Free:54.98 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 926CDA54)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 44FDFE06)
Partition 1: (Active) - (Size=466 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 15 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

schrauber 12.08.2014 19:33
Zitat:
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AV: Emsisoft Anti-Malware (Enabled - Up to date) {8504DEEF-CC04-1F76-2137-F1A5F4A659DA}
AV: Norton Internet Security (Disabled - Out of date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Emsisoft Anti-Malware (Enabled - Up to date) {3E653F0B-EA3E-10F8-1B87-CAD78F211367}
AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}
AS: Norton Internet Security (Disabled - Out of date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Disabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
Yeah, und die Kiste raucht ab in 3,2,1......

Zitat:
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 na1r.services.adobe.com
127.0.0.1 hlrcv.stage.adobe.com
und auch noch gecrackte Software......

C.V.H. 12.08.2014 19:46
Zitat:
Zitat von schrauber (Beitrag 1343768)
Yeah, und die Kiste raucht ab in 3,2,1......


und auch noch gecrackte Software......
Nein! Adobe Lightroom ist Testversion,Airbus X Extended,Stuttgart X und Friedrichshafen von einem Freund,welcher sie direkt bei Aerosoft legal erworben hat.

Und warum sollte die Kiste rauchen?

schrauber 12.08.2014 19:56
Und wer hat dann den Crack installiert? ;)

Warum sie raucht? Man benutzt EIN EINZIGES Av Programm, nicht 10. Du sammelst nicht nur AV Programme, sondern mitunter auch den größten Scheiss den es auf dem Markt gibt (Avira, Norton......)

Alles deinstallieren. ALLES. Und ein einziges AV behalten. Und bei Adobe will ich wissen wer den Crack installiert hat und warum. Bei Verdacht auf gecrackte Software gibt es keinen Support.

C.V.H. 13.08.2014 11:23
Zitat:
Zitat von schrauber (Beitrag 1343800)
Und wer hat dann den Crack installiert? ;)

Warum sie raucht? Man benutzt EIN EINZIGES Av Programm, nicht 10. Du sammelst nicht nur AV Programme, sondern mitunter auch den größten Scheiss den es auf dem Markt gibt (Avira, Norton......)

Alles deinstallieren. ALLES. Und ein einziges AV behalten. Und bei Adobe will ich wissen wer den Crack installiert hat und warum. Bei Verdacht auf gecrackte Software gibt es keinen Support.
Hab alle AV gelöscht,bis auf Avira.
Und zu Adobe.Adobe Lightroom ist Testversion,gedownloaded von hier https://www.adobe.com/cfusion/tdrc/index.cfm?loc=de&product=photoshop_lightroom#

schrauber 13.08.2014 19:49
das beantwortet immer noch nicht die Frage wo der Crack her kommt.
Zitat:
127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 lmlicenses.wip4.adobe.com
127.0.0.1 lm.licenses.adobe.com
127.0.0.1 na1r.services.adobe.com
127.0.0.1 hlrcv.stage.adobe.com
Wer hat das in die Hosts eingetragen um die Aktivierung zu umgehen?!

C.V.H. 13.08.2014 20:39
Zitat:
Zitat von schrauber (Beitrag 1344252)
das beantwortet immer noch nicht die Frage wo der Crack her kommt.

Wer hat das in die Hosts eingetragen um die Aktivierung zu umgehen?!
Ganz ehrlich.Von Hosts hab ich kein Plan.

Ich habe nun alles von Adobe komplett deinstaliert,da ich auf Hilfe hoffe.


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:22 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131