Seit ein paar tagen friert mein System relativ willkürlich ein (nur stecker ziehen hilft) mein Virenprogramm (avast) und Malwarebytes haben nichts gefunden. Mein system: Windows 7 Prozessor: amd phenom 2 x4 955; 4gb ram; Grafikkarte: nvidia geforce gtx 560ti; asus mainboard; 500w netzteil. Ich wäre echt dankbar für eure Hilfe.

Hi,

das ist wahrscheinlich kein Malwareproblem.. Aber ich kann mal reinschauen, ob was derartiges zu sehen ist:
Wenn du deinen Rechner nach Malware untersuchen lassen willst, dann arbeite bitte diese Anleitung ab und poste die resultierenden Logfiles hier.

Wird gemacht.


FRST Logfile:

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-08-2013
Ran by Falko (administrator) on 26-08-2013 21:34:02
Running from C:\Users\Falko\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Windows\SYSTEM32\WISPTIS.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Wacom Technology, Corp.) C:\Program Files\Tablet\Pen\Pen_Tablet.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
(BitTorrent Inc.) C:\Program Files (x86)\uTorrent\uTorrent.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [x]
HKCU\...\Run: [Spotify Web Helper] - "C:\Users\Falko\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [x]
HKCU\...\Run: [Steam] - C:\Program Files (x86)\Steam\Steam.exe [1807272 2013-07-27] (Valve Corporation)
MountPoints2: {cbf2be16-b954-11e1-858a-bcaec5368695} - G:\BALDUR.EXE
MountPoints2: {e61417fb-ae81-11e1-aadb-806e6f6e6963} - E:\setup.exe /autorun
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
Startup: C:\Users\Falko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk
ShortcutTarget: MagicDisc.lnk -> C:\Program Files (x86)\MagicDisc\MagicDisc.exe (No File)

==================== Internet (Whitelisted) ====================

ProxyServer: 69.252.122.46:80
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Bing
URLSearchHook: (No Name) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} -  No File
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2475029
SearchScopes: HKCU - {E7EE38F9-AAC8-41AE-8C4C-F7AB7775089A} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=0E25829C-DB99-4C9D-AAAF-498AA3562945&apn_sauid=545ADF09-720E-4EA8-ACF7-924FF1189F59
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Falko\AppData\Roaming\Mozilla\Firefox\Profiles\dglncpoq.default
FF NewTab: hxxp://www.google.com/firefox
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.youtube.com/
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=utf-8&q=
FF NetworkProxy: "http", " 118.97.95.174"
FF NetworkProxy: "http_port", 80
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/DTPlugin,version=10.9.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=1.132.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @wacom.com/wacom-plugin,version=1.1.0.10 - C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF Plugin-x32: @wacom.com/wtPlugin,version=2.0.0.1 - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF Plugin HKCU: wacom.com/WacomTabletPlugin - C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF SearchPlugin: C:\Users\Falko\AppData\Roaming\Mozilla\Firefox\Profiles\dglncpoq.default\searchplugins\askcom.xml
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome: 
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.com"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_257.dll No File
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll No File
CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (Chrome In-App Payments service) - C:\Users\Falko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-12-23] ()

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-20] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-20] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-08-20] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283200 2012-06-17] (DT Soft Ltd)
R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [8192 2005-03-29] ()
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-26 21:32 - 2013-08-26 21:32 - 01577068 _____ (Farbar) C:\Users\Falko\Downloads\FRST64.exe
2013-08-26 21:31 - 2013-08-26 21:31 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-08-26 21:30 - 2013-08-26 21:30 - 00000542 _____ C:\Users\Falko\Downloads\defogger_disable.log
2013-08-26 21:30 - 2013-08-26 21:30 - 00000168 _____ C:\Users\Falko\defogger_reenable
2013-08-26 21:28 - 2013-08-26 21:28 - 00050477 _____ C:\Users\Falko\Downloads\Defogger.exe
2013-08-24 22:43 - 2013-08-26 21:25 - 00000000 ____D C:\Users\Falko\AppData\Local\The Witcher
2013-08-24 22:43 - 2013-08-25 00:43 - 00000000 ____D C:\Users\Falko\Documents\The Witcher
2013-08-24 22:43 - 2013-08-24 22:43 - 00000031 _____ C:\Windows\progress
2013-08-24 22:40 - 2013-08-24 22:40 - 00001919 _____ C:\Users\Public\Desktop\The Witcher Enhanced Edition Director's Cut.lnk
2013-08-24 22:39 - 2013-08-24 22:40 - 00000000 ____D C:\Users\Public\Documents\The Witcher
2013-08-24 22:05 - 2013-08-24 22:05 - 00000000 ____D C:\GOG Games
2013-08-22 23:18 - 2013-08-22 23:18 - 00000000 ____D C:\Users\Falko\AppData\Local\GOG.com
2013-08-22 23:17 - 2013-08-22 23:17 - 03701720 _____ (GOG.com                                                     ) C:\Users\Falko\Downloads\Setup_Downloader_3.5.8_stable.exe
2013-08-22 22:15 - 2013-08-22 22:15 - 00001042 _____ C:\Users\Public\Desktop\The Witcher 2 starten.lnk
2013-08-22 21:05 - 2013-08-22 21:09 - 50449456 _____ (Microsoft Corporation) C:\Users\Falko\Downloads\dotNetFx40_Full_x86_x64.exe
2013-08-22 21:00 - 2013-08-22 21:00 - 00000000 ____D C:\NvidiaLogging
2013-08-22 20:59 - 2013-08-22 21:30 - 00000000 ____D C:\Users\Falko\AppData\Local\NVIDIA
2013-08-22 20:52 - 2013-08-22 20:52 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-08-22 20:49 - 2013-06-21 14:06 - 27781920 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 21102368 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 15144928 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 12427240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 11235104 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2013-08-22 20:49 - 2013-06-21 14:06 - 09239344 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 07687592 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 07641832 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 06324360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 02953504 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 02777888 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 02363680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 02002720 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 01832224 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6432049.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 01511712 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6432049.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00925648 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00572704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00570656 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00467232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00465184 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00266448 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00218592 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00214448 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll
2013-08-22 20:49 - 2013-06-21 14:06 - 00181488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll
2013-08-22 20:49 - 2013-02-25 07:27 - 00194848 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2013-08-22 20:49 - 2013-02-25 07:27 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2013-08-22 18:04 - 2013-08-22 18:16 - 229594432 _____ (NVIDIA Corporation) C:\Users\Falko\Downloads\320.49-desktop-win8-win7-winvista-64bit-international-whql.exe
2013-08-22 18:01 - 2013-08-22 18:04 - 50349920 _____ (Microsoft Corporation) C:\Users\Falko\Downloads\dotnetfx45_full_x86_x64.exe
2013-08-22 02:03 - 2013-08-22 02:03 - 00000000 ____D C:\Users\Falko\Downloads\The.Walking.Dead.400.Days-HI2U
2013-08-21 22:12 - 2013-08-21 22:19 - 115686754 _____ C:\Users\Falko\Downloads\Pharoahe Monch - Best Of Pt. 1.zip
2013-08-21 00:57 - 2013-08-21 01:18 - 403224362 _____ (CD Projekt RED                                              ) C:\Users\Falko\Downloads\patch3.3.exe
2013-08-20 21:33 - 2013-08-22 01:59 - 00000000 ____D C:\Users\Falko\Downloads\Witcher - Enhanced Edition, The (October 26, 2007)
2013-08-20 21:29 - 2013-08-20 21:29 - 00000000 ____D C:\Users\Falko\Downloads\The.Witcher.Enhanced.Edition-SKIDROW
2013-08-20 15:34 - 2013-08-23 04:00 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-20 15:34 - 2013-08-20 15:34 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-08-20 15:34 - 2013-08-20 15:34 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-08-20 15:34 - 2013-08-20 15:34 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-08-20 15:34 - 2013-08-20 15:34 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-20 15:34 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-08-20 15:34 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-08-20 15:34 - 2013-05-09 10:59 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-08-20 15:34 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-08-20 15:34 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-08-20 15:34 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-08-20 15:26 - 2013-08-20 15:32 - 117478104 _____ C:\Users\Falko\Downloads\avast_free_antivirus_setup_8.0.1489.300(3).exe
2013-08-19 22:44 - 2013-08-19 22:44 - 00000000 ____D C:\Users\Falko\Downloads\The.Witcher.Enhanced.Edition.Directors.Cut-PROPHET
2013-08-17 16:00 - 2013-08-17 16:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 03:06 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 03:06 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 03:06 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 03:06 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 03:06 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 03:06 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 03:06 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 03:06 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 03:06 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 03:06 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 03:06 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 03:06 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 03:06 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 03:06 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 15:27 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 15:27 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 15:27 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 15:27 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 15:27 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 15:27 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 15:27 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 15:27 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 15:27 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 15:27 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 15:27 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 15:27 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 15:27 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 15:27 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 15:27 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 15:27 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 15:27 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 15:27 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 15:27 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 15:27 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 15:27 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 15:27 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 15:27 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 15:27 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 15:27 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 15:27 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 15:27 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 02:00 - 2013-08-14 02:00 - 00258979 _____ C:\Users\Falko\Downloads\circus freak.htm
2013-08-11 20:47 - 2013-08-11 20:47 - 01926652 _____ (Francesco                                                   ) C:\Users\Falko\Downloads\FrancescosLeveledCreaturesItemsMod(1).exe.part
2013-08-11 01:13 - 2013-08-11 01:13 - 00000000 ____D C:\Users\Falko\AppData\Roaming\Malwarebytes
2013-08-11 01:12 - 2013-08-11 01:12 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-11 01:12 - 2013-08-11 01:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-11 01:12 - 2013-08-11 01:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-11 01:12 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-11 01:11 - 2013-08-11 01:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Falko\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-09 21:24 - 2013-08-09 21:24 - 00000000 ____D C:\Program Files (x86)\Black Isle
2013-08-09 17:31 - 2013-08-09 17:31 - 08478120 _____ C:\Users\Falko\Downloads\HSS-3.09-install-chip-389-conduit.exe
2013-08-09 17:21 - 2013-08-09 17:21 - 00000000 _____ C:\END
2013-08-06 00:19 - 2013-08-06 00:19 - 00000000 ____D C:\Users\Falko\Downloads\pstfixpack_v413
2013-08-05 23:58 - 2013-08-06 00:03 - 00000000 ____D C:\Users\Falko\Downloads\Ghostdogs_PST_UI_mod_v2.2
2013-08-05 23:50 - 2013-08-05 23:50 - 00002108 _____ C:\Users\Public\Desktop\Planescape Torment.lnk
2013-08-05 23:48 - 2013-08-22 23:18 - 00000000 ____D C:\Program Files (x86)\GOG.com
2013-08-05 23:36 - 2013-08-05 23:36 - 01301647 _____ C:\Users\Falko\Downloads\pstfixpack_v413.rar
2013-08-05 23:34 - 2013-08-05 23:35 - 13104454 _____ C:\Users\Falko\Downloads\Ghostdogs_PST_UI_mod_v2.2.7z
2013-08-05 23:32 - 2013-08-05 23:32 - 00797186 _____ C:\Users\Falko\Downloads\widescreen-v3.05.exe
2013-08-05 21:23 - 2013-08-05 21:28 - 00000000 ____D C:\Users\Falko\Downloads\Planescape Torment [GOG]
2013-08-05 21:12 - 2013-08-05 21:35 - 00000000 ____D C:\Users\Falko\Downloads\Baldur's Gate 2
2013-07-31 01:28 - 2013-07-31 01:28 - 00001769 _____ C:\Users\Falko\Desktop\FalloutLauncher - Verknüpfung.lnk
2013-07-30 22:05 - 2013-07-30 22:06 - 00000000 ____D C:\Users\Falko\AppData\Local\Fallout3
2013-07-30 21:25 - 2013-07-30 21:25 - 00003054 _____ C:\Windows\System32\Tasks\{6CCC752E-5A4E-465F-8F3D-032419A4515A}
2013-07-30 03:49 - 2013-07-30 03:50 - 05030661 _____ C:\Users\Falko\Downloads\oblivion_v1.2.0416german(2).exe
2013-07-30 03:02 - 2013-07-30 03:05 - 41730415 _____ (Francesco                                                   ) C:\Users\Falko\Downloads\FrancescosLeveledCreaturesItemsMod.exe
2013-07-30 03:02 - 2013-07-30 03:02 - 00000000 ____D C:\Users\Falko\Downloads\WEPON Base Install Oblivion and SI-35560
2013-07-30 03:00 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT
2013-07-30 02:56 - 2013-07-30 02:58 - 24809206 _____ C:\Users\Falko\Downloads\WEPON Base Install Oblivion and SI-35560.7z
2013-07-30 02:54 - 2013-07-30 03:03 - 148936819 _____ (Quarn, Kivan, and Arthmoor                                  ) C:\Users\Falko\Downloads\Unofficial Oblivion Patch - EXE Installer-5296-3-4-4.exe
2013-07-30 02:50 - 2013-07-30 02:50 - 01667512 _____ C:\Users\Falko\Downloads\obmm_setup(1).zip
2013-07-30 02:12 - 2013-07-30 02:18 - 00002164 _____ C:\Users\Public\Desktop\Oblivion.lnk

==================== One Month Modified Files and Folders =======

2013-08-26 21:33 - 2013-08-26 21:33 - 00000000 ____D C:\FRST
2013-08-26 21:32 - 2013-08-26 21:32 - 01577068 _____ (Farbar) C:\Users\Falko\Downloads\FRST64.exe
2013-08-26 21:31 - 2013-08-26 21:31 - 00000472 _____ C:\Windows\SysWOW64\defogger_disable.log
2013-08-26 21:30 - 2013-08-26 21:30 - 00000542 _____ C:\Users\Falko\Downloads\defogger_disable.log
2013-08-26 21:30 - 2013-08-26 21:30 - 00000168 _____ C:\Users\Falko\defogger_reenable
2013-08-26 21:30 - 2012-06-04 22:24 - 00000000 ____D C:\Users\Falko
2013-08-26 21:28 - 2013-08-26 21:28 - 00050477 _____ C:\Users\Falko\Downloads\Defogger.exe
2013-08-26 21:27 - 2012-06-04 22:52 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-26 21:25 - 2013-08-24 22:43 - 00000000 ____D C:\Users\Falko\AppData\Local\The Witcher
2013-08-26 20:51 - 2009-07-14 06:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-26 20:51 - 2009-07-14 06:45 - 00021680 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-26 20:50 - 2013-05-22 21:51 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-26 20:44 - 2013-02-27 15:18 - 00000000 ____D C:\Program Files (x86)\Steam
2013-08-26 20:44 - 2012-06-04 22:52 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-26 20:44 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-26 20:43 - 2012-07-19 22:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-08-26 20:43 - 2009-07-14 06:51 - 00069392 _____ C:\Windows\setupact.log
2013-08-26 16:26 - 2012-06-04 22:17 - 01576827 _____ C:\Windows\WindowsUpdate.log
2013-08-25 00:43 - 2013-08-24 22:43 - 00000000 ____D C:\Users\Falko\Documents\The Witcher
2013-08-24 22:43 - 2013-08-24 22:43 - 00000031 _____ C:\Windows\progress
2013-08-24 22:40 - 2013-08-24 22:40 - 00001919 _____ C:\Users\Public\Desktop\The Witcher Enhanced Edition Director's Cut.lnk
2013-08-24 22:40 - 2013-08-24 22:39 - 00000000 ____D C:\Users\Public\Documents\The Witcher
2013-08-24 22:05 - 2013-08-24 22:05 - 00000000 ____D C:\GOG Games
2013-08-24 03:16 - 2013-03-18 23:00 - 01593956 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-08-24 03:16 - 2010-11-21 08:50 - 00699416 _____ C:\Windows\system32\perfh007.dat
2013-08-24 03:16 - 2010-11-21 08:50 - 00149556 _____ C:\Windows\system32\perfc007.dat
2013-08-24 03:15 - 2009-07-14 07:13 - 01593956 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-23 04:00 - 2013-08-20 15:34 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-08-23 00:57 - 2009-07-14 06:45 - 00302128 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-22 23:19 - 2012-06-07 20:48 - 00066312 _____ C:\Users\Falko\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-22 23:18 - 2013-08-22 23:18 - 00000000 ____D C:\Users\Falko\AppData\Local\GOG.com
2013-08-22 23:18 - 2013-08-05 23:48 - 00000000 ____D C:\Program Files (x86)\GOG.com
2013-08-22 23:17 - 2013-08-22 23:17 - 03701720 _____ (GOG.com                                                     ) C:\Users\Falko\Downloads\Setup_Downloader_3.5.8_stable.exe
2013-08-22 22:53 - 2013-03-18 22:28 - 00000000 ____D C:\Program Files (x86)\The Witcher 2
2013-08-22 22:18 - 2012-06-05 01:09 - 00655802 _____ C:\Windows\DirectX.log
2013-08-22 22:15 - 2013-08-22 22:15 - 00001042 _____ C:\Users\Public\Desktop\The Witcher 2 starten.lnk
2013-08-22 21:32 - 2012-06-04 22:35 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-08-22 21:32 - 2012-06-04 22:35 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-08-22 21:30 - 2013-08-22 20:59 - 00000000 ____D C:\Users\Falko\AppData\Local\NVIDIA
2013-08-22 21:30 - 2012-06-04 22:35 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-08-22 21:19 - 2010-11-21 05:47 - 00210798 _____ C:\Windows\PFRO.log
2013-08-22 21:09 - 2013-08-22 21:05 - 50449456 _____ (Microsoft Corporation) C:\Users\Falko\Downloads\dotNetFx40_Full_x86_x64.exe
2013-08-22 21:00 - 2013-08-22 21:00 - 00000000 ____D C:\NvidiaLogging
2013-08-22 20:52 - 2013-08-22 20:52 - 00000000 ____D C:\Program Files (x86)\AGEIA Technologies
2013-08-22 18:16 - 2013-08-22 18:04 - 229594432 _____ (NVIDIA Corporation) C:\Users\Falko\Downloads\320.49-desktop-win8-win7-winvista-64bit-international-whql.exe
2013-08-22 18:04 - 2013-08-22 18:01 - 50349920 _____ (Microsoft Corporation) C:\Users\Falko\Downloads\dotnetfx45_full_x86_x64.exe
2013-08-22 02:03 - 2013-08-22 02:03 - 00000000 ____D C:\Users\Falko\Downloads\The.Walking.Dead.400.Days-HI2U
2013-08-22 01:59 - 2013-08-20 21:33 - 00000000 ____D C:\Users\Falko\Downloads\Witcher - Enhanced Edition, The (October 26, 2007)
2013-08-21 22:19 - 2013-08-21 22:12 - 115686754 _____ C:\Users\Falko\Downloads\Pharoahe Monch - Best Of Pt. 1.zip
2013-08-21 01:18 - 2013-08-21 00:57 - 403224362 _____ (CD Projekt RED                                              ) C:\Users\Falko\Downloads\patch3.3.exe
2013-08-20 21:29 - 2013-08-20 21:29 - 00000000 ____D C:\Users\Falko\Downloads\The.Witcher.Enhanced.Edition-SKIDROW
2013-08-20 20:32 - 2012-06-04 22:55 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-20 18:26 - 2013-01-04 23:26 - 00000000 ____D C:\Users\Falko\Documents\Gothic3
2013-08-20 15:34 - 2013-08-20 15:34 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-08-20 15:34 - 2013-08-20 15:34 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-08-20 15:34 - 2013-08-20 15:34 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-08-20 15:34 - 2013-08-20 15:34 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-20 15:34 - 2013-06-28 13:39 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-08-20 15:34 - 2013-06-26 19:49 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-08-20 15:34 - 2013-06-26 19:49 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-08-20 15:34 - 2012-06-04 22:52 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-08-20 15:34 - 2012-06-04 22:51 - 00000000 ____D C:\ProgramData\AVAST Software
2013-08-20 15:34 - 2012-06-04 22:51 - 00000000 ____D C:\Program Files\AVAST Software
2013-08-20 15:32 - 2013-08-20 15:26 - 117478104 _____ C:\Users\Falko\Downloads\avast_free_antivirus_setup_8.0.1489.300(3).exe
2013-08-19 22:44 - 2013-08-19 22:44 - 00000000 ____D C:\Users\Falko\Downloads\The.Witcher.Enhanced.Edition.Directors.Cut-PROPHET
2013-08-19 15:05 - 2012-08-10 16:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 16:00 - 2013-08-17 16:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-15 20:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-15 03:02 - 2013-07-30 03:00 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 03:01 - 2012-06-05 16:57 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-14 02:00 - 2013-08-14 02:00 - 00258979 _____ C:\Users\Falko\Downloads\circus freak.htm
2013-08-11 20:47 - 2013-08-11 20:47 - 01926652 _____ (Francesco                                                   ) C:\Users\Falko\Downloads\FrancescosLeveledCreaturesItemsMod(1).exe.part
2013-08-11 01:13 - 2013-08-11 01:13 - 00000000 ____D C:\Users\Falko\AppData\Roaming\Malwarebytes
2013-08-11 01:12 - 2013-08-11 01:12 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-11 01:12 - 2013-08-11 01:12 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-11 01:12 - 2013-08-11 01:12 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-11 01:11 - 2013-08-11 01:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Falko\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-09 21:24 - 2013-08-09 21:24 - 00000000 ____D C:\Program Files (x86)\Black Isle
2013-08-09 21:24 - 2012-07-26 23:42 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-08-09 17:31 - 2013-08-09 17:31 - 08478120 _____ C:\Users\Falko\Downloads\HSS-3.09-install-chip-389-conduit.exe
2013-08-09 17:21 - 2013-08-09 17:21 - 00000000 _____ C:\END
2013-08-06 12:31 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-06 00:19 - 2013-08-06 00:19 - 00000000 ____D C:\Users\Falko\Downloads\pstfixpack_v413
2013-08-06 00:03 - 2013-08-05 23:58 - 00000000 ____D C:\Users\Falko\Downloads\Ghostdogs_PST_UI_mod_v2.2
2013-08-05 23:50 - 2013-08-05 23:50 - 00002108 _____ C:\Users\Public\Desktop\Planescape Torment.lnk
2013-08-05 23:36 - 2013-08-05 23:36 - 01301647 _____ C:\Users\Falko\Downloads\pstfixpack_v413.rar
2013-08-05 23:35 - 2013-08-05 23:34 - 13104454 _____ C:\Users\Falko\Downloads\Ghostdogs_PST_UI_mod_v2.2.7z
2013-08-05 23:32 - 2013-08-05 23:32 - 00797186 _____ C:\Users\Falko\Downloads\widescreen-v3.05.exe
2013-08-05 21:35 - 2013-08-05 21:12 - 00000000 ____D C:\Users\Falko\Downloads\Baldur's Gate 2
2013-08-05 21:28 - 2013-08-05 21:23 - 00000000 ____D C:\Users\Falko\Downloads\Planescape Torment [GOG]
2013-07-31 01:28 - 2013-07-31 01:28 - 00001769 _____ C:\Users\Falko\Desktop\FalloutLauncher - Verknüpfung.lnk
2013-07-30 22:06 - 2013-07-30 22:05 - 00000000 ____D C:\Users\Falko\AppData\Local\Fallout3
2013-07-30 22:05 - 2012-07-08 22:55 - 00000000 ____D C:\Users\Falko\Documents\my games
2013-07-30 21:25 - 2013-07-30 21:25 - 00003054 _____ C:\Windows\System32\Tasks\{6CCC752E-5A4E-465F-8F3D-032419A4515A}
2013-07-30 20:46 - 2012-07-26 15:28 - 00000000 ____D C:\Program Files (x86)\Bethesda Softworks
2013-07-30 03:50 - 2013-07-30 03:49 - 05030661 _____ C:\Users\Falko\Downloads\oblivion_v1.2.0416german(2).exe
2013-07-30 03:06 - 2012-07-20 14:28 - 00000000 ____D C:\Users\Falko\AppData\Local\Oblivion
2013-07-30 03:05 - 2013-07-30 03:02 - 41730415 _____ (Francesco                                                   ) C:\Users\Falko\Downloads\FrancescosLeveledCreaturesItemsMod.exe
2013-07-30 03:03 - 2013-07-30 02:54 - 148936819 _____ (Quarn, Kivan, and Arthmoor                                  ) C:\Users\Falko\Downloads\Unofficial Oblivion Patch - EXE Installer-5296-3-4-4.exe
2013-07-30 03:02 - 2013-07-30 03:02 - 00000000 ____D C:\Users\Falko\Downloads\WEPON Base Install Oblivion and SI-35560
2013-07-30 02:58 - 2013-07-30 02:56 - 24809206 _____ C:\Users\Falko\Downloads\WEPON Base Install Oblivion and SI-35560.7z
2013-07-30 02:51 - 2012-07-26 15:49 - 00001258 _____ C:\Users\Falko\Desktop\Oblivion Mod Manager.lnk
2013-07-30 02:50 - 2013-07-30 02:50 - 01667512 _____ C:\Users\Falko\Downloads\obmm_setup(1).zip
2013-07-30 02:18 - 2013-07-30 02:12 - 00002164 _____ C:\Users\Public\Desktop\Oblivion.lnk

Files to move or delete:
====================
C:\Users\Falko\AppData\Local\Temp\aacenc3.exe
C:\Users\Falko\AppData\Local\Temp\APNStub.exe
C:\Users\Falko\AppData\Local\Temp\AskSLib.dll
C:\Users\Falko\AppData\Local\Temp\ffmpeg15.exe
C:\Users\Falko\AppData\Local\Temp\fileutil.dll
C:\Users\Falko\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Falko\AppData\Local\Temp\FP_PL_PFS_INSTALLER_32bit.exe
C:\Users\Falko\AppData\Local\Temp\GLFEB23.tmp.ConduitEngineSetup.exe
C:\Users\Falko\AppData\Local\Temp\Gw2.exe
C:\Users\Falko\AppData\Local\Temp\installerdll5704394.dll
C:\Users\Falko\AppData\Local\Temp\installerdll5741179.dll
C:\Users\Falko\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Falko\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Falko\AppData\Local\Temp\mpsetup.exe
C:\Users\Falko\AppData\Local\Temp\Myashampoo.exe
C:\Users\Falko\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Falko\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Falko\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\Falko\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Falko\AppData\Local\Temp\nvStInst.exe
C:\Users\Falko\AppData\Local\Temp\ppadsetup.exe
C:\Users\Falko\AppData\Local\Temp\rootsupd.exe
C:\Users\Falko\AppData\Local\Temp\Setup.exe
C:\Users\Falko\AppData\Local\Temp\sonarinst.exe
C:\Users\Falko\AppData\Local\Temp\soxdec.exe
C:\Users\Falko\AppData\Local\Temp\tbMyAs.dll
C:\Users\Falko\AppData\Local\Temp\ubi735C.tmp.exe
C:\Users\Falko\AppData\Local\Temp\utt9A22.tmp.exe
C:\Users\Falko\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Falko\AppData\Local\Temp\vcredist_x86.exe
C:\Users\Falko\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe
C:\Users\Falko\AppData\Local\Temp\wpsetup.exe
C:\Users\Falko\AppData\Local\Temp\{}\toolbar\components\RadioWMPCore.dll
C:\Users\Falko\AppData\Local\Temp\{}\toolbar\components\RadioWMPCoreGecko19.dll
C:\Users\Falko\AppData\Local\Temp\{}\conduitengine\components\RadioWMPCore.dll
C:\Users\Falko\AppData\Local\Temp\{}\conduitengine\components\RadioWMPCoreGecko19.dll
C:\Users\Falko\AppData\Local\Temp\{E02D29E5-B571-47B4-9669-CFC78C20DA54}\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\{AA64C8B4-AF01-44F7-B8E0-726B769F45A9}\setup.exe
C:\Users\Falko\AppData\Local\Temp\{87E9FE12-5AC4-15F9-11FE-E987C45AF915}\awesomium.dll
C:\Users\Falko\AppData\Local\Temp\{87E9FE12-5AC4-15F9-11FE-E987C45AF915}\icudt.dll
C:\Users\Falko\AppData\Local\Temp\{433EACD8-4747-4A6A-826A-FFA9F39B0D40}\adobe_caps.dll
C:\Users\Falko\AppData\Local\Temp\{433EACD8-4747-4A6A-826A-FFA9F39B0D40}\amtservices.dll
C:\Users\Falko\AppData\Local\Temp\{433EACD8-4747-4A6A-826A-FFA9F39B0D40}\asneu.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\kernel32.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\mfc90.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\mfc90u.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\mfcm90.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\mfcm90u.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\psapi.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\python27.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\pythoncom27.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\PyWinTypes27.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\shell32.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\wxbase294u_net_vc90.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\wxbase294u_vc90.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\wxmsw294u_adv_vc90.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\wxmsw294u_core_vc90.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\wxmsw294u_html_vc90.dll
C:\Users\Falko\AppData\Local\Temp\_MEI39082\wxmsw294u_webview_vc90.dll
C:\Users\Falko\AppData\Local\Temp\Temp1_SharePod_3.99.zip\SharePod.exe
C:\Users\Falko\AppData\Local\Temp\Temp1_obmm_setup.zip\obmm_setup.exe
C:\Users\Falko\AppData\Local\Temp\Temp1_Minecraft147.zip\Minecraft.exe
C:\Users\Falko\AppData\Local\Temp\Temp1_MASS.EFFECT.2.V1.02.VITALITY.NODVD.ZIP\MassEffect2.exe
C:\Users\Falko\AppData\Local\Temp\Temp1_M.Sydjr.'s Tales of the Realm of Ruun I.zip\Data.exe
C:\Users\Falko\AppData\Local\Temp\Temp1_elderscrolls_iv_oblivion_qarlstexturepack3.zip\QarlTP3.exe
C:\Users\Falko\AppData\Local\Temp\SOERedist\DSETUP.dll
C:\Users\Falko\AppData\Local\Temp\SOERedist\dsetup32.dll
C:\Users\Falko\AppData\Local\Temp\SOERedist\DXSETUP.exe
C:\Users\Falko\AppData\Local\Temp\SOERedist\dxwebsetup.exe
C:\Users\Falko\AppData\Local\Temp\oct1791.tmp\PokkiUpdater.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\setup.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvaudcap32v.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvaudcap64v.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvgenco32.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NvVAD\nvgenco64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVI2.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVI2UI.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVPrxy32.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\NVPrxy64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\NVI2\ReleaseHighlights.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\MS.NET\dotNetFx40_Full_setup.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\MS.NET\MSNetExt.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\clrzmq.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\detoured.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\libzmq.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvFBC.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvsteamsupport.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvstreamer.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\nvstreamsvc.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\protobuf-net.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\rxinput.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\x86\server\steam_api.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\SteamLauncher\NVIDIA.SteamLauncher.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\detoured.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\libzmq.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvFBC.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvsteamsupport.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvstreamer.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\nvstreamsvc.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\rxinput.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience.NvStreamSrv\amd64\server\steam_api64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\7z.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\DisplayCplExt.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ExtensionLoader.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GalaSoft.MvvmLight.Extras.WPF4.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GalaSoft.MvvmLight.WPF4.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperience.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceControls.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceCore.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GFExperienceExt.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\GridService.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\InstallerService.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\InstallerUIExtension.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\log4net.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.Practices.ServiceLocation.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.WindowsAPICodePack.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\Microsoft.WindowsAPICodePack.Shell.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Settings.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Settings.Properties.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.UpdateService.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\NVIDIA.Win32Api.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nvtmru.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\oaremote_plugin.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ShadowPlay.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Core.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Interfaces.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Linq.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.PlatformServices.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Providers.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Runtime.Remoting.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Reactive.Windows.Threading.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\System.Windows.Interactivity.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\zh-CHT\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\zh-CHS\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\tr-TR\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\th-TH\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sv-SE\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sl-SI\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\sk-SK\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ru-RU\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pt-PT\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pt-BR\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\pl-PL\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nl-NL\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\nb-NO\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ko-KR\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ja-JP\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\it-IT\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\hu-HU\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\he-IL\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\fr-FR\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\fi-FI\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\es-MX\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\es-ES\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-US\GFExperience.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-US\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\en-GB\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\el-GR\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\de-DE\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\da-DK\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\cs-CZ\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\GFExperience\ar-AE\GFExperienceControls.resources.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\ComUpdatus.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\daemonu.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\easyDaemonAPIU32.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\easyDaemonAPIU64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdt32.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdt64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtr32.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtr64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtrXP32.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtrXP64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtXP32.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\nvupdtXP64.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\UpdateExt.dll
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Update\WLMerger.exe
C:\Users\Falko\AppData\Local\Temp\NVIDIA\GeForceExperienceSelfUpdate\7.2.17.0\Display.Optimus\OptimusExt.dll
C:\Users\Falko\AppData\Local\Temp\nsz2DD7.tmp\FindProcDLL.dll
C:\Users\Falko\AppData\Local\Temp\nsz2DD7.tmp\newadvsplash.dll
C:\Users\Falko\AppData\Local\Temp\nsz2DD7.tmp\Registry.dll
C:\Users\Falko\AppData\Local\Temp\nswDA61.tmp\___ocnsis.dll
C:\Users\Falko\AppData\Local\Temp\nsv2D0D.tmp\FindProcDLL.dll
C:\Users\Falko\AppData\Local\Temp\nsv2D0D.tmp\Registry.dll
C:\Users\Falko\AppData\Local\Temp\nstF3A2.tmp\DevCon.exe
C:\Users\Falko\AppData\Local\Temp\nstF3A2.tmp\ElbyVCDShell.dll
C:\Users\Falko\AppData\Local\Temp\nstF3A2.tmp\ExecuteWithUAC.exe
C:\Users\Falko\AppData\Local\Temp\nstF3A2.tmp\InstallHelp.dll
C:\Users\Falko\AppData\Local\Temp\nsq40FA.tmp\FindProcDLL.dll
C:\Users\Falko\AppData\Local\Temp\nsq40FA.tmp\Registry.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\InstallOptions.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\SetupHelper.exe
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\System.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\UninstHlp.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\AFK.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\ARA.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\BGR.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\BIH.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\CAT.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\CHS.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\CHT.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\CSY.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\DAN.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\DEU.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\ELL.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\ENU.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\ESN.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\FIN.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\FRA.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\GLC.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\HEB.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\HRV.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\HUN.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\HYE.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\IND.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\ITA.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\JPN.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\KAT.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\KOR.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\LTH.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\LVI.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\NLB.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\NOR.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\PLK.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\PTB.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\ROM.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\RUS.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\SKY.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\SLV.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\SRL.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\SVE.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\TRK.dll
C:\Users\Falko\AppData\Local\Temp\nsnEDE8.tmp\Lang\UKR.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\InstallOptions.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\SetupHelper.exe
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\System.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\UninstHlp.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\AFK.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\ARA.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\BGR.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\BIH.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\CAT.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\CHS.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\CHT.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\CSY.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\DAN.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\DEU.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\ELL.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\ENU.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\ESN.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\FIN.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\FRA.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\GLC.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\HEB.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\HRV.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\HUN.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\HYE.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\IND.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\ITA.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\JPN.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\KAT.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\KOR.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\LTH.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\LVI.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\NLB.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\NOR.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\PLK.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\PTB.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\ROM.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\RUS.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\SKY.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\SLV.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\SRL.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\SVE.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\TRK.dll
C:\Users\Falko\AppData\Local\Temp\nsfDF96.tmp\Lang\UKR.dll
C:\Users\Falko\AppData\Local\Temp\nsf957F.tmp\FindProcDLL.dll
C:\Users\Falko\AppData\Local\Temp\nsf957F.tmp\Registry.dll
C:\Users\Falko\AppData\Local\Temp\nsc3C8E.tmp\___ocnsis.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\InstallOptions.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\SetupHelper.exe
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\System.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\UninstHlp.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\AFK.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\ARA.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\BGR.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\BIH.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\CAT.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\CHS.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\CHT.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\CSY.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\DAN.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\DEU.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\ELL.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\ENU.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\ESN.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\FIN.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\FRA.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\GLC.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\HEB.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\HRV.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\HUN.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\HYE.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\IND.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\ITA.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\JPN.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\KAT.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\KOR.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\LTH.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\LVI.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\NLB.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\NOR.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\PLK.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\PTB.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\ROM.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\RUS.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\SKY.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\SLV.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\SRL.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\SVE.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\TRK.dll
C:\Users\Falko\AppData\Local\Temp\nsaB117.tmp\Lang\UKR.dll
C:\Users\Falko\AppData\Local\Temp\nchuninst\uninst.exe
C:\Users\Falko\AppData\Local\Temp\mtka_tmp\Alf.dll
C:\Users\Falko\AppData\Local\Temp\mtka_tmp\DFA.dll
C:\Users\Falko\AppData\Local\Temp\mtka_tmp\dsspacker_launcher.exe
C:\Users\Falko\AppData\Local\Temp\mtka_tmp\EFLC.exe
C:\Users\Falko\AppData\Local\Temp\mtka_tmp\LaunchEFLC_activation.exe
C:\Users\Falko\AppData\Local\Temp\mtka_tmp\paul.dll
C:\Users\Falko\AppData\Local\Temp\mtka_tmp\secupacker_launcher.exe
C:\Users\Falko\AppData\Local\Temp\MSS\3.0.318.3\mcbrwsr2.dll
C:\Users\Falko\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes.dll
C:\Users\Falko\AppData\Local\Temp\MSS\3.0.318.3\McInstallerRes_LD.dll
C:\Users\Falko\AppData\Local\Temp\MSS\3.0.318.3\McInstallerStartup.dll
C:\Users\Falko\AppData\Local\Temp\MSS\3.0.318.3\McUICnt.exe
C:\Users\Falko\AppData\Local\Temp\MSS\3.0.318.3\SecurityScanner.dll
C:\Users\Falko\AppData\Local\Temp\ispFBDB.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispF903.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispEB85.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispE47.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispE3AB.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispDC79.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispD8.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispCE70.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispCA83.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispC7CF.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispC6A7.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispBF3.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispAC4E.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispA9F8.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispA959.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispA8E0.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\ispA41.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp9AF0.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp99CB.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp94E4.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp9413.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp7D48.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp7905.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp75CE.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp7275.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp703E.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp6E5F.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp6D8C.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp67D9.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp6668.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp577.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp49FE.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp48A2.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp4799.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp4221.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp3BF.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp395C.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp2CAB.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp29BC.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp20AE.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp1A86.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\isp127C.tmp\_Setup.dll
C:\Users\Falko\AppData\Local\Temp\gw2cache-{4F4B130E-557F-1603-0D13-4B4F7F550316}\icudt.dll
C:\Users\Falko\AppData\Local\Temp\G4WL\dotnetfx3.exe
C:\Users\Falko\AppData\Local\Temp\G4WL\dotnetfx3_x64.exe
C:\Users\Falko\AppData\Local\Temp\G4WL\msiexec.exe
C:\Users\Falko\AppData\Local\Temp\G4WL\vcredist_x86.exe
C:\Users\Falko\AppData\Local\Temp\DXREDIST\DSETUP.dll
C:\Users\Falko\AppData\Local\Temp\DXREDIST\dsetup32.dll
C:\Users\Falko\AppData\Local\Temp\DXREDIST\DXSETUP.exe
C:\Users\Falko\AppData\Local\Temp\bye412E.tmp\Disk1\setup.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-23 20:44

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---

FRST Additions Logfile:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-08-2013
Ran by Falko at 2013-08-26 21:34:41
Running from C:\Users\Falko\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
µTorrent (HKCU Version: 3.3.1.30003)
µTorrent (x32 Version: 3.1.3)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe AIR (x32 Version: 3.8.0.870)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Photoshop Elements 9 (x32 Version: 9.0)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
Baldur's Gate(TM) II - Shadows of Amn(TM) (x32)
Bamboo (Version: 5.2.5-5)
Battlefield 3™ (x32 Version: 1.4.0.0)
Battlefield: Bad Company™ 2 (x32 Version: 1.0.0.0)
Battlelog Web Plugins (x32 Version: 2.1.4)
BioShock Infinite (x32)
Bonjour (Version: 3.0.0.10)
Borderlands 2 (x32)
BOSS (x32 Version: 2.0.0)
Cool Record Edit Deluxe (x32)
D3DX10 (x32 Version: 15.4.2368.0902)
Dark Souls Prepare to Die Edition (x32 Version: 1.0.0000.130)
Dragon Age: Origins (x32 Version: 1.00)
EAX4 Unified Redist (x32 Version: 4.001)
Elements 9 Organizer (x32 Version: 9.0)
Elements STI Installer (x32 Version: 1.0)
ESN Sonar (x32 Version: 0.70.4)
Fallout 3 (x32 Version: 1.00.0000)
Fallout: New Vegas (x32)
Far Cry 3 (x32 Version: 1.00)
Fraps (x32)
Free YouTube to MP3 Converter version 3.11.26.706 (x32 Version: 3.11.26.706)
GOG.com Downloader version 3.5.8 (x32 Version: 3.5.8)
Google Chrome (x32 Version: 29.0.1547.57)
Google Drive (x32 Version: 1.11.4865.2530)
Google Update Helper (x32 Version: 1.3.21.153)
Gothic III - Forsaken Gods (x32 Version: 1.0.0)
Gothic III (x32 Version: 1.00.0000)
Grand Theft Auto: Episodes From Liberty City (x32 Version: 1.1.0.0)
Guild Wars 2 (x32)
iTunes (Version: 11.0.4.4)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
L.A. Noire (x32 Version: 1.00.0000)
Last.fm 1.5.4.27091 (x32)
Mafia II (x32)
MAGIX Screenshare (x32 Version: 4.3.6.1987)
MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mass Effect 2 (x32 Version: 1.00)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.88.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Minecraft Cracked (x32 Version: 1.4.6)
Minecraft1.4.7 (x32)
MixPad (x32)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
NBA 2K12 (x32 Version: 1.0.0)
NBA 2K13 (x32 Version: 1.0.0)
Need For Speed™ World (x32 Version: 1.0.0.936)
NVIDIA 3D Vision Controller-Treiber 320.49 (Version: 320.49)
NVIDIA 3D Vision Treiber 320.49 (Version: 320.49)
NVIDIA Grafiktreiber 320.49 (Version: 320.49)
NVIDIA HD-Audiotreiber 1.3.24.2 (Version: 1.3.24.2)
NVIDIA Install Application (Version: 2.1002.131.854)
NVIDIA PhysX (x32 Version: 9.13.0604)
NVIDIA PhysX-Systemsoftware 9.13.0604 (Version: 9.13.0604)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.2049)
NVIDIA Systemsteuerung 320.49 (Version: 320.49)
Oblivion - TweakOblivion 5.10 (Build:370) (x32)
Oblivion (x32 Version: 1.2.0416)
Oblivion mod manager 1.1.9 (x32)
OpenOffice.org 3.4 (x32 Version: 3.4.9590)
Origin (x32 Version: 9.1.13.85)
PDF-Viewer (Version: 2.5.207.0)
Planescape Torment (x32)
PlanetSide 2 (HKCU Version: 1.0.3.183)
PunkBuster Services (x32 Version: 0.993)
Rockstar Games Social Club (x32 Version: 1.0.0.0)
ScummVM 1.4.1 (x32)
Sid Meier's Civilization 4 (x32 Version: 1.61)
Spotify (HKCU Version: 0.8.4.107.g4fa0003f)
Steam (x32 Version: 1.0.0.0)
TeamExtreme Minecraft Installer 1.3.2 (x32)
The Elder Scrolls III: Morrowind (x32)
The Elder Scrolls V: Skyrim (x32)
The Witcher 2 Enhanced Edition Version 3.0 (x32 Version: 3.0)
The Witcher Enhanced Edition Director's Cut (x32 Version: 2.0.0.12)
Tom Clancy's Splinter Cell Double Agent (x32 Version: 1.00.0000)
Two Worlds II (x32 Version: 1.3.0.0)
Unofficial Oblivion Patch v3.4.4 (x32 Version: 3.4.4)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
Uplay (x32 Version: 2.0)
us Mod Manager (Version: 0.44.5)
VideoPad Video Editor (x32)
VirtualCloneDrive (x32)
VLC media player 2.0.2 (Version: 2.0.2)
WebTablet FB Plugin (x32 Version: 2.0.0.1)
WebTablet IE Plugin (x32 Version: 1.1.0.12)
WebTablet Netscape Plugin (x32 Version: 1.1.0.10)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Media Player Firefox Plugin (x32 Version: 1.0.0.8)
Wrye Bash (x32 Version: 0.2.9.9)

==================== Restore Points  =========================

24-08-2013 01:00:11 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {04696E03-C401-4D09-8BFD-F7ECFD27417C} - System32\Tasks\AdobeAAMUpdater-1.0-Falko-PC-Falko => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe No File
Task: {05569D8E-DECF-42AA-840C-0C021FAC8C56} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: {56513BF6-532B-4622-9C10-6AB145B63BB6} - System32\Tasks\Games\UpdateCheck_S-1-5-21-1401544413-250303580-3743260845-1001
Task: {725F0C5A-51CA-49BA-9AEC-4346631CE34F} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {79A5FBF5-8CB3-42F1-B74D-C00C3543C51D} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {988210D4-BD96-4771-A3E7-6A707F2F8635} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-13] (Adobe Systems Incorporated)
Task: {9EFC3A6C-6D97-4DCC-A2CE-7958AECA517B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-04] (Google Inc.)
Task: {A307BAF3-A02D-428B-8FAF-D68EA4C864EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-06-04] (Google Inc.)
Task: {AE3C3235-7BCC-4EEB-B9B9-28DA96AB0837} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe


==================== Faulty Device Manager Devices =============

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/26/2013 09:11:15 PM) (Source: Application Hang) (User: )
Description: Programm witcher2.EXE, Version 3.4.4.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 119c

Startzeit: 01cea28fa604b2b3

Endzeit: 40

Anwendungspfad: C:\Program Files (x86)\The Witcher 2\bin\witcher2.EXE

Berichts-ID: 3f6ee9f2-0e83-11e3-b8d2-bcaec5368695

Error: (08/26/2013 08:45:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 08:14:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 04:34:56 PM) (Source: Customer Experience Improvement Program) (User: )
Description: 80004005

Error: (08/26/2013 04:22:47 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 01:14:03 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 01:11:19 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 11:13:47 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 10:36:16 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4912191

Error: (08/25/2013 10:36:16 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4912191


System errors:
=============
Error: (08/26/2013 08:43:52 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎26.‎08.‎2013 um 20:15:02 unerwartet heruntergefahren.

Error: (08/26/2013 08:13:08 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎26.‎08.‎2013 um 17:18:55 unerwartet heruntergefahren.

Error: (08/26/2013 01:10:10 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (08/26/2013 01:10:10 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (08/26/2013 01:10:10 AM) (Source: DCOM) (User: )
Description: 1068netman{BA126AD1-2166-11D1-B1D0-00805FC1270E}

Error: (08/26/2013 01:10:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (08/26/2013 01:10:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (08/26/2013 01:10:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (08/26/2013 01:10:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (08/26/2013 01:10:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (08/26/2013 09:11:15 PM) (Source: Application Hang)(User: )
Description: witcher2.EXE3.4.4.1119c01cea28fa604b2b340C:\Program Files (x86)\The Witcher 2\bin\witcher2.EXE3f6ee9f2-0e83-11e3-b8d2-bcaec5368695

Error: (08/26/2013 08:45:36 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 08:14:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 04:34:56 PM) (Source: Customer Experience Improvement Program)(User: )
Description: 80004005

Error: (08/26/2013 04:22:47 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 01:14:03 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/26/2013 01:11:19 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 11:13:47 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/25/2013 10:36:16 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4912191

Error: (08/25/2013 10:36:16 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4912191


CodeIntegrity Errors:
===================================
  Date: 2013-03-13 14:28:04.801
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-03-13 14:28:04.743
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 41%
Total physical RAM: 4094.18 MB
Available physical RAM: 2412.6 MB
Total Pagefile: 8186.54 MB
Available Pagefile: 6237.46 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:638.54 GB) (Free:40.04 GB) NTFS
Drive d: () (Fixed) (Total:292.87 GB) (Free:267.6 GB) NTFS
Drive e: (NBA 2K12) (CDROM) (Total:7.09 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 61C95992)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=293 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=639 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

--- --- ---

GMER Logfile:

GMER 2.1.19163 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-08-26 21:47:57
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD103SJ rev.1AJ10001 931,51GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Falko\AppData\Local\Temp\ugloypoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544                                                                                        fffff80002fad000 93 bytes [89, 6C, 24, 70, E9, 4B, FF, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 638                                                                                        fffff80002fad05e 57 bytes [05, 05, 20, 1B, 00, 49, 8D, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\wininit.exe[616] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\services.exe[672] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\winlogon.exe[764] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[848] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\nvvsvc.exe[932] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                 0000000076d7eecd 1 byte [62]
.text     C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe[956] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                            0000000075d6a30a 1 byte [62]
.text     C:\Windows\System32\svchost.exe[416] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000076d7eecd 1 byte [62]
.text     C:\Windows\System32\svchost.exe[568] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[652] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[312] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000076d7eecd 1 byte [62]
.text     C:\Program Files\Tablet\Pen\Pen_TouchService.exe[1208] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                              0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1280] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1468] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                      0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\nvvsvc.exe[1476] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                0000000076d7eecd 1 byte [62]
.text     C:\Windows\SYSTEM32\WISPTIS.EXE[1496] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Windows\System32\spoolsv.exe[1840] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1868] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe[1956] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112              0000000075d6a30a 1 byte [62]
.text     C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[2024] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112  0000000075d6a30a 1 byte [62]
.text     C:\Windows\SYSTEM32\WISPTIS.EXE[1192] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe[1592] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                 0000000076d7eecd 1 byte [62]
.text     C:\Program Files\Tablet\Pen\Pen_TouchUser.exe[1728] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                 0000000076d7eecd 1 byte [62]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1420] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                         0000000075d6a30a 1 byte [62]
.text     C:\Windows\Explorer.EXE[2108] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                       0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\svchost.exe[2228] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                              0000000075d6a30a 1 byte [62]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322                                                                   0000000074451a22 2 bytes [45, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496                                                                   0000000074451ad0 2 bytes [45, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552                                                                   0000000074451b08 2 bytes [45, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730                                                                   0000000074451bba 2 bytes [45, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762                                                                   0000000074451bda 2 bytes [45, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                            0000000074ad1465 2 bytes [AD, 74]
.text     C:\Windows\SysWOW64\PnkBstrA.exe[2340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                           0000000074ad14bb 2 bytes [AD, 74]
.text     ...                                                                                                                                                       * 2
.text     C:\Windows\system32\svchost.exe[2364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[2388] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                    0000000076d7eecd 1 byte [62]
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2440] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                       0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\taskhost.exe[2464] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000076d7eecd 1 byte [62]
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                           0000000076e63b10 5 bytes JMP 000000010012075c
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                             0000000076e67ac0 5 bytes JMP 00000001001203a4
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                0000000076e91430 5 bytes JMP 0000000100120b14
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                    0000000076e91490 5 bytes JMP 0000000100120ecc
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                     0000000076e91570 5 bytes JMP 000000010012163c
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                 0000000076e917b0 5 bytes JMP 0000000100121284
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                     0000000076e927e0 5 bytes JMP 00000001001219f4
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                             000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                 000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                 000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                       000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                       000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Program Files\Tablet\Pen\Pen_TabletUser.exe[2552] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                        000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                   000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                       000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                       000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                      000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                      000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                             000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                             000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[3024] C:\Windows\SYSTEM32\sechost.dll!DeleteService                              000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                               0000000076e63b10 5 bytes JMP 00000001002e075c
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                 0000000076e67ac0 5 bytes JMP 00000001002e03a4
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                    0000000076e91430 5 bytes JMP 00000001002e0b14
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                        0000000076e91490 5 bytes JMP 00000001002e0ecc
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                         0000000076e91570 5 bytes JMP 00000001002e163c
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                     0000000076e917b0 5 bytes JMP 00000001002e1284
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                         0000000076e927e0 5 bytes JMP 00000001002e19f4
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                    0000000076d7eecd 1 byte [62]
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                 000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                     000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                     000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                    000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                    000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                           000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                           000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Program Files\Tablet\Pen\Pen_Tablet.exe[3060] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                            000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                000000007703fac0 5 bytes JMP 0000000100030600
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                    000000007703fb58 5 bytes JMP 0000000100030804
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                     000000007703fcb0 5 bytes JMP 0000000100030c0c
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                 0000000077040038 5 bytes JMP 0000000100030a08
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                     0000000077041920 5 bytes JMP 0000000100030e10
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                             000000007705c4dd 5 bytes JMP 00000001000301f8
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                           0000000077061287 5 bytes JMP 00000001000303fc
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                0000000075d6a30a 1 byte [62]
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                             0000000076a05181 5 bytes JMP 0000000100101014
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                 0000000076a05254 5 bytes JMP 0000000100100804
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                 0000000076a053d5 5 bytes JMP 0000000100100a08
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                0000000076a054c2 5 bytes JMP 0000000100100c0c
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                0000000076a055e2 5 bytes JMP 0000000100100e10
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                       0000000076a0567c 5 bytes JMP 00000001001001f8
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                       0000000076a0589f 5 bytes JMP 00000001001003fc
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                        0000000076a05a22 5 bytes JMP 0000000100100600
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                       0000000075f0ee09 5 bytes JMP 00000001001101f8
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                        0000000075f13982 5 bytes JMP 00000001001103fc
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                     0000000075f17603 5 bytes JMP 0000000100110804
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                     0000000075f1835c 5 bytes JMP 0000000100110600
.text     C:\Program Files (x86)\iTunes\iTunesHelper.exe[3752] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                   0000000075f2f52b 5 bytes JMP 0000000100110a08
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                              000000007703fac0 5 bytes JMP 0000000100030600
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                  000000007703fb58 5 bytes JMP 0000000100030804
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                   000000007703fcb0 5 bytes JMP 0000000100030c0c
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                               0000000077040038 5 bytes JMP 0000000100030a08
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                   0000000077041920 5 bytes JMP 0000000100030e10
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                           000000007705c4dd 5 bytes JMP 00000001000301f8
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                         0000000077061287 5 bytes JMP 00000001000303fc
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                              0000000075d6a30a 1 byte [62]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                           0000000076a05181 5 bytes JMP 00000001001e1014
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                               0000000076a05254 5 bytes JMP 00000001001e0804
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                               0000000076a053d5 5 bytes JMP 00000001001e0a08
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                              0000000076a054c2 5 bytes JMP 00000001001e0c0c
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                              0000000076a055e2 5 bytes JMP 00000001001e0e10
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                     0000000076a0567c 5 bytes JMP 00000001001e01f8
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                     0000000076a0589f 5 bytes JMP 00000001001e03fc
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\SysWOW64\sechost.dll!DeleteService                                      0000000076a05a22 5 bytes JMP 00000001001e0600
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                     0000000075f0ee09 5 bytes JMP 00000001001f01f8
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                      0000000075f13982 5 bytes JMP 00000001001f03fc
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                   0000000075f17603 5 bytes JMP 00000001001f0804
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                   0000000075f1835c 5 bytes JMP 00000001001f0600
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3780] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                 0000000075f2f52b 5 bytes JMP 00000001001f0a08
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[3792] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                             0000000075d6a30a 1 byte [62]
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                0000000076e63b10 5 bytes JMP 00000001002e075c
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                  0000000076e67ac0 5 bytes JMP 00000001002e03a4
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                     0000000076e91430 5 bytes JMP 00000001002e0b14
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                         0000000076e91490 5 bytes JMP 00000001002e0ecc
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                          0000000076e91570 5 bytes JMP 00000001002e163c
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                      0000000076e917b0 5 bytes JMP 00000001002e1284
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                          0000000076e927e0 5 bytes JMP 00000001002e19f4
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                     0000000076d7eecd 1 byte [62]
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                  000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                      000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                      000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                     000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                     000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                            000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                            000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Program Files\iPod\bin\iPodService.exe[4020] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                             000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                    0000000076e63b10 5 bytes JMP 00000001003e075c
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                      0000000076e67ac0 5 bytes JMP 00000001003e03a4
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                         0000000076e91430 5 bytes JMP 00000001003e0b14
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                             0000000076e91490 5 bytes JMP 00000001003e0ecc
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                              0000000076e91570 5 bytes JMP 00000001003e163c
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                          0000000076e917b0 5 bytes JMP 00000001003e1284
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                              0000000076e927e0 5 bytes JMP 00000001003e19f4
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                         0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                      000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                          000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                          000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                         000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                         000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Windows\system32\SearchIndexer.exe[3248] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                 000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                               000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                               000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Windows\system32\svchost.exe[3480] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                       000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[4128] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                            0000000076d7eecd 1 byte [62]
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                          0000000076e63b10 5 bytes JMP 000000010015075c
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                            0000000076e67ac0 5 bytes JMP 00000001001503a4
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                               0000000076e91430 5 bytes JMP 0000000100150b14
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                   0000000076e91490 5 bytes JMP 0000000100150ecc
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                    0000000076e91570 5 bytes JMP 000000010015163c
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                                0000000076e917b0 5 bytes JMP 0000000100151284
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                    0000000076e927e0 5 bytes JMP 00000001001519f4
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                               000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                               000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Windows\System32\svchost.exe[4272] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                       000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                               000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                               000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Windows\system32\DllHost.exe[1716] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                       000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                            000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                                000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                                000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                               000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                               000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                      000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                      000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Windows\System32\svchost.exe[5028] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                       000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                  000000007703fac0 5 bytes JMP 0000000100030600
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                      000000007703fb58 5 bytes JMP 0000000100030804
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                       000000007703fcb0 5 bytes JMP 0000000100030c0c
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                   0000000077040038 5 bytes JMP 0000000100030a08
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                       0000000077041920 5 bytes JMP 0000000100030e10
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                               000000007705c4dd 5 bytes JMP 00000001000301f8
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                             0000000077061287 5 bytes JMP 00000001000303fc
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                  0000000075d6a30a 1 byte [62]
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                               0000000076a05181 5 bytes JMP 00000001003b1014
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                   0000000076a05254 5 bytes JMP 00000001003b0804
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                   0000000076a053d5 5 bytes JMP 00000001003b0a08
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                  0000000076a054c2 5 bytes JMP 00000001003b0c0c
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                  0000000076a055e2 5 bytes JMP 00000001003b0e10
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                         0000000076a0567c 5 bytes JMP 00000001003b01f8
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                         0000000076a0589f 5 bytes JMP 00000001003b03fc
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                          0000000076a05a22 5 bytes JMP 00000001003b0600
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                         0000000075f0ee09 5 bytes JMP 00000001003c01f8
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                          0000000075f13982 5 bytes JMP 00000001003c03fc
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                       0000000075f17603 5 bytes JMP 00000001003c0804
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                       0000000075f1835c 5 bytes JMP 00000001003c0600
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                     0000000075f2f52b 5 bytes JMP 00000001003c0a08
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                0000000074ad1465 2 bytes [AD, 74]
.text     C:\Program Files (x86)\uTorrent\uTorrent.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                               0000000074ad14bb 2 bytes [AD, 74]
.text     ...                                                                                                                                                       * 2
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                                                         0000000076e63b10 5 bytes JMP 000000010019075c
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                                                           0000000076e67ac0 5 bytes JMP 00000001001903a4
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory                                                              0000000076e91430 5 bytes JMP 0000000100190b14
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory                                                                  0000000076e91490 5 bytes JMP 0000000100190ecc
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                                                   0000000076e91570 5 bytes JMP 000000010019163c
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory                                                               0000000076e917b0 5 bytes JMP 0000000100191284
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                   0000000076e927e0 5 bytes JMP 00000001001919f4
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                              0000000076d7eecd 1 byte [62]
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity                                                           000007fefe9a6e00 5 bytes JMP 000007ff7e9c1dac
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA                                                               000007fefe9a6f2c 5 bytes JMP 000007ff7e9c0ecc
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW                                                               000007fefe9a7220 5 bytes JMP 000007ff7e9c1284
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A                                                              000007fefe9a739c 5 bytes JMP 000007ff7e9c163c
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W                                                              000007fefe9a7538 5 bytes JMP 000007ff7e9c19f4
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA                                                                     000007fefe9a75e8 5 bytes JMP 000007ff7e9c03a4
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW                                                                     000007fefe9a790c 5 bytes JMP 000007ff7e9c075c
.text     C:\Windows\system32\taskhost.exe[4568] C:\Windows\SYSTEM32\sechost.dll!DeleteService                                                                      000007fefe9a7ab4 5 bytes JMP 000007ff7e9c0b14
.text     C:\Windows\system32\AUDIODG.EXE[4532] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                                               0000000076d7eecd 1 byte [62]
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory                                                    000000007703fac0 5 bytes JMP 0000000100030600
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory                                                        000000007703fb58 5 bytes JMP 0000000100030804
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess                                                         000000007703fcb0 5 bytes JMP 0000000100030c0c
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                     0000000077040038 5 bytes JMP 0000000100030a08
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread                                                         0000000077041920 5 bytes JMP 0000000100030e10
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                                                 000000007705c4dd 5 bytes JMP 00000001000301f8
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll                                                               0000000077061287 5 bytes JMP 00000001000303fc
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                    0000000075d6a30a 1 byte [62]
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity                                                 0000000076a05181 5 bytes JMP 0000000100241014
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA                                                     0000000076a05254 5 bytes JMP 0000000100240804
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW                                                     0000000076a053d5 5 bytes JMP 0000000100240a08
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A                                                    0000000076a054c2 5 bytes JMP 0000000100240c0c
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W                                                    0000000076a055e2 5 bytes JMP 0000000100240e10
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!CreateServiceA                                                           0000000076a0567c 5 bytes JMP 00000001002401f8
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!CreateServiceW                                                           0000000076a0589f 5 bytes JMP 00000001002403fc
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\SysWOW64\sechost.dll!DeleteService                                                            0000000076a05a22 5 bytes JMP 0000000100240600
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\syswow64\USER32.dll!SetWinEventHook                                                           0000000075f0ee09 5 bytes JMP 00000001002501f8
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\syswow64\USER32.dll!UnhookWinEvent                                                            0000000075f13982 5 bytes JMP 00000001002503fc
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW                                                         0000000075f17603 5 bytes JMP 0000000100250804
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA                                                         0000000075f1835c 5 bytes JMP 0000000100250600
.text     C:\Users\Falko\Downloads\gmer_2.1.19163.exe[780] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx                                                       0000000075f2f52b 5 bytes JMP 0000000100250a08

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type                                                                                                      2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start                                                                                                     2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl                                                                                              1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName                                                                                               aswFsBlk
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group                                                                                                     FSFilter Activity Monitor
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService                                                                                           FltMgr?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description                                                                                               avast! mini-filter driver (aswFsBlk)
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag                                                                                                       2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances                                                                                                 
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance                                                                                 aswFsBlk Instance
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance                                                                               
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                      388400
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                         0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk                                                                                                           
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type                                                                                                     2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start                                                                                                    2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl                                                                                             1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath                                                                                                \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName                                                                                              aswMonFlt
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group                                                                                                    FSFilter Anti-Virus
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService                                                                                          FltMgr?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description                                                                                              avast! mini-filter driver (aswMonFlt)
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances                                                                                                
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance                                                                                aswMonFlt Instance
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance                                                                             
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                    320700
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                       0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt                                                                                                          
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath                                                                                                   \SystemRoot\System32\Drivers\aswrdr2.sys
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type                                                                                                        1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start                                                                                                       1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl                                                                                                1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName                                                                                                 aswRdr
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group                                                                                                       PNP_TDI
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService                                                                                             tcpip?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description                                                                                                 avast! WFP Redirect driver
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters                                                                                                  
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                               
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                               nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr                                                                                                             
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type                                                                                                       1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start                                                                                                      0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl                                                                                               1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName                                                                                                aswRvrt
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description                                                                                                avast! Revert
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters                                                                                                 
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter                                                                                     14
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter                                                                                     220208
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot                                                                                      \Device\Harddisk0\Partition3\Windows
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown                                                                                1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt                                                                                                            
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type                                                                                                        2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start                                                                                                       1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl                                                                                                1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName                                                                                                 aswSnx
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group                                                                                                       FSFilter Virtualization
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService                                                                                             FltMgr?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description                                                                                                 avast! virtualization driver (aswSnx)
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag                                                                                                         2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance                                                                                   aswSnx Instance
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                          137600
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags                                                                             0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters                                                                                                  
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder                                                                                    \DosDevices\C:\Program Files\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder                                                                                       \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx                                                                                                             
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type                                                                                                         1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start                                                                                                        1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl                                                                                                 1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName                                                                                                  aswSP
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description                                                                                                  avast! Self Protection
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield                                                                                       1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder                                                                                     \DosDevices\C:\Program Files\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder                                                                                        \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder                                                                                \DosDevices\C:\Program Files
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder                                                                                      \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP                                                                                                              
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type                                                                                                        1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start                                                                                                       1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl                                                                                                1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName                                                                                                 avast! Network Shield Support
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group                                                                                                       PNP_TDI
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService                                                                                             tcpip?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description                                                                                                 avast! Network Shield TDI driver
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag                                                                                                         9
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi                                                                                                             
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type                                                                                                        1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start                                                                                                       0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl                                                                                                1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName                                                                                                 aswVmm
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description                                                                                                 avast! VM Monitor
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters                                                                                                  
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm                                                                                                             
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type                                                                                              32
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start                                                                                             2
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl                                                                                      1
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath                                                                                         "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName                                                                                       avast! Antivirus
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group                                                                                             ShellSvcGroup
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService                                                                                   aswMonFlt?RpcSS?
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64                                                                                             1
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName                                                                                        LocalSystem
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType                                                                                    1
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description                                                                                       Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus                                                                                                   
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type                                                                                                          2
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start                                                                                                         2
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl                                                                                                  1
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName                                                                                                   aswFsBlk
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group                                                                                                         FSFilter Activity Monitor
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService                                                                                               FltMgr?
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description                                                                                                   avast! mini-filter driver (aswFsBlk)
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag                                                                                                           2
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)                                                                             
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance                                                                                     aswFsBlk Instance
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)                                                           
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                          388400
Reg       HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                             0
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type                                                                                                         2
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start                                                                                                        2
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl                                                                                                 1
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath                                                                                                    \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName                                                                                                  aswMonFlt
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group                                                                                                        FSFilter Anti-Virus
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService                                                                                              FltMgr?
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description                                                                                                  avast! mini-filter driver (aswMonFlt)
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)                                                                            
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance                                                                                    aswMonFlt Instance
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)                                                         
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                        320700
Reg       HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                           0
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath                                                                                                       \SystemRoot\System32\Drivers\aswrdr2.sys
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@Type                                                                                                            1
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@Start                                                                                                           1
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl                                                                                                    1
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName                                                                                                     aswRdr
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@Group                                                                                                           PNP_TDI
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService                                                                                                 tcpip?
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr@Description                                                                                                     avast! WFP Redirect driver
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)                                                                              
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                                   
Reg       HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                                   nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type                                                                                                           1
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start                                                                                                          0
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl                                                                                                   1
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName                                                                                                    aswRvrt
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description                                                                                                    avast! Revert
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)                                                                             
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter                                                                                         14
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter                                                                                         220208
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot                                                                                          \Device\Harddisk0\Partition3\Windows
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown                                                                                    1
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@Type                                                                                                            2
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@Start                                                                                                           1
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl                                                                                                    1
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName                                                                                                     aswSnx
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@Group                                                                                                           FSFilter Virtualization
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService                                                                                                 FltMgr?
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@Description                                                                                                     avast! virtualization driver (aswSnx)
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag                                                                                                             2
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)                                                                               
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance                                                                                       aswSnx Instance
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)                                                               
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                              137600
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags                                                                                 0
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)                                                                              
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder                                                                                        \DosDevices\C:\Program Files\AVAST Software\Avast
Reg       HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder                                                                                           \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP@Type                                                                                                             1
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP@Start                                                                                                            1
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl                                                                                                     1
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName                                                                                                      aswSP
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP@Description                                                                                                      avast! Self Protection
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)                                                                               
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield                                                                                           1
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder                                                                                         \DosDevices\C:\Program Files\AVAST Software\Avast
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder                                                                                            \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder                                                                                    \DosDevices\C:\Program Files
Reg       HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder                                                                                          \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@Type                                                                                                            1
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@Start                                                                                                           1
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl                                                                                                    1
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName                                                                                                     avast! Network Shield Support
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@Group                                                                                                           PNP_TDI
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService                                                                                                 tcpip?
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@Description                                                                                                     avast! Network Shield TDI driver
Reg       HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag                                                                                                             9
Reg       HKLM\SYSTEM\ControlSet002\services\aswVmm@Type                                                                                                            1
Reg       HKLM\SYSTEM\ControlSet002\services\aswVmm@Start                                                                                                           0
Reg       HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl                                                                                                    1
Reg       HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName                                                                                                     aswVmm
Reg       HKLM\SYSTEM\ControlSet002\services\aswVmm@Description                                                                                                     avast! VM Monitor
Reg       HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)                                                                              
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type                                                                                                  32
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start                                                                                                 2
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl                                                                                          1
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath                                                                                             "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName                                                                                           avast! Antivirus
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group                                                                                                 ShellSvcGroup
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService                                                                                       aswMonFlt?RpcSS?
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64                                                                                                 1
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName                                                                                            LocalSystem
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType                                                                                        1
Reg       HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description                                                                                           Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.

---- EOF - GMER 2.1 ----
         

--- --- ---


Das wars dann.

Da ist nicht wirklich etwas zu erkennen..

ProxyServer: 69.252.122.46:80
FF NetworkProxy: "http", " 118.97.95.174"
FF NetworkProxy: "http_port", 80

Hast du diese Proxies gesetzt?

Ja habe ich.

ok.



ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Also Ich hab mal gestern so eine Überprüfung der Festplatte über Windows gemacht und seitdem gab es keine Freezes mehr. Mal abwarten.

Ja, das wäre auch meine Vermutung, dass es sich hier nicht um ein Malwareproblem handelt.

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Ich bekomme somit keine Benachrichtigung mehr über neue Antworten.
Solltest du das Thema erneut brauchen, schicke mir bitte eine PM und wir machen hier weiter.

Jeder andere bitte diese Anleitung lesen und einen eigenen Thread erstellen.