| |
| |||||||
Log-Analyse und Auswertung: Windows-8-PC mit Systemabsturz und temporärem StartproblemWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
13.08.2013, 15:39
| #1 |
 |  Windows-8-PC mit Systemabsturz und temporärem Startproblem Guten Tag liebe Trojaner-Board-Helfer, unser Zweit-PC verhält sich seit gestern zeitweilig recht seltsam. Gestern wollte mein Mann nach dem Systemstart ein Programm starten, woraufhin der Bildschirm schwarz wurde und nur noch ein Meldung zeigte, dass ein schwerer Windows-Fehler vorläge und man von einem funktionstüchtgen Systemdatenträger neu booten solle. Vor Schreck hat er dann den PC einfach ausgemacht und neu hochgefahren. Funktionierte auch wieder prima. quickscan mit Mbam ergab keinen Fund. Zwischenzeitlich wurde der PC noch ein paarmal ohne Probleme benutzt - Vor 2 Stunden hab ich dann den Startknopf des PCs gedrückt, der dann aber nicht startete sondern lediglich einen weißen Mauszeiger auf schwarzem Grund zeigte. - Kein Startbildschirm, kein Willkommensbildschirm und schon gar keine Anmeldung. Habe also das Ding wieder ausgeschaltet, vom Strom getrennt und wieder neu gestartet - und siehe, da er funktioniert wieder. Vollscan mit Avast Free gemacht - Kein Fund! Daraufhin habe ich noch die von euch gewünschten Scans mit defogger, Frst und GMER gemacht. Bei GMER hat er ein paar Mal gemäkelt: Direkt nach gmer-Start: C:\windows\system32\config\system: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird gleiche Meldung während des scans bei Sektor C:\users\sanne\Downloads \gmer_2.1.19163.exe[3480]@c:\windows\system32\OLEAUT32.dll und so ziemlich am Scan-Ende kam die Meldung C:\User\sanne\ntuser.dat Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird So, ich hoffe, ich habe nichts vergessen und wäre Euch unendlich dankbar, wenn Ihr Euch die Logs einmal anschauen würdet, ob da irgendwas bösartiges zu finden ist  Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:48 on 13/08/2013 (Sanne)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-08-2013
Ran by Sanne (administrator) on 13-08-2013 15:50:00
Running from C:\Users\Sanne\Downloads
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Microsoft Corporation) C:\Windows\system32\dashost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SoftPerfect Research) C:\Program Files\NetWorx\networx.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [NetWorx] - C:\Program Files\NetWorx\networx.exe [4886648 2013-07-24] (SoftPerfect Research)
HKCU\...\Run: [Pando Media Booster] - C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe [3093624 2013-03-06] ()
HKCU\...\Run: [FileHippo.com] - C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe [307712 2012-11-23] (FileHippo.com)
HKCU\...\Run: [SecureBanking] - C:\Program Files (x86)\Secure Banking\SecureBanking.exe [507904 2013-07-04] (Secure Banking)
HKCU\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [277504 2012-08-16] (Intel Corporation)
HKLM-x32\...\Run: [CLMLServer_For_P2G8] - C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [111120 2012-06-08] (CyberLink)
HKLM-x32\...\Run: [CLVirtualDrive] - C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe [491120 2012-07-20] (CyberLink Corp.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Reader Application Helper] - C:\Program Files (x86)\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [899400 2013-03-18] (Sony Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
HKLM-x32\...\Run: [] - [x]
HKU\Default\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Default User\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
HKU\Philipp\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)
HKU\UpdatusUser\...\RunOnce: [HKCU] - C:\Windows\System32\oobe\info\HKCU.vbs [x]
AppInit_DLLs: C:\PROGRA~2\NVIDIA~1\3DVISI~1\NVSTIN~1.DLL [759384 2013-07-08] ()
AppInit_DLLs-x32: C:\PROGRA~2\NVIDIA~1\3DVISI~1\nvStInit.dll [759384 2013-07-08] ()
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo13.msn.com
SearchScopes: HKCU - DefaultScope {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
SearchScopes: HKCU - {0C688C30-1FFE-47A6-A484-31890FF3D232} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MALNJS
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
FireFox:
========
FF ProfilePath: C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3503.0728 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @sony.com/ReaderDesktop - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll (Sony Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Extension: WOT - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: No Name - C:\Users\Sanne\AppData\Roaming\Mozilla\Firefox\Profiles\nr0cwijt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}&sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Docs) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0
CHR Extension: (Google Drive) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0
CHR Extension: (YouTube) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Gmail) - C:\Users\Sanne\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-13] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-13] (CyberLink)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-07-19] (Intel Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1223704 2013-02-07] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660504 2013-02-07] (Secunia)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-29] (Microsoft Corporation)
==================== Drivers (Whitelisted) ====================
R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)
R1 networx; C:\Windows\System32\drivers\networx.sys [41976 2013-07-20] (NetFilterSDK.com)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-02-07] (Secunia)
S3 RTL8192cu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 RtlWlanu; C:\Windows\system32\DRIVERS\rtwlanu.sys [1576080 2012-08-07] (Realtek Semiconductor Corporation )
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
S3 X6va011; \??\C:\Windows\SysWOW64\Drivers\X6va011 [x]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000472 _____ C:\Users\Sanne\Desktop\defogger_disable.log
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 15:44 - 01575190 _____ (Farbar) C:\Users\Sanne\Downloads\FRST64.exe
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-21 21:04 - 2013-07-21 21:06 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:17 - 2013-06-28 00:04 - 00693112 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-20 16:17 - 2013-06-28 00:04 - 00078200 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-20 15:58 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-20 15:58 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-20 15:57 - 2013-06-17 00:41 - 00997632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-07-20 15:57 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-20 15:57 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-20 15:57 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-20 15:57 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-20 15:57 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-20 15:57 - 2013-06-01 13:54 - 00194816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sdbus.sys
2013-07-20 15:57 - 2013-06-01 13:54 - 00125184 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dumpsd.sys
2013-07-20 15:57 - 2013-06-01 13:34 - 02391280 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-07-20 15:57 - 2013-06-01 13:33 - 02233600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-20 15:57 - 2013-06-01 13:29 - 00337152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBXHCI.SYS
2013-07-20 15:57 - 2013-06-01 13:29 - 00213248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\UCX01000.SYS
2013-07-20 15:57 - 2013-06-01 13:26 - 06987008 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-07-20 15:57 - 2013-06-01 13:26 - 00327936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2013-07-20 15:57 - 2013-06-01 12:24 - 02106176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-07-20 15:57 - 2013-06-01 11:25 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:25 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 01453568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:24 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 01842176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:23 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\vds.exe
2013-07-20 15:57 - 2013-06-01 11:22 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00446976 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00190976 _____ (Microsoft Corporation) C:\Windows\system32\vdsutil.dll
2013-07-20 15:57 - 2013-06-01 11:22 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\MbaeParserTask.exe
2013-07-20 15:57 - 2013-06-01 11:21 - 00729600 _____ (Microsoft Corporation) C:\Windows\system32\samsrv.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-20 15:57 - 2013-06-01 11:21 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\samlib.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 02219520 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01527808 _____ (Microsoft Corporation) C:\Windows\system32\mfcore.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 01048576 _____ (Microsoft Corporation) C:\Windows\system32\mfasfsrcsnk.dll
2013-07-20 15:57 - 2013-06-01 11:20 - 00583168 _____ (Microsoft Corporation) C:\Windows\system32\mscms.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00785408 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2013-07-20 15:57 - 2013-06-01 11:19 - 00207872 _____ (Microsoft Corporation) C:\Windows\system32\DeviceSetupManager.dll
2013-07-20 15:57 - 2013-06-01 05:08 - 00037632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\BthAvrcpTg.sys
2013-07-20 15:57 - 2013-05-31 01:14 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-20 15:57 - 2013-05-25 00:09 - 01403296 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01271584 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-07-20 15:57 - 2013-05-25 00:09 - 01217352 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-07-20 15:57 - 2013-05-25 00:09 - 01093904 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-07-20 15:57 - 2013-05-20 02:08 - 00386642 _____ C:\Windows\system32\ApnDatabase.xml
2013-07-20 15:57 - 2013-05-04 08:59 - 02842112 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-20 15:57 - 2013-05-04 06:57 - 02620928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-20 15:57 - 2013-04-12 00:30 - 01421312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-20 15:57 - 2013-04-12 00:22 - 01838080 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
==================== One Month Modified Files and Folders =======
2013-08-13 15:49 - 2013-08-13 15:49 - 00000000 ____D C:\FRST
2013-08-13 15:48 - 2013-08-13 15:48 - 00000472 _____ C:\Users\Sanne\Desktop\defogger_disable.log
2013-08-13 15:48 - 2013-08-13 15:48 - 00000000 _____ C:\Users\Sanne\defogger_reenable
2013-08-13 15:48 - 2012-12-17 11:30 - 00000000 ____D C:\Users\Sanne
2013-08-13 15:45 - 2013-08-13 15:45 - 00377856 _____ C:\Users\Sanne\Downloads\gmer_2.1.19163.exe
2013-08-13 15:44 - 2013-08-13 15:44 - 01575190 _____ (Farbar) C:\Users\Sanne\Downloads\FRST64.exe
2013-08-13 15:43 - 2012-08-28 15:12 - 00752930 _____ C:\Windows\system32\perfh007.dat
2013-08-13 15:43 - 2012-08-28 15:12 - 00156156 _____ C:\Windows\system32\perfc007.dat
2013-08-13 15:43 - 2012-07-26 09:28 - 01748838 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-13 15:42 - 2013-08-13 15:42 - 00050477 _____ C:\Users\Sanne\Downloads\Defogger.exe
2013-08-13 15:40 - 2012-11-29 12:41 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-13 15:39 - 2012-07-26 09:22 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-13 15:38 - 2012-09-11 14:11 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-13 15:37 - 2013-08-13 15:37 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-08-13 15:37 - 2012-11-29 12:05 - 00000000 ____D C:\Users\Jürgen
2013-08-13 15:33 - 2013-08-13 15:33 - 01110476 _____ C:\Users\Philipp\Downloads\7z920.exe
2013-08-13 15:06 - 2013-02-12 23:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-13 15:00 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\system32\sru
2013-08-13 14:58 - 2012-11-29 12:41 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-13 14:46 - 2013-02-20 10:23 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-13 14:45 - 2012-07-26 07:26 - 00524288 ___SH C:\Windows\system32\config\BBI
2013-08-13 13:30 - 2012-11-29 12:05 - 01170115 _____ C:\Windows\WindowsUpdate.log
2013-08-13 12:52 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\rescache
2013-08-13 11:43 - 2013-06-21 12:36 - 00001322 _____ C:\Users\Sanne\Desktop\Sandboxed Web Browser.lnk
2013-08-12 22:16 - 2012-11-29 17:03 - 00000000 ____D C:\Users\Philipp\AppData\Roaming\Skype
2013-08-12 19:32 - 2012-11-29 12:49 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-12 19:30 - 2013-08-12 19:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-12 19:29 - 2013-01-12 18:35 - 00000000 ____D C:\Users\Sanne\AppData\Roaming\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-08-12 19:28 - 2012-11-29 16:14 - 00000000 ____D C:\ProgramData\Skype
2013-08-12 19:27 - 2013-08-12 19:27 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Sanne\Downloads\SkypeSetup.exe
2013-08-12 19:26 - 2013-03-14 11:32 - 00002450 _____ C:\Windows\Sandboxie.ini
2013-08-12 19:08 - 2013-02-20 10:23 - 00001926 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-12 19:08 - 2013-02-20 10:23 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-12 19:07 - 2013-08-12 19:07 - 497783871 _____ C:\Windows\MEMORY.DMP
2013-08-12 19:07 - 2013-08-12 19:07 - 00294544 _____ C:\Windows\Minidump\081213-15968-01.dmp
2013-08-12 19:07 - 2013-08-12 19:07 - 00000000 ____D C:\Windows\Minidump
2013-08-12 16:58 - 2012-11-29 12:42 - 00002187 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-11 15:54 - 2012-07-26 10:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-08-11 12:03 - 2013-08-11 12:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-29 13:33 - 2013-07-29 13:33 - 00001130 _____ C:\Users\Philipp\Desktop\FiestaOnline.lnk
2013-07-29 12:38 - 2012-08-28 13:13 - 00163234 _____ C:\Windows\PFRO.log
2013-07-29 12:36 - 2013-07-29 12:36 - 03313224 _____ (Softperfect Research ) C:\Users\Sanne\Downloads\networx_setup.exe
2013-07-29 12:36 - 2013-05-03 11:10 - 00000000 ____D C:\Program Files\NetWorx
2013-07-28 12:36 - 2012-12-03 10:00 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-25 18:19 - 2012-12-23 16:28 - 00000000 ____D C:\Users\Philipp\Documents\Fiesta
2013-07-21 21:06 - 2013-07-21 21:04 - 00000000 ____D C:\Windows\system32\MRT
2013-07-21 19:25 - 2013-07-21 19:25 - 00386216 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-20 16:25 - 2013-05-15 10:41 - 00000000 ____D C:\Users\Sanne\AppData\Local\Adobe
2013-07-20 16:24 - 2013-02-12 23:00 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-20 16:14 - 2013-02-01 19:23 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-20 16:13 - 2012-07-26 11:45 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-20 16:13 - 2012-07-26 07:38 - 00000000 ____D C:\Windows\system32\oobe
2013-07-20 15:53 - 2012-11-29 12:41 - 00004096 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-20 15:53 - 2012-11-29 12:41 - 00003860 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-20 11:12 - 2013-05-03 11:10 - 00041976 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\networx.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-13 11:50
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-08-2013 Ran by Sanne at 2013-08-13 15:50:27 Running from C:\Users\Sanne\Downloads Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 7-Zip 9.20 (x32) Adobe Digital Editions 2.0 (x32 Version: 2.0) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Ashampoo AppLauncher (Medion) v.1.0.0 (x32 Version: 1.0.0) avast! Free Antivirus (x32 Version: 8.0.1489.0) CyberLink LabelPrint 2.5 (x32 Version: 2.5.5415) CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3111_44883) CyberLink PhotoDirector 3 (x32 Version: 3.0.3124) CyberLink PhotoNow (x32 Version: 1.1.7717) CyberLink Power2Go 8 (x32 Version: 8.0.0.1920) CyberLink PowerDirector (Version: 9.0.0.3815c) CyberLink PowerDVD 10 (x32 Version: 10.0.4125.02) CyberLink PowerDVD Copy 1.5 (x32 Version: 1.5.2715b) CyberLink PowerRecover (Version: 5.7.0.0906) CyberLink PowerRecover (x32 Version: 5.7.0.0906) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) DIE SIEDLER - Das Erbe der Könige - Gold Edition (x32 Version: 1.00.0000) Fiesta Online DE 1.04.095 (x32 Version: 1.04.095) FileHippo.com Update Checker (x32) Fotogalerie (x32 Version: 16.4.3503.0728) Fotogalerija (x32 Version: 16.4.3503.0728) Fotogalleri (x32 Version: 16.4.3503.0728) Fotogalleriet (x32 Version: 16.4.3503.0728) Fotoğraf Galerisi (x32 Version: 16.4.3503.0728) Fotótár (x32 Version: 16.4.3503.0728) Galeria de Fotografias (x32 Version: 16.4.3503.0728) Galería de fotos (x32 Version: 16.4.3503.0728) Galeria fotografii (x32 Version: 16.4.3503.0728) Galerie de photos (x32 Version: 16.4.3503.0728) Google Chrome (x32 Version: 28.0.1500.95) Google Update Helper (x32 Version: 1.3.21.153) Intel(R) Management Engine Components (x32 Version: 8.1.0.1281) Intel(R) Rapid Storage Technology (x32 Version: 11.5.4.1001) Intel® Trusted Connect Service Client (Version: 1.24.738.1) League of Legends (x32 Version: 1.3) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Mediathek (x32 Version: 1.4.0) Medion Home Cinema 10 (x32 Version: 10.0) Medion Home Cinema 10 (x32 Version: 10.1924) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000) Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000) Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Movie Maker (x32 Version: 16.4.3503.0728) Mozilla Firefox 23.0 (x86 de) (x32 Version: 23.0) Mozilla Maintenance Service (x32 Version: 17.0.8) Mozilla Thunderbird 17.0.8 (x86 de) (x32 Version: 17.0.8) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT110 (x32 Version: 16.4.1108.0727) MSVCRT110_amd64 (Version: 16.4.1108.0727) NVIDIA 3D Vision Controller-Treiber 314.07 (Version: 314.07) NVIDIA 3D Vision Treiber 314.07 (Version: 314.07) NVIDIA Grafiktreiber 314.07 (Version: 314.07) NVIDIA HD-Audiotreiber 1.3.23.1 (Version: 1.3.23.1) NVIDIA Install Application (Version: 2.1002.109.706) NVIDIA PhysX (x32 Version: 9.12.1031) NVIDIA PhysX-Systemsoftware 9.12.1031 (Version: 9.12.1031) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1407) NVIDIA Systemsteuerung 314.07 (Version: 314.07) NVIDIA Update 1.12.12 (Version: 1.12.12) NVIDIA Update Components (Version: 1.12.12) Pando Media Booster (x32 Version: 2.6.0.8) Photo Common (x32 Version: 16.4.3503.0728) Photo Gallery (x32 Version: 16.4.3503.0728) Podstawowe programy Windows Live (x32 Version: 16.4.3503.0728) QuickLaunch (x32 Version: 1.00.0019) Raccolta foto (x32 Version: 16.4.3503.0728) Reader for PC (x32 Version: 2.0.02.15180) Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6710) Sandboxie 4.04 (64-bit) (Version: 4.04) Secunia PSI (3.0.0.6005) (x32 Version: 3.0.0.6005) Secure Banking Version 1.5.1 (x32 Version: 1.5.1) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32) Skype™ 6.7 (x32 Version: 6.7.102) Stronghold 2 (x32 Version: 1.40.1000) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Windows Live (x32 Version: 16.4.3503.0728) Windows Live Communications Platform (x32 Version: 16.4.3503.0728) Windows Live Essentials (x32 Version: 16.4.3503.0728) Windows Live Installer (x32 Version: 16.4.3503.0728) Windows Live Photo Common (x32 Version: 16.4.3503.0728) Windows Live PIMT Platform (x32 Version: 16.4.3503.0728) Windows Live SOXE (x32 Version: 16.4.3503.0728) Windows Live SOXE Definitions (x32 Version: 16.4.3503.0728) Windows Live Temel Parçalar (x32 Version: 16.4.3503.0728) Windows Live UX Platform (x32 Version: 16.4.3503.0728) Windows Live UX Platform Language Pack (x32 Version: 16.4.3503.0728) Worx 5.2.9 Συλλογή φωτογραφιών (x32 Version: 16.4.3503.0728) ==================== Restore Points ========================= 28-07-2013 10:32:53 Windows Update 11-08-2013 14:04:39 Geplanter Prüfpunkt ==================== Hosts content: ========================== 2012-07-26 07:26 - 2012-07-26 07:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {10D85952-E3F6-47A1-96CF-5E1C2D874EA6} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\system32\srtasks.exe [2012-07-26] (Microsoft Corporation) Task: {13A2AC02-B682-48CC-9155-2E2673580117} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Critical Task: {17644F17-DC4C-4AC8-9444-7AAA52EB5CDC} - System32\Tasks\Microsoft\Windows\NetCfg\BindingWorkItemQueueHandler Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {1DB7C2F1-876C-4F24-AD17-8428211113F9} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\ProcessMemoryDiagnosticEvents Task: {214B24F4-FEB4-4C59-AF1F-70136065199C} - System32\Tasks\Microsoft\Windows\Shell\IndexerAutomaticMaintenance Task: {23700E5C-0E77-499D-908A-415D5C6252F4} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Group Policy Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {2C6B9EA8-7F5A-4ABA-BF96-8D352D02A743} - System32\Tasks\Microsoft\Windows\Device Setup\Metadata Refresh Task: {2E030FA7-3D7C-4E1D-8CFE-56ADB26FD402} - System32\Tasks\Microsoft\Windows\PI\Sqm-Tasks Task: {3054485A-F517-4E95-9977-4DD827B1E9B3} - System32\Tasks\Microsoft\Windows\WS\Badge Update Task: {30FFF6E4-FAB3-4B7F-B4A8-AD0D7E73A529} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1003 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {349EA0C3-8CAB-4B08-8D73-3A0D82CBD554} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.) Task: {378401BA-A703-444A-A79C-3C47AD2DC5B6} - System32\Tasks\Microsoft\Windows\TaskScheduler\Maintenance Configurator Task: {3AE164E7-30CD-40BC-9422-3EC7A5618965} - System32\Tasks\Microsoft\Windows\WS\WSTask Task: {3C490ABD-D849-41AF-9AC4-87DD759B0996} - System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeSystem Task: {4073C1B3-6E16-4AA8-B7F3-C6A6D35D5071} - System32\Tasks\Microsoft\Windows\TPM\Tpm-Maintenance Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - System32\Tasks\Microsoft\Windows\Live\Roaming\SynchronizeWithStorage Task: {483A8F5C-5D26-44B5-B49E-AF6741D1BBEB} - System32\Tasks\Microsoft\Windows\Mobile Broadband Accounts\MNO Metadata Parser => C:\Windows\System32\MbaeParserTask.exe [2013-06-01] (Microsoft Corporation) Task: {4B952129-9AE9-41A3-BE2B-8AD2E06F66B6} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon Task: {4F1D2AE7-1069-46FA-9457-53A2CCAEFE92} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1008 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {5755E746-D7ED-4C20-A472-66C11834CDE4} - System32\Tasks\Microsoft\Windows\TaskScheduler\Manual Maintenance Task: {5C4EFB77-EFA6-45DF-A373-D795C0725BFF} - System32\Tasks\Microsoft\Windows\Plug and Play\Device Install Reboot Required Task: {627441F3-8526-4B62-BF9A-1A3EA414E71A} - System32\Tasks\Microsoft\Windows\SpacePort\SpaceAgentTask => C:\Windows\system32\SpaceAgent.exe [2012-07-26] (Microsoft Corporation) Task: {6E9DE125-5583-4031-B572-FEE48F25CFFF} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyMonitor => C:\Windows\System32\wpcmon.exe [2012-09-20] (Microsoft Corporation) Task: {6FDDEA7C-6310-428D-AEB2-54FFC72811EF} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Task: {74096F94-B654-4DB0-96F5-3C3408B92FE3} - System32\Tasks\Microsoft\Windows\PI\Secure-Boot-Update Task: {77DD17B7-3F1A-401C-B40D-3718D24C2CF4} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUSessionConnect Task: {7A23DED5-0D43-4C22-ABAB-568C017EDE40} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1003 Task: {7D9A9A1C-499C-40A6-8F8A-5BCC4CC9A87C} - System32\Tasks\Microsoft\Windows\TaskScheduler\Regular Maintenance Task: {81762FBB-0464-4396-A6E5-4602F39C3CBC} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start => C:\Windows\system32\sc.exe [2012-07-26] (Microsoft Corporation) Task: {845CB020-68B5-4C6B-9876-7BEC7B3E27AC} - System32\Tasks\Microsoft\Windows\TaskScheduler\Idle Maintenance Task: {87354DAA-66DF-4B41-9346-15958D96E1D2} - System32\Tasks\Microsoft\Windows\FileHistory\File History (maintenance mode) Task: {8EC9F6B1-67D5-4658-9E1A-4E8289B0E760} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1007 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {901A0531-78F7-4B09-A7E5-5959A6C7F5CD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software) Task: {921A1D4E-32FB-46D7-B6C0-6F467884074D} - System32\Tasks\Microsoft\Windows\WS\Sync Licenses Task: {9479EF8E-11D4-41B3-9783-CC65070D592D} - System32\Tasks\Microsoft\Windows\Time Synchronization\ForceSynchronizeTime Task: {94DCF254-64FB-4C4E-8E12-5F4055C10C2A} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 64 Task: {989A7C6D-BE82-4C3C-AF96-6116039E336B} - System32\Tasks\Microsoft\Windows\MemoryDiagnostic\RunFullMemoryDiagnostic Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => C:\Windows\System32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {A800277E-E202-4492-AD38-3312641CBC04} - System32\Tasks\Microsoft\Windows\Live\Roaming\MaintenanceTask Task: {AB289308-A5D6-43CE-9449-016AB0332E3F} - System32\Tasks\Microsoft\Windows\Servicing\StartComponentCleanup Task: {AB62FA47-2C99-44B1-A5D0-D4161423BE43} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyRefresh Task: {AC221D7B-E624-4F18-9671-369646ADCA38} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUScheduledInstall Task: {AC6259DE-AC59-459E-849E-6ADFFD1ADE63} - System32\Tasks\Microsoft\Windows\Shell\CreateObjectTask Task: {AD021103-C0F3-45F4-B707-180DFD69782D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-20] (Adobe Systems Incorporated) Task: {AEB0B5BD-B9E5-458A-898A-E559BD9EB51B} - System32\Tasks\Microsoft\Windows\SettingSync\BackgroundUploadTask Task: {AF549BD8-337C-4BF7-8681-36A182E30507} - System32\Tasks\Microsoft\Windows\Chkdsk\ProactiveScan Task: {B1277EC7-70CD-41A4-8D37-A94F9FAC8752} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.) Task: {B151B483-01FD-44B2-83E3-9AF0254E61F3} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1008 Task: {BC76AEF7-2CF0-4EB6-B65B-A8803E0B5E12} - System32\Tasks\Microsoft\Windows\AppID\SmartScreenSpecific Task: {BCF9560B-3A82-476A-9148-87249A19F82A} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-500 Task: {BF3E6C21-FDAB-4A55-A481-4FB76127DACB} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2012-09-20] (Microsoft Corporation) Task: {C1ACCD1E-4385-4FB2-B5E4-7F2A57A626A2} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan Task: {C463FD1E-31C7-4C20-AB65-08E514CA152D} - System32\Tasks\Microsoft\Windows\IME\SQM data sender Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {CD1054FF-8005-4904-8B9C-436EAB1E2021} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetwork Task: {D5C2E41C-C889-45D7-A357-23386F57A207} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1007 Task: {DBCF6E1B-CE0A-441E-B7A5-219C8BE50C65} - System32\Tasks\Microsoft\Windows\.NET Framework\.NET Framework NGEN v4.0.30319 Critical Task: {DECE5921-598D-454B-9A04-B2DE95EFC1B3} - System32\Tasks\Microsoft\Windows\Data Integrity Scan\Data Integrity Scan for Crash Recovery Task: {E4DFE66F-E089-4CC3-A70F-957223D565F4} - System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask Task: {E8DAA09B-DF2A-4951-9134-6FA9587793F9} - System32\Tasks\Microsoft\Windows\Plug and Play\Sysprep Generalize Drivers => C:\Windows\System32\drvinst.exe [2012-09-20] (Microsoft Corporation) Task: {EB66C230-1811-4263-97B6-5D14FDC3CDFA} - System32\Tasks\WPD\SqmUpload_S-1-5-21-1234656636-18614592-3897552348-1006 => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {EBA33922-91B8-48FA-BBCC-8388AD87766D} - System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1234656636-18614592-3897552348-1006 Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => C:\Windows\system32\rundll32.exe [2012-07-26] (Microsoft Corporation) Task: {EC552CC1-91E5-4FC2-9A3C-DCAEED992A81} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {ED0C1F69-C3A2-41EA-B8C3-3F0D83A1F6C0} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\BthSQM Task: {F3A236AB-4E73-44B2-8718-486A2D793D45} - System32\Tasks\Microsoft\Windows\WindowsUpdate\AUFirmwareInstall Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/13/2013 03:34:48 PM) (Source: Application Hang) (User: ) Description: Programm firefox.exe, Version 23.0.0.4959 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 8a8 Startzeit: 01ce98292c428806 Endzeit: 47 Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Berichts-ID: fe40c736-041c-11e3-bf05-d43d7e2e172b Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (08/12/2013 08:40:13 PM) (Source: Application Hang) (User: ) Description: Programm Fiesta.bin, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 974 Startzeit: 01ce978b54870240 Endzeit: 32 Anwendungspfad: C:\gamigo\FIESTA~1\Fiesta.bin Berichts-ID: 9a5c4ae5-037e-11e3-bf02-d43d7e2e172b Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Error: (08/12/2013 07:23:53 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6 Ausnahmecode: 0xe0434352 Fehleroffset: 0x000000000003811c ID des fehlerhaften Prozesses: 0x324 Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0 Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1 Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2 Berichtskennung: LenovoQuickLaunch.exe3 Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5 Error: (08/12/2013 07:23:53 PM) (Source: .NET Runtime) (User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 07:59:12 PM) (Source: Desktop Window Manager) (User: ) Description: Der Desktopfenster-Manager hat einen schwerwiegenden Fehler (0x8898008d) festgestellt. Error: (07/04/2013 11:54:49 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6 Ausnahmecode: 0xe0434352 Fehleroffset: 0x000000000003811c ID des fehlerhaften Prozesses: 0x5c4 Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0 Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1 Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2 Berichtskennung: LenovoQuickLaunch.exe3 Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5 Error: (07/04/2013 11:54:49 AM) (Source: .NET Runtime) (User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:54:37 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: LenovoQuickLaunch.exe, Version: 1.0.0.0, Zeitstempel: 0x5023cd23 Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.2.9200.16451, Zeitstempel: 0x50988aa6 Ausnahmecode: 0xe0434352 Fehleroffset: 0x000000000003811c ID des fehlerhaften Prozesses: 0x11a0 Startzeit der fehlerhaften Anwendung: 0xLenovoQuickLaunch.exe0 Pfad der fehlerhaften Anwendung: LenovoQuickLaunch.exe1 Pfad des fehlerhaften Moduls: LenovoQuickLaunch.exe2 Berichtskennung: LenovoQuickLaunch.exe3 Vollständiger Name des fehlerhaften Pakets: LenovoQuickLaunch.exe4 Anwendungs-ID, die relativ zum fehlerhaften Paket ist: LenovoQuickLaunch.exe5 Error: (07/04/2013 11:54:37 AM) (Source: .NET Runtime) (User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:53:58 AM) (Source: Application Hang) (User: ) Description: Programm psi.exe, Version 3.0.0.6005 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 12dc Startzeit: 01ce789c52f11484 Endzeit: 16 Anwendungspfad: C:\Program Files (x86)\Secunia\PSI\psi.exe Berichts-ID: a176d318-e48f-11e2-bef3-801f02803614 Vollständiger Name des fehlerhaften Pakets: Anwendungs-ID, die relativ zum fehlerhaften Paket ist: System errors: ============= Error: (08/13/2013 03:41:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (08/13/2013 03:41:15 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (08/13/2013 03:38:58 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (08/13/2013 03:38:40 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT) Description: 0xc000014d0 Error: (08/13/2013 02:57:34 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (08/13/2013 02:57:34 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (08/13/2013 02:46:24 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (User: NT-AUTORITÄT) Description: Das WLAN-Erweiterungsmodul konnte nicht gestartet werden. Modulpfad: C:\Windows\system32\Rtlihvs.dll Fehlercode: 126 Error: (08/13/2013 02:46:06 PM) (Source: Microsoft-Windows-Kernel-General) (User: NT-AUTORITÄT) Description: 0xc000014d0 Error: (08/13/2013 02:37:22 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (08/13/2013 02:37:22 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Microsoft Office Sessions: ========================= Error: (08/13/2013 03:34:48 PM) (Source: Application Hang)(User: ) Description: firefox.exe23.0.0.49598a801ce98292c42880647C:\Program Files (x86)\Mozilla Firefox\firefox.exefe40c736-041c-11e3-bf05-d43d7e2e172b Error: (08/12/2013 08:40:13 PM) (Source: Application Hang)(User: ) Description: Fiesta.bin0.0.0.097401ce978b5487024032C:\gamigo\FIESTA~1\Fiesta.bin9a5c4ae5-037e-11e3-bf02-d43d7e2e172b Error: (08/12/2013 07:23:53 PM) (Source: Application Error)(User: ) Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c32401ce9780b17f17faC:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllf5b7cb99-0373-11e3-bf01-801f02803614 Error: (08/12/2013 07:23:53 PM) (Source: .NET Runtime)(User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 07:59:12 PM) (Source: Desktop Window Manager)(User: ) Description: 0x8898008d Error: (07/04/2013 11:54:49 AM) (Source: Application Error)(User: ) Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c5c401ce789c844d8ae6C:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllc37de74b-e48f-11e2-bef3-801f02803614 Error: (07/04/2013 11:54:49 AM) (Source: .NET Runtime)(User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:54:37 AM) (Source: Application Error)(User: ) Description: LenovoQuickLaunch.exe1.0.0.05023cd23KERNELBASE.dll6.2.9200.1645150988aa6e0434352000000000003811c11a001ce789c6f90083aC:\Program Files (x86)\Lenovo\LenovoQuickLaunch\LenovoQuickLaunch.exeC:\Windows\system32\KERNELBASE.dllbc6ba0f7-e48f-11e2-bef3-801f02803614 Error: (07/04/2013 11:54:37 AM) (Source: .NET Runtime)(User: ) Description: Anwendung: LenovoQuickLaunch.exe Frameworkversion: v4.0.30319 Beschreibung: Der Prozess wurde aufgrund einer unbehandelten Ausnahme beendet. Ausnahmeinformationen: System.NotSupportedException Stapel: bei System.Security.Util.StringExpressionSet.CanonicalizePath(System.String, Boolean) bei System.Security.Util.StringExpressionSet.CreateListFromExpressions(System.String[], Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.Security.AccessControl.AccessControlActions, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission.AddPathList(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean, Boolean) bei System.Security.Permissions.FileIOPermission..ctor(System.Security.Permissions.FileIOPermissionAccess, System.String[], Boolean, Boolean) bei System.IO.FileSystemEnumerableIterator`1[[System.__Canon, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]..ctor(System.String, System.String, System.String, System.IO.SearchOption, System.IO.SearchResultHandler`1<System.__Canon>, Boolean) bei System.IO.Directory.InternalGetFileDirectoryNames(System.String, System.String, System.String, Boolean, Boolean, System.IO.SearchOption, Boolean) bei System.IO.Directory.InternalGetFiles(System.String, System.String, System.IO.SearchOption) bei Lenovo.WPF.StartMenu.Logger.MonitorLog() bei Lenovo.WPF.StartMenu.Logger.WriteLog() bei System.Threading.ExecutionContext.RunInternal(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object, Boolean) bei System.Threading.ExecutionContext.Run(System.Threading.ExecutionContext, System.Threading.ContextCallback, System.Object) bei System.Threading.ThreadHelper.ThreadStart() Error: (07/04/2013 11:53:58 AM) (Source: Application Hang)(User: ) Description: psi.exe3.0.0.600512dc01ce789c52f1148416C:\Program Files (x86)\Secunia\PSI\psi.exea176d318-e48f-11e2-bef3-801f02803614 ==================== Memory info =========================== Percentage of memory in use: 26% Total physical RAM: 4037.83 MB Available physical RAM: 2961.18 MB Total Pagefile: 8133.83 MB Available Pagefile: 6964.02 MB Total Virtual: 8192 MB Available Virtual: 8191.77 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:1801.3 GB) (Free:1728.11 GB) NTFS Drive d: (Recover) (Fixed) (Total:60 GB) (Free:44.38 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 1863 GB) (Disk ID: 00000000) Partition: GPT Partition Type ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-13 16:02:33
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000035 ST2000DM001-9YN164 rev.CC4G 1863,02GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Sanne\AppData\Local\Temp\uwtoypog.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\csrss.exe[584] C:\Windows\SYSTEM32\kernel32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\wininit.exe[664] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\services.exe[736] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\lsass.exe[772] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[876] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[932] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1000] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\svchost.exe[328] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[560] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[580] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\svchost.exe[1068] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Sandboxie\SbieSvc.exe[1212] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1356] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[2000] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1136] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\dashost.exe[2340] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[2348] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\CyberLink\Shared files\RichVideo64.exe[2476] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[2892] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[2944] C:\Windows\system32\KERNEL32.DLL!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\svchost.exe[1772] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\System32\WUDFHost.exe[3712] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\winlogon.exe[2044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text C:\Windows\system32\dwm.exe[1804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8bf771782 4 bytes [77, BF, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1236] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text C:\Windows\system32\nvvsvc.exe[3360] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8bf771782 4 bytes [77, BF, F8, 07]
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\system32\taskhostex.exe[3044] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Windows\Explorer.EXE[1688] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8bf77177a 4 bytes [77, BF, F8, 07]
.text C:\Windows\Explorer.EXE[1688] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8bf771782 4 bytes [77, BF, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1656] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8ba5f1532 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8ba5f153a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8ba5f165a 4 bytes [5F, BA, F8, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2628] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 000007f8bf782d60 5 bytes JMP 000007f93f950b14
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 000007f8bf782dc0 5 bytes JMP 000007f93f950ecc
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 000007f8bf782ea0 5 bytes JMP 000007f93f95163c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 000007f8bf7830e0 5 bytes JMP 000007f93f951284
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 000007f8bf784251 5 bytes JMP 000007f93f9519f4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 000007f8bf794a10 5 bytes JMP 000007f93f95075c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f8bf7b31c4 5 bytes JMP 000007f93f9503a4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 163 000007f8bd8df7eb 1 byte [62]
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!UnhookWindowsHookEx 000007f8bcb82120 5 bytes JMP 000007f93ccd1284
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f8bcb8bee0 5 bytes JMP 000007f93ccd0ecc
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!UnhookWinEvent 000007f8bcb8e030 5 bytes JMP 000007f93ccd075c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWinEventHook 000007f8bcb92f70 5 bytes JMP 000007f93ccd03a4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f8bcbb1850 5 bytes JMP 000007f93ccd0b14
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007f8bce27510 5 bytes JMP 000007f93ce70b14
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007f8bce27550 5 bytes JMP 000007f93ce719f4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007f8bce275d0 5 bytes JMP 000007f93ce7075c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007f8bce27b20 5 bytes JMP 000007f93ce71284
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007f8bce4b034 5 bytes JMP 000007f93ce703a4
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007f8bce4b2e4 5 bytes JMP 000007f93ce7163c
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007f8bce4b470 5 bytes JMP 000007f93ce70ecc
.text C:\Program Files\Sandboxie\SbieSvc.exe[3432] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007f8bce4b6d4 5 bytes JMP 000007f93ce71dac
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [3704:3688] fffff960008805e8
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
SuNi |
| Themen zu Windows-8-PC mit Systemabsturz und temporärem Startproblem |
| adobe, antivirus, avast, bildschirm, booten, browser, defender, diagnostics, error, excel, explorer, farbar, farbar recovery scan tool, flash player, helper, homepage, kein fund, minidump, mozilla, ntdll.dll, problem, programm, prozess, realtek, registry, rundll, secunia psi, security, services.exe, software, srtasks.exe, startbildschirm, starten, svchost.exe |
Baum-Darstellung