Win 7: Essential will neustarten, meldet PWS:WIN32/Zbot.gen!AM

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 22:19 on 01/09/2013 (Nadja)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-09-2013 03
Ran by Nadja_2 (ATTENTION: The logged in user is not administrator) on NADJA-HP on 01-09-2013 22:30:34
Running from C:\Users\Nadja_2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2M7X192O
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Hewlett-Packard Company) C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_94_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\Shared\hpCaslNotification.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2480936 2010-12-17] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [524800 2010-12-14] (IDT, Inc.)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-07-21] (Hewlett-Packard Company)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1281512 2013-01-27] (Microsoft Corporation)
HKLM\...\Runonce: [MSPCLOCK] - rundll32.exe streamci,StreamingDeviceSetup {97ebaacc-95bd-11d0-a3ea-00a0c9223196},{53172480-4791-11D0-A5D6-28DB04C10000},{53172480-4791-11D0-A5D6-28DB04C10000} [x]
HKLM\...\Runonce: [MSPQM] - rundll32.exe streamci,StreamingDeviceSetup {DDF4358E-BB2C-11D0-A42F-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196},{97EBAACB-95BD-11D0-A3EA-00A0C9223196} [x]
HKLM\...\Runonce: [MSKSSRV] - rundll32.exe streamci,StreamingDeviceSetup {96E080C7-143C-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196},{3C0D501A-140B-11D1-B40F-00A0C9223196} [x]
HKLM\...\Runonce: [MSTEE.CxTransform] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},{CF1DDA2C-9743-11D0-A3EE-00A0C9223196},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install [x]
HKLM\...\Runonce: [MSTEE.Splitter] - rundll32.exe streamci,StreamingDeviceSetup {cfd669f1-9bc2-11d0-8299-0000f822fe8a},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},{0A4252A0-7E70-11D0-A5D6-28DB04C10000},C:\Windows\inf\ksfilter.inf,MSTEE.Interface.Install [x]
HKLM\...\Runonce: [WDM_DRMKAUD] - rundll32.exe streamci,StreamingDeviceSetup {EEC12DB6-AD9C-4168-8658-B03DAEF417FE},{ABD61E00-9350-47e2-A632-4438B90C6641},{FFBB6E3F-CCFE-4D84-90D9-421418B03A8E},C:\Windows\inf\WDMAUDIO.inf,WDM_DRMKAUD.Interface.Install [x]
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-11-22] (Hewlett-Packard Company)
HKCU\...\Run: [Yfsui] - C:\Users\Nadja_2\AppData\Roaming\Ylohe\yfsui.exe [339825 2013-03-27] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2010-12-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-14] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111640 2010-07-23] ()
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [41056 2013-05-08] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2010-12-13] (EasyBits Software AS)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [318520 2010-12-13] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Snapfish PictureMover.lnk
ShortcutTarget: Snapfish PictureMover.lnk -> C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
Startup: C:\Users\Nadja_2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM - DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {ec29edf6-ad3c-4e1c-a087-d6cb81400c43} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = 
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = 
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-01-04] (EasyBits Software Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

==================== Services (Whitelisted) =================

S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-09-01] (AVAST Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-09-01] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-09-01] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-01 22:19 - 2013-09-01 22:19 - 00000472 _____ C:\Users\Nadja_2\Desktop\defogger_disable.log
2013-09-01 22:19 - 2013-09-01 22:19 - 00000000 _____ C:\Users\Nadja\defogger_reenable
2013-09-01 22:18 - 2013-09-01 22:19 - 00050477 _____ C:\Users\Nadja_2\Downloads\Defogger.exe
2013-09-01 22:13 - 2013-09-01 22:13 - 00002219 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-01 22:13 - 2013-09-01 22:13 - 00000000 ____D C:\ProgramData\Google
2013-09-01 22:13 - 2013-09-01 22:13 - 00000000 ____D C:\Program Files\Google
2013-09-01 22:12 - 2013-09-01 22:23 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-01 22:12 - 2013-09-01 22:23 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-01 22:12 - 2013-09-01 22:13 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-01 22:12 - 2013-09-01 22:12 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-09-01 22:12 - 2013-09-01 22:12 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-09-01 22:12 - 2013-09-01 22:12 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-09-01 22:12 - 2013-09-01 22:12 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-09-01 22:12 - 2013-09-01 22:12 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-09-01 22:12 - 2013-09-01 22:12 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-01 22:12 - 2013-09-01 22:12 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-09-01 22:12 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-09-01 22:12 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-09-01 22:12 - 2013-05-09 10:59 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-09-01 22:12 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-09-01 22:12 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-09-01 22:12 - 2013-05-09 10:58 - 00287840 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-09-01 22:11 - 2013-09-01 22:11 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-01 22:11 - 2013-09-01 22:11 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-01 22:11 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-08-22 01:11 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-22 01:11 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-22 01:11 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-22 01:11 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-22 01:11 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-22 01:11 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-22 01:11 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-22 01:11 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-22 01:11 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-22 01:11 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-22 01:11 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-22 01:11 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-22 01:11 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-22 01:11 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-22 01:06 - 2013-08-22 01:07 - 00000000 ____D C:\Windows\system32\MRT
2013-08-22 00:37 - 2013-08-22 00:37 - 00000000 ____D C:\Users\Nadja_2\AppData\Local\{BE20219E-5E07-4358-A654-FAE234D4369C}
2013-08-22 00:37 - 2013-08-22 00:37 - 00000000 ____D C:\Users\Nadja_2\AppData\Local\{008C5916-654E-4EC2-81B7-5FF02A12903A}
2013-08-21 22:55 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-21 22:55 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-21 22:55 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-21 22:55 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-21 22:55 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-21 22:55 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-21 22:55 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-21 22:55 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-21 22:54 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-21 22:54 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-21 22:54 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-21 22:54 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-21 22:54 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-21 22:54 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-21 22:54 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-21 22:54 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-03 15:14 - 2013-08-03 16:20 - 00000000 ____D C:\Users\Nadja_2\AppData\Roaming\Jewel Match 3

==================== One Month Modified Files and Folders =======

2013-09-01 22:29 - 2013-09-01 22:29 - 00000000 ____D C:\FRST
2013-09-01 22:25 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-01 22:25 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-01 22:23 - 2013-09-01 22:12 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-01 22:23 - 2013-09-01 22:12 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-01 22:19 - 2013-09-01 22:19 - 00000472 _____ C:\Users\Nadja_2\Desktop\defogger_disable.log
2013-09-01 22:19 - 2013-09-01 22:19 - 00000000 _____ C:\Users\Nadja\defogger_reenable
2013-09-01 22:19 - 2013-09-01 22:18 - 00050477 _____ C:\Users\Nadja_2\Downloads\Defogger.exe
2013-09-01 22:19 - 2013-03-26 00:01 - 00000000 ____D C:\Users\Nadja
2013-09-01 22:18 - 2011-01-25 02:32 - 01121301 _____ C:\Windows\WindowsUpdate.log
2013-09-01 22:13 - 2013-09-01 22:13 - 00002219 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-09-01 22:13 - 2013-09-01 22:13 - 00000000 ____D C:\ProgramData\Google
2013-09-01 22:13 - 2013-09-01 22:13 - 00000000 ____D C:\Program Files\Google
2013-09-01 22:13 - 2013-09-01 22:12 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-01 22:12 - 2013-09-01 22:12 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-09-01 22:12 - 2013-09-01 22:12 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-09-01 22:12 - 2013-09-01 22:12 - 00189936 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-09-01 22:12 - 2013-09-01 22:12 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-09-01 22:12 - 2013-09-01 22:12 - 00000175 _____ C:\Windows\system32\Drivers\aswVmm.sys.sum
2013-09-01 22:12 - 2013-09-01 22:12 - 00000175 _____ C:\Windows\system32\Drivers\aswSP.sys.sum
2013-09-01 22:12 - 2013-09-01 22:12 - 00000175 _____ C:\Windows\system32\Drivers\aswSnx.sys.sum
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-09-01 22:11 - 2013-09-01 22:11 - 00000000 ____D C:\ProgramData\AVAST Software
2013-09-01 22:11 - 2013-09-01 22:11 - 00000000 ____D C:\Program Files\AVAST Software
2013-09-01 22:06 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-01 22:06 - 2009-07-14 06:51 - 00052497 _____ C:\Windows\setupact.log
2013-08-30 06:59 - 2013-04-16 08:22 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-29 19:14 - 2013-04-29 19:11 - 00000000 ____D C:\Users\Nadja_2\Documents\Cantelberg
2013-08-26 20:16 - 2013-07-30 17:00 - 00000000 ____D C:\Users\Nadja_2\AppData\Local\MumboJumbo
2013-08-26 20:16 - 2013-03-26 00:40 - 00000000 ____D C:\Users\Nadja_2\Documents\MumboJumbo
2013-08-24 15:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-22 18:57 - 2013-04-15 11:25 - 00000000 ____D C:\Users\Nadja_2\Documents\physiotherapie
2013-08-22 01:08 - 2011-01-04 23:09 - 00654166 _____ C:\Windows\system32\perfh007.dat
2013-08-22 01:08 - 2011-01-04 23:09 - 00130006 _____ C:\Windows\system32\perfc007.dat
2013-08-22 01:08 - 2009-07-14 07:13 - 01519874 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-22 01:07 - 2013-08-22 01:06 - 00000000 ____D C:\Windows\system32\MRT
2013-08-22 01:05 - 2013-04-15 18:00 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-22 00:37 - 2013-08-22 00:37 - 00000000 ____D C:\Users\Nadja_2\AppData\Local\{BE20219E-5E07-4358-A654-FAE234D4369C}
2013-08-22 00:37 - 2013-08-22 00:37 - 00000000 ____D C:\Users\Nadja_2\AppData\Local\{008C5916-654E-4EC2-81B7-5FF02A12903A}
2013-08-21 23:43 - 2013-04-16 08:22 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-21 23:43 - 2013-04-16 08:22 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-03 16:20 - 2013-08-03 15:14 - 00000000 ____D C:\Users\Nadja_2\AppData\Roaming\Jewel Match 3
2013-08-03 14:53 - 2013-04-25 08:53 - 00000342 _____ C:\Windows\Tasks\HPCeeScheduleForNADJA-HP$.job

Files to move or delete:
====================
C:\Users\Nadja_2\AppData\Local\Temp\SDIAG_abbcaf1e-b42e-4b64-9713-df157159bd63\DiagPackage.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-09-2013 03
Ran by Nadja_2 at 2013-09-01 22:31:37
Running from C:\Users\Nadja_2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2M7X192O
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Reader 9.5.5 MUI (x32 Version: 9.5.5)
Adobe Shockwave Player 11.5 (x32 Version: 11.5.8.612)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)
Atheros Driver Installation Program (x32 Version: 9.0)
ATI Catalyst Install Manager (Version: 3.0.804.0)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
Barn Yarn Collector's Edition (x32 Version: 3.0.2.48)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Bejeweled 3 (x32 Version: 2.2.0.95)
Bing Bar (x32 Version: 7.1.361.0)
Blasterball 3 (x32 Version: 2.2.0.95)
Bounce Symphony (x32 Version: 2.2.0.95)
Bubble Shooter Premium Edition (x32 Version: 3.0.2.32)
Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95)
Burger Island 2 (x32 Version: 2.2.0.95)
Cake Mania (x32 Version: 2.2.0.95)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.1217.1530.27758)
Catalyst Control Center InstallProxy (x32 Version: 2010.1217.1530.27758)
Catalyst Control Center Localization All (x32 Version: 2010.1217.1530.27758)
Catalyst Control Center Profiles Mobile (x32 Version: 2010.1217.1530.27758)
CCC Help Chinese Standard (x32 Version: 2010.1217.1529.27758)
CCC Help Chinese Traditional (x32 Version: 2010.1217.1529.27758)
CCC Help Czech (x32 Version: 2010.1217.1529.27758)
CCC Help Danish (x32 Version: 2010.1217.1529.27758)
CCC Help Dutch (x32 Version: 2010.1217.1529.27758)
CCC Help English (x32 Version: 2010.1217.1529.27758)
CCC Help Finnish (x32 Version: 2010.1217.1529.27758)
CCC Help French (x32 Version: 2010.1217.1529.27758)
CCC Help German (x32 Version: 2010.1217.1529.27758)
CCC Help Greek (x32 Version: 2010.1217.1529.27758)
CCC Help Hungarian (x32 Version: 2010.1217.1529.27758)
CCC Help Italian (x32 Version: 2010.1217.1529.27758)
CCC Help Japanese (x32 Version: 2010.1217.1529.27758)
CCC Help Korean (x32 Version: 2010.1217.1529.27758)
CCC Help Norwegian (x32 Version: 2010.1217.1529.27758)
CCC Help Polish (x32 Version: 2010.1217.1529.27758)
CCC Help Portuguese (x32 Version: 2010.1217.1529.27758)
CCC Help Russian (x32 Version: 2010.1217.1529.27758)
CCC Help Spanish (x32 Version: 2010.1217.1529.27758)
CCC Help Swedish (x32 Version: 2010.1217.1529.27758)
CCC Help Thai (x32 Version: 2010.1217.1529.27758)
ccc-core-static (x32 Version: 2010.1217.1530.27758)
ccc-utility64 (Version: 2010.1217.1530.27758)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Cisco EAP-FAST Module (x32 Version: 2.2.14)
Cisco LEAP Module (x32 Version: 1.0.19)
Cisco PEAP Module (x32 Version: 1.1.6)
CorelDRAW Graphics Suite 12 (x32 Version: 12.0.0.458)
CyberLink DVD Suite (x32 Version: 7.0.3525)
CyberLink YouCam (x32 Version: 3.2.1.3609)
D3DX10 (x32 Version: 15.4.2368.0902)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)
Energy Star Digital Logo (x32 Version: 1.0.1)
ESU for Microsoft Windows 7 (x32 Version: 1.0.0)
Farm Frenzy (x32 Version: 2.2.0.95)
FATE (x32 Version: 2.2.0.95)
Forbidden Secrets Alien Town (x32 Version: 3.0.2.48)
Gardenscapes 2 Collector's Edition (x32 Version: 3.0.2.48)
Google Chrome (x32 Version: 29.0.1547.62)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4413.1752)
Google Update Helper (x32 Version: 1.3.21.153)
HP Auto (Version: 1.0.12494.3472)
HP Client Services (Version: 1.0.12656.3472)
HP CloudDrive (x32)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7)
HP Documentation (x32 Version: 1.1.0.0)
HP Games (x32 Version: 1.0.1.5)
HP On Screen Display (x32 Version: 1.0.7)
HP Power Manager (x32 Version: 1.1.2)
HP Quick Launch (x32 Version: 2.3.6)
HP Setup (x32 Version: 8.4.4487.3576)
HP Setup Manager (x32 Version: 1.0.12845.3522)
HP Software Framework (x32 Version: 4.0.80.1)
HP Support Assistant (x32 Version: 5.1.11.1)
HP Wireless Assistant (Version: 4.0.10.0)
HPAsset component for HP Active Support Library (x32 Version: 3.0.0.3)
IDT Audio (x32 Version: 1.0.6315.0)
In Search of the Lost Temple (x32 Version: 3.0.2.48)
Insaniquarium Deluxe (x32 Version: 2.2.0.95)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Rapid Storage Technology (x32 Version: 10.0.0.1046)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.02.00.1002)
Java 7 Update 17 (x32 Version: 7.0.170)
Java Auto Updater (x32 Version: 2.1.9.0)
Java(TM) 6 Update 22 (64-bit) (Version: 6.0.220)
Jewel Match 3 (x32 Version: 2.2.0.98)
Jewel Quest II (x32 Version: 2.2.0.95)
Jewel Quest Mysteries (x32 Version: 2.2.0.95)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
John Deere Drive Green (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
LabelPrint (x32 Version: 2.5.3429)
LightScribe System Software (x32 Version: 1.18.20.1)
Luxor - Amun Rising (x32 Version: 2.2.0.95)
Luxor 2 HD (x32 Version: 3.0.2.38)
Luxor Amun Rising HD (x32 Version: 1.0.0.0)
Luxor Amun Rising HD (x32 Version: 3.0.2.48)
LUXOR Evolved (x32 Version: 3.0.2.48)
Luxor HD (x32 Version: 2.2.0.110)
Magic Desktop (x32 Version: 3.0)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Security Client (Version: 4.2.0223.1)
Microsoft Security Essentials (Version: 4.2.223.1)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Mysteryville 2 (x32 Version: 1.00.0000)
OpenOffice.org 3.4.1 (x32 Version: 3.41.9593)
Penguins! (x32 Version: 2.2.0.95)
PictureMover (x32 Version: 3.5.0.35)
Plants vs. Zombies (x32 Version: 2.2.0.95)
Polar Bowler (x32 Version: 2.2.0.95)
Power2Go (x32 Version: 6.1.4725)
PX Profile Update (x32 Version: 1.00.1.)
Realtek Ethernet Controller Driver (x32 Version: 7.26.902.2010)
Realtek PCIE Card Reader (x32 Version: 6.1.7600.69)
Recovery Manager (x32 Version: 1.0.22)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
SAT1 GAME CENTER (x32 Version: 1.0.0.46)
Slingo Deluxe (x32 Version: 2.2.0.95)
Synaptics Pointing Device Driver (Version: 15.2.4.4)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update Installer for WildTangent Games App (x32)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
Wedding Dash (x32 Version: 2.2.0.95)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.16)
WildTangent Games App (x32 Version: 4.0.10.16)
WildTangent-Spiele (x32 Version: 1.0.4.0)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Zuma Deluxe (x32 Version: 2.2.0.95)

==================== Restore Points  =========================

Could not list Restore Points.


==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
Task: C:\Windows\Tasks\HPCeeScheduleForNADJA-HP$.job => ?

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Users\Nadja_2\Desktop\Bestellnummer 286018.url:favicon


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/22/2013 00:04:28 AM) (Source: Application Hang) (User: )
Description: Programm CorelDRW.exe, Version 12.0.0.458 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 480

Startzeit: 01ce9eb9ddeaebfe

Endzeit: 16

Anwendungspfad: C:\Program Files (x86)\Corel\Corel Graphics 12\Programs\CorelDRW.exe

Berichts-ID: 9e62bd0e-0aad-11e3-bf02-984be1a3059c

Error: (07/30/2013 10:05:08 PM) (Source: ATIeRecord) (User: )
Description: ATI EEU PnP start/stop failed

Error: (07/23/2013 10:17:36 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: StructuredQuery.dll, Version: 7.0.7601.17514, Zeitstempel: 0x4ce7c9c7
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000003b2d9
ID des fehlerhaften Prozesses: 0xb38
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (06/28/2013 00:08:16 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Explorer.EXE, Version: 6.1.7601.17567, Zeitstempel: 0x4d672ee4
Name des fehlerhaften Moduls: DUI70.dll, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bdf25
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000001134
ID des fehlerhaften Prozesses: 0xb1c
Startzeit der fehlerhaften Anwendung: 0xExplorer.EXE0
Pfad der fehlerhaften Anwendung: Explorer.EXE1
Pfad des fehlerhaften Moduls: Explorer.EXE2
Berichtskennung: Explorer.EXE3

Error: (05/02/2013 11:34:05 PM) (Source: ESENT) (User: )
Description: WinMail (3412) WindowsMail0: Die Sicherung wurde abgebrochen, weil sie vom Client angehalten wurde, oder weil die Verbindung mit dem Client unterbrochen wurde.

Error: (05/02/2013 11:33:57 PM) (Source: ESENT) (User: )
Description: WinMail (3168) WindowsMail0: Die Sicherung wurde abgebrochen, weil sie vom Client angehalten wurde, oder weil die Verbindung mit dem Client unterbrochen wurde.

Error: (04/20/2013 08:47:50 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Dwm.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc541
Name des fehlerhaften Moduls: atidxx64.dll, Version: 8.17.10.325, Zeitstempel: 0x4d0bc59c
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000028307a
ID des fehlerhaften Prozesses: 0xb3c
Startzeit der fehlerhaften Anwendung: 0xDwm.exe0
Pfad der fehlerhaften Anwendung: Dwm.exe1
Pfad des fehlerhaften Moduls: Dwm.exe2
Berichtskennung: Dwm.exe3

Error: (04/17/2013 03:17:38 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{1A00C998-C37F-497F-A98F-8D29C9EEFE14}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}Explorer

Error: (04/10/2013 10:35:06 PM) (Source: EventSystem) (User: )
Description: 80070005EventSystem.EventSubscription{D46DE642-0B34-42AC-95E5-D57BB4D06EBA}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}Explorer

Error: (04/06/2013 10:44:06 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: LMS.exe, Version: 6.0.40.1213, Zeitstempel: 0x4b8ee3ba
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x72fa6a64
ID des fehlerhaften Prozesses: 0x4b4
Startzeit der fehlerhaften Anwendung: 0xLMS.exe0
Pfad der fehlerhaften Anwendung: LMS.exe1
Pfad des fehlerhaften Moduls: LMS.exe2
Berichtskennung: LMS.exe3


System errors:
=============
Error: (08/27/2013 10:10:00 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎27.‎08.‎2013 um 21:52:14 unerwartet heruntergefahren.

Error: (08/24/2013 02:02:01 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (08/24/2013 02:02:00 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (08/24/2013 02:02:00 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.

Error: (08/24/2013 01:02:46 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (08/24/2013 01:02:40 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (08/24/2013 01:02:35 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (08/24/2013 01:02:29 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (08/24/2013 01:02:23 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (08/24/2013 01:02:18 PM) (Source: cdrom) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.


Microsoft Office Sessions:
=========================
Error: (08/22/2013 00:04:28 AM) (Source: Application Hang)(User: )
Description: CorelDRW.exe12.0.0.45848001ce9eb9ddeaebfe16C:\Program Files (x86)\Corel\Corel Graphics 12\Programs\CorelDRW.exe9e62bd0e-0aad-11e3-bf02-984be1a3059c

Error: (07/30/2013 10:05:08 PM) (Source: ATIeRecord)(User: )
Description: 

Error: (07/23/2013 10:17:36 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4StructuredQuery.dll7.0.7601.175144ce7c9c7c0000005000000000003b2d9b3801ce87e181601178C:\Windows\Explorer.EXEC:\Windows\System32\StructuredQuery.dlle9a61658-f3d4-11e2-87aa-984be1a3059c

Error: (06/28/2013 00:08:16 AM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4DUI70.dll6.1.7600.163854a5bdf25c00000050000000000001134b1c01ce737d0be58dddC:\Windows\Explorer.EXEC:\Windows\system32\DUI70.dll110fd605-df76-11e2-8857-984be1a3059c

Error: (05/02/2013 11:34:05 PM) (Source: ESENT)(User: )
Description: WinMail3412WindowsMail0:

Error: (05/02/2013 11:33:57 PM) (Source: ESENT)(User: )
Description: WinMail3168WindowsMail0:

Error: (04/20/2013 08:47:50 AM) (Source: Application Error)(User: )
Description: Dwm.exe6.1.7600.163854a5bc541atidxx64.dll8.17.10.3254d0bc59cc0000005000000000028307ab3c01ce3d92f7eacc1eC:\Windows\system32\Dwm.exeC:\Windows\system32\atidxx64.dll37489170-a986-11e2-ad3e-984be1a3059c

Error: (04/17/2013 03:17:38 PM) (Source: EventSystem)(User: )
Description: 80070005EventSystem.EventSubscription{1A00C998-C37F-497F-A98F-8D29C9EEFE14}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}Explorer

Error: (04/10/2013 10:35:06 PM) (Source: EventSystem)(User: )
Description: 80070005EventSystem.EventSubscription{D46DE642-0B34-42AC-95E5-D57BB4D06EBA}-{00000000-0000-0000-0000-000000000000}-{00000000-0000-0000-0000-000000000000}Explorer

Error: (04/06/2013 10:44:06 AM) (Source: Application Error)(User: )
Description: LMS.exe6.0.40.12134b8ee3baunknown0.0.0.000000000c000000572fa6a644b401ce32a29c0981c6C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exeunknown239fa708-9e96-11e2-b514-984be1a3059c


==================== Memory info =========================== 

Percentage of memory in use: 43%
Total physical RAM: 3893.86 MB
Available physical RAM: 2199.38 MB
Total Pagefile: 7785.9 MB
Available Pagefile: 5669.67 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:581.23 GB) (Free:504.5 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:1.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

==================== End Of Log ============================
         

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-01 22:54:53
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ00 596,17GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Nadja\AppData\Local\Temp\ugtiqpow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                                              fffff80002e08000 58 bytes [E8, 9B, 0F, F9, FF, F0, 83, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 619                                                                              fffff80002e0803b 55 bytes {SHL EDX, 0x20; OR RAX, RDX; MOV R11, RAX; MOV [RBP+0x50], RAX; JMP 0xfffffffffff976f9}

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                        0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                       00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                             * 2
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess             0000000077c908fc 5 bytes JMP 000000010087a8bc
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                      0000000077cac45a 5 bytes JMP 000000010087aa99
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\USER32.dll!TranslateMessage               00000000771f7809 5 bytes JMP 0000000100888e2f
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\USER32.dll!GetClipboardData               0000000077239f1d 5 bytes JMP 0000000100888e93
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext         00000000756e0bb9 5 bytes JMP 00000001008959b4
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                00000000756e124e 5 bytes JMP 00000001008959fe
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                00000000756e129d 5 bytes JMP 0000000100895a42
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!closesocket                    0000000076b83918 5 bytes JMP 0000000100876a4f
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                    0000000076b84296 5 bytes JMP 00000001008768e4
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!WSASend                        0000000076b84406 5 bytes JMP 0000000100876c8f
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                   0000000076b84889 5 bytes JMP 00000001008767e5
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                  0000000076b84b1b 5 bytes JMP 000000010087695c
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!recv                           0000000076b86b0e 5 bytes JMP 0000000100876aa6
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!send                           0000000076b86f01 5 bytes JMP 0000000100876c3d
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!WSARecv                        0000000076b87089 5 bytes JMP 0000000100876afe
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult         0000000076b87489 5 bytes JMP 0000000100876d3b
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WS2_32.dll!gethostbyname                  0000000076b97673 5 bytes JMP 00000001008769e2
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore            00000000768f1884 5 bytes JMP 0000000100888f14
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!InternetCloseHandle           00000000776c4282 5 bytes JMP 000000010088e6a9
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                00000000776c7079 5 bytes JMP 000000010088fa0d
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                00000000776c77c2 5 bytes JMP 000000010088fa31
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!HttpSendRequestW              00000000776c7ca6 5 bytes JMP 000000010088f193
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable    00000000776d92e9 5 bytes JMP 000000010088f972
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!InternetReadFile              00000000776d972b 5 bytes JMP 000000010088f900
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!InternetReadFileExW           00000000776eadd7 5 bytes JMP 000000010088f94c
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!InternetReadFileExA           00000000776eae2e 5 bytes JMP 000000010088f926
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW            000000007772ceff 5 bytes JMP 000000010088f1d9
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!InternetWriteFile             000000007772d06f 5 bytes JMP 000000010088f35c
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA            0000000077793222 5 bytes JMP 000000010088f1b6
.text     C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe[3324] C:\Windows\syswow64\WININET.dll!HttpSendRequestA              00000000777932f2 5 bytes JMP 000000010088f170
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                                0000000077c908fc 5 bytes JMP 000000010052a8bc
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                         0000000077cac45a 5 bytes JMP 000000010052aa99
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\USER32.dll!TranslateMessage                                  00000000771f7809 5 bytes JMP 0000000100538e2f
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\USER32.dll!GetClipboardData                                  0000000077239f1d 5 bytes JMP 0000000100538e93
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                            00000000756e0bb9 5 bytes JMP 00000001005459b4
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                   00000000756e124e 5 bytes JMP 00000001005459fe
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                   00000000756e129d 5 bytes JMP 0000000100545a42
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!closesocket                                       0000000076b83918 5 bytes JMP 0000000100526a4f
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                       0000000076b84296 5 bytes JMP 00000001005268e4
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!WSASend                                           0000000076b84406 5 bytes JMP 0000000100526c8f
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                      0000000076b84889 5 bytes JMP 00000001005267e5
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                     0000000076b84b1b 5 bytes JMP 000000010052695c
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!recv                                              0000000076b86b0e 5 bytes JMP 0000000100526aa6
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!send                                              0000000076b86f01 5 bytes JMP 0000000100526c3d
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!WSARecv                                           0000000076b87089 5 bytes JMP 0000000100526afe
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                            0000000076b87489 5 bytes JMP 0000000100526d3b
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                     0000000076b97673 5 bytes JMP 00000001005269e2
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                               00000000768f1884 5 bytes JMP 0000000100538f14
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                              00000000776c4282 5 bytes JMP 000000010053e6a9
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                   00000000776c7079 5 bytes JMP 000000010053fa0d
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                   00000000776c77c2 5 bytes JMP 000000010053fa31
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                 00000000776c7ca6 5 bytes JMP 000000010053f193
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                       00000000776d92e9 5 bytes JMP 000000010053f972
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!InternetReadFile                                 00000000776d972b 5 bytes JMP 000000010053f900
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                              00000000776eadd7 5 bytes JMP 000000010053f94c
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                              00000000776eae2e 5 bytes JMP 000000010053f926
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                               000000007772ceff 5 bytes JMP 000000010053f1d9
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!InternetWriteFile                                000000007772d06f 5 bytes JMP 000000010053f35c
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                               0000000077793222 5 bytes JMP 000000010053f1b6
.text     C:\Program Files (x86)\PictureMover\Bin\PictureMover.exe[3540] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                 00000000777932f2 5 bytes JMP 000000010053f170
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                             0000000077c908fc 5 bytes JMP 0000000100c6a8bc
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                      0000000077cac45a 5 bytes JMP 0000000100c6aa99
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\USER32.dll!TranslateMessage                               00000000771f7809 5 bytes JMP 0000000100c78e2f
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\USER32.dll!GetClipboardData                               0000000077239f1d 5 bytes JMP 0000000100c78e93
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                         00000000756e0bb9 5 bytes JMP 0000000100c859b4
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                00000000756e124e 5 bytes JMP 0000000100c859fe
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                00000000756e129d 5 bytes JMP 0000000100c85a42
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!closesocket                                    0000000076b83918 5 bytes JMP 0000000100c66a4f
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                    0000000076b84296 5 bytes JMP 0000000100c668e4
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!WSASend                                        0000000076b84406 5 bytes JMP 0000000100c66c8f
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                   0000000076b84889 5 bytes JMP 0000000100c667e5
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                  0000000076b84b1b 5 bytes JMP 0000000100c6695c
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!recv                                           0000000076b86b0e 5 bytes JMP 0000000100c66aa6
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!send                                           0000000076b86f01 5 bytes JMP 0000000100c66c3d
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!WSARecv                                        0000000076b87089 5 bytes JMP 0000000100c66afe
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                         0000000076b87489 5 bytes JMP 0000000100c66d3b
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                  0000000076b97673 5 bytes JMP 0000000100c669e2
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                            00000000768f1884 5 bytes JMP 0000000100c78f14
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                           00000000776c4282 5 bytes JMP 0000000100c7e6a9
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                00000000776c7079 5 bytes JMP 0000000100c7fa0d
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                00000000776c77c2 5 bytes JMP 0000000100c7fa31
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                              00000000776c7ca6 5 bytes JMP 0000000100c7f193
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                    00000000776d92e9 5 bytes JMP 0000000100c7f972
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!InternetReadFile                              00000000776d972b 5 bytes JMP 0000000100c7f900
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                           00000000776eadd7 5 bytes JMP 0000000100c7f94c
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                           00000000776eae2e 5 bytes JMP 0000000100c7f926
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                            000000007772ceff 5 bytes JMP 0000000100c7f1d9
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!InternetWriteFile                             000000007772d06f 5 bytes JMP 0000000100c7f35c
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                            0000000077793222 5 bytes JMP 0000000100c7f1b6
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe[3628] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                              00000000777932f2 5 bytes JMP 0000000100c7f170
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                             0000000077c908fc 5 bytes JMP 0000000100e9a8bc
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                      0000000077cac45a 5 bytes JMP 0000000100e9aa99
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\USER32.dll!TranslateMessage                               00000000771f7809 5 bytes JMP 0000000100ea8e2f
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\USER32.dll!GetClipboardData                               0000000077239f1d 5 bytes JMP 0000000100ea8e93
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                         00000000756e0bb9 5 bytes JMP 0000000100eb59b4
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                00000000756e124e 5 bytes JMP 0000000100eb59fe
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                                00000000756e129d 5 bytes JMP 0000000100eb5a42
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!closesocket                                    0000000076b83918 5 bytes JMP 0000000100e96a4f
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                                    0000000076b84296 5 bytes JMP 0000000100e968e4
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!WSASend                                        0000000076b84406 5 bytes JMP 0000000100e96c8f
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                                   0000000076b84889 5 bytes JMP 0000000100e967e5
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                                  0000000076b84b1b 5 bytes JMP 0000000100e9695c
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!recv                                           0000000076b86b0e 5 bytes JMP 0000000100e96aa6
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!send                                           0000000076b86f01 5 bytes JMP 0000000100e96c3d
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!WSARecv                                        0000000076b87089 5 bytes JMP 0000000100e96afe
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                         0000000076b87489 5 bytes JMP 0000000100e96d3b
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WS2_32.dll!gethostbyname                                  0000000076b97673 5 bytes JMP 0000000100e969e2
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                             * 2
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                            00000000768f1884 5 bytes JMP 0000000100ea8f14
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                           00000000776c4282 5 bytes JMP 0000000100eae6a9
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                                00000000776c7079 5 bytes JMP 0000000100eafa0d
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                                00000000776c77c2 5 bytes JMP 0000000100eafa31
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                              00000000776c7ca6 5 bytes JMP 0000000100eaf193
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                    00000000776d92e9 5 bytes JMP 0000000100eaf972
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!InternetReadFile                              00000000776d972b 5 bytes JMP 0000000100eaf900
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                           00000000776eadd7 5 bytes JMP 0000000100eaf94c
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                           00000000776eae2e 5 bytes JMP 0000000100eaf926
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                            000000007772ceff 5 bytes JMP 0000000100eaf1d9
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!InternetWriteFile                             000000007772d06f 5 bytes JMP 0000000100eaf35c
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                            0000000077793222 5 bytes JMP 0000000100eaf1b6
.text     C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[3660] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                              00000000777932f2 5 bytes JMP 0000000100eaf170
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess           0000000077c908fc 5 bytes JMP 000000010051a8bc
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                    0000000077cac45a 5 bytes JMP 000000010051aa99
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext       00000000756e0bb9 5 bytes JMP 00000001005359b4
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\SspiCli.dll!EncryptMessage              00000000756e124e 5 bytes JMP 00000001005359fe
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\SspiCli.dll!DecryptMessage              00000000756e129d 5 bytes JMP 0000000100535a42
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\USER32.dll!TranslateMessage             00000000771f7809 5 bytes JMP 0000000100528e2f
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\USER32.dll!GetClipboardData             0000000077239f1d 5 bytes JMP 0000000100528e93
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!closesocket                  0000000076b83918 5 bytes JMP 0000000100516a4f
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                  0000000076b84296 5 bytes JMP 00000001005168e4
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!WSASend                      0000000076b84406 5 bytes JMP 0000000100516c8f
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                 0000000076b84889 5 bytes JMP 00000001005167e5
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                0000000076b84b1b 5 bytes JMP 000000010051695c
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!recv                         0000000076b86b0e 5 bytes JMP 0000000100516aa6
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!send                         0000000076b86f01 5 bytes JMP 0000000100516c3d
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!WSARecv                      0000000076b87089 5 bytes JMP 0000000100516afe
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult       0000000076b87489 5 bytes JMP 0000000100516d3b
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WS2_32.dll!gethostbyname                0000000076b97673 5 bytes JMP 00000001005169e2
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore          00000000768f1884 5 bytes JMP 0000000100528f14
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!InternetCloseHandle         00000000776c4282 5 bytes JMP 000000010052e6a9
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA              00000000776c7079 5 bytes JMP 000000010052fa0d
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW              00000000776c77c2 5 bytes JMP 000000010052fa31
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!HttpSendRequestW            00000000776c7ca6 5 bytes JMP 000000010052f193
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable  00000000776d92e9 5 bytes JMP 000000010052f972
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!InternetReadFile            00000000776d972b 5 bytes JMP 000000010052f900
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!InternetReadFileExW         00000000776eadd7 5 bytes JMP 000000010052f94c
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!InternetReadFileExA         00000000776eae2e 5 bytes JMP 000000010052f926
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW          000000007772ceff 5 bytes JMP 000000010052f1d9
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!InternetWriteFile           000000007772d06f 5 bytes JMP 000000010052f35c
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA          0000000077793222 5 bytes JMP 000000010052f1b6
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3676] C:\Windows\syswow64\WININET.dll!HttpSendRequestA            00000000777932f2 5 bytes JMP 000000010052f170
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                     0000000077c908fc 5 bytes JMP 00000001003ca8bc
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                              0000000077cac45a 5 bytes JMP 00000001003caa99
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\USER32.dll!TranslateMessage                       00000000771f7809 5 bytes JMP 00000001003d8e2f
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\USER32.dll!GetClipboardData                       0000000077239f1d 5 bytes JMP 00000001003d8e93
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                 00000000756e0bb9 5 bytes JMP 00000001003e59b4
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                        00000000756e124e 5 bytes JMP 00000001003e59fe
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                        00000000756e129d 5 bytes JMP 00000001003e5a42
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!closesocket                            0000000076b83918 5 bytes JMP 00000001003c6a4f
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                            0000000076b84296 5 bytes JMP 00000001003c68e4
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!WSASend                                0000000076b84406 5 bytes JMP 00000001003c6c8f
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                           0000000076b84889 5 bytes JMP 00000001003c67e5
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                          0000000076b84b1b 5 bytes JMP 00000001003c695c
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!recv                                   0000000076b86b0e 5 bytes JMP 00000001003c6aa6
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!send                                   0000000076b86f01 5 bytes JMP 00000001003c6c3d
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!WSARecv                                0000000076b87089 5 bytes JMP 00000001003c6afe
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                 0000000076b87489 5 bytes JMP 00000001003c6d3b
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WS2_32.dll!gethostbyname                          0000000076b97673 5 bytes JMP 00000001003c69e2
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                    00000000768f1884 5 bytes JMP 00000001003d8f14
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                   00000000776c4282 5 bytes JMP 00000001003de6a9
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                        00000000776c7079 5 bytes JMP 00000001003dfa0d
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                        00000000776c77c2 5 bytes JMP 00000001003dfa31
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                      00000000776c7ca6 5 bytes JMP 00000001003df193
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable            00000000776d92e9 5 bytes JMP 00000001003df972
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!InternetReadFile                      00000000776d972b 5 bytes JMP 00000001003df900
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                   00000000776eadd7 5 bytes JMP 00000001003df94c
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                   00000000776eae2e 5 bytes JMP 00000001003df926
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                    000000007772ceff 5 bytes JMP 00000001003df1d9
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!InternetWriteFile                     000000007772d06f 5 bytes JMP 00000001003df35c
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                    0000000077793222 5 bytes JMP 00000001003df1b6
.text     C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe[3772] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                      00000000777932f2 5 bytes JMP 00000001003df170
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                   0000000077c908fc 5 bytes JMP 000000010029a8bc
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                            0000000077cac45a 5 bytes JMP 000000010029aa99
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\USER32.dll!TranslateMessage                     00000000771f7809 5 bytes JMP 00000001002a8e2f
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\USER32.dll!GetClipboardData                     0000000077239f1d 5 bytes JMP 00000001002a8e93
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext               00000000756e0bb9 5 bytes JMP 00000001002b59b4
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                      00000000756e124e 5 bytes JMP 00000001002b59fe
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                      00000000756e129d 5 bytes JMP 00000001002b5a42
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!closesocket                          0000000076b83918 5 bytes JMP 0000000100296a4f
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                          0000000076b84296 5 bytes JMP 00000001002968e4
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!WSASend                              0000000076b84406 5 bytes JMP 0000000100296c8f
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                         0000000076b84889 5 bytes JMP 00000001002967e5
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                        0000000076b84b1b 5 bytes JMP 000000010029695c
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!recv                                 0000000076b86b0e 5 bytes JMP 0000000100296aa6
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!send                                 0000000076b86f01 5 bytes JMP 0000000100296c3d
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!WSARecv                              0000000076b87089 5 bytes JMP 0000000100296afe
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult               0000000076b87489 5 bytes JMP 0000000100296d3b
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WS2_32.dll!gethostbyname                        0000000076b97673 5 bytes JMP 00000001002969e2
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                  00000000768f1884 5 bytes JMP 00000001002a8f14
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                 00000000776c4282 5 bytes JMP 00000001002ae6a9
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                      00000000776c7079 5 bytes JMP 00000001002afa0d
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                      00000000776c77c2 5 bytes JMP 00000001002afa31
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                    00000000776c7ca6 5 bytes JMP 00000001002af193
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable          00000000776d92e9 5 bytes JMP 00000001002af972
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!InternetReadFile                    00000000776d972b 5 bytes JMP 00000001002af900
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                 00000000776eadd7 5 bytes JMP 00000001002af94c
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                 00000000776eae2e 5 bytes JMP 00000001002af926
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                  000000007772ceff 5 bytes JMP 00000001002af1d9
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!InternetWriteFile                   000000007772d06f 5 bytes JMP 00000001002af35c
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                  0000000077793222 5 bytes JMP 00000001002af1b6
.text     C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe[3844] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                    00000000777932f2 5 bytes JMP 00000001002af170
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\SysWOW64\ntdll.dll!NtCreateUserProcess                        0000000077c908fc 5 bytes JMP 000000010029a8bc
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll                                 0000000077cac45a 5 bytes JMP 000000010029aa99
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                    00000000756e0bb9 5 bytes JMP 00000001002b59b4
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                           00000000756e124e 5 bytes JMP 00000001002b59fe
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\SspiCli.dll!DecryptMessage                           00000000756e129d 5 bytes JMP 00000001002b5a42
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\USER32.dll!TranslateMessage                          00000000771f7809 5 bytes JMP 00000001002a8e2f
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\USER32.dll!GetClipboardData                          0000000077239f1d 5 bytes JMP 00000001002a8e93
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                      00000000776c4282 5 bytes JMP 00000001002ae6a9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!HttpQueryInfoA                           00000000776c7079 5 bytes JMP 00000001002afa0d
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!HttpQueryInfoW                           00000000776c77c2 5 bytes JMP 00000001002afa31
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                         00000000776c7ca6 5 bytes JMP 00000001002af193
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable               00000000776d92e9 5 bytes JMP 00000001002af972
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!InternetReadFile                         00000000776d972b 5 bytes JMP 00000001002af900
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!InternetReadFileExW                      00000000776eadd7 5 bytes JMP 00000001002af94c
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                      00000000776eae2e 5 bytes JMP 00000001002af926
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                       000000007772ceff 5 bytes JMP 00000001002af1d9
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!InternetWriteFile                        000000007772d06f 5 bytes JMP 00000001002af35c
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                       0000000077793222 5 bytes JMP 00000001002af1b6
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                         00000000777932f2 5 bytes JMP 00000001002af170
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!closesocket                               0000000076b83918 5 bytes JMP 0000000100296a4f
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!getaddrinfo                               0000000076b84296 5 bytes JMP 00000001002968e4
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!WSASend                                   0000000076b84406 5 bytes JMP 0000000100296c8f
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!GetAddrInfoW                              0000000076b84889 5 bytes JMP 00000001002967e5
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!FreeAddrInfoW                             0000000076b84b1b 5 bytes JMP 000000010029695c
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!recv                                      0000000076b86b0e 5 bytes JMP 0000000100296aa6
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!send                                      0000000076b86f01 5 bytes JMP 0000000100296c3d
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!WSARecv                                   0000000076b87089 5 bytes JMP 0000000100296afe
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!WSAGetOverlappedResult                    0000000076b87489 5 bytes JMP 0000000100296d3b
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\WS2_32.dll!gethostbyname                             0000000076b97673 5 bytes JMP 00000001002969e2
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                       00000000768f1884 5 bytes JMP 00000001002a8f14
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                             * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69    0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4928] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155   00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                             * 2
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[2164] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                   0000000076a0a30a 1 byte [62]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[2164] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                 0000000076991465 2 bytes [99, 76]
.text     C:\Program Files\AVAST Software\Avast\AvastUI.exe[2164] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                             * 2
.text     C:\Windows\system32\AUDIODG.EXE[2156] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                                     00000000779ceecd 1 byte [62]
.text     C:\Users\Nadja_2\Downloads\gmer_2.1.19163.exe[5004] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                       0000000076a0a30a 1 byte [62]

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type                                                                                            2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start                                                                                           2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl                                                                                    1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName                                                                                     aswFsBlk
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group                                                                                           FSFilter Activity Monitor
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService                                                                                 FltMgr?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description                                                                                     avast! mini-filter driver (aswFsBlk)
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag                                                                                             2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances                                                                                       
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance                                                                       aswFsBlk Instance
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance                                                                     
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                            388400
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                               0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk                                                                                                 
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type                                                                                           2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start                                                                                          2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl                                                                                   1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath                                                                                      \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName                                                                                    aswMonFlt
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group                                                                                          FSFilter Anti-Virus
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService                                                                                FltMgr?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description                                                                                    avast! mini-filter driver (aswMonFlt)
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances                                                                                      
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance                                                                      aswMonFlt Instance
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                          320700
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                             0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt                                                                                                
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath                                                                                         \SystemRoot\System32\Drivers\aswrdr2.sys
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type                                                                                              1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start                                                                                             1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl                                                                                      1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName                                                                                       aswRdr
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group                                                                                             PNP_TDI
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService                                                                                   tcpip?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description                                                                                       avast! WFP Redirect driver
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters                                                                                        
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                     
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                     nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRdr                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type                                                                                             1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start                                                                                            0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl                                                                                     1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName                                                                                      aswRvrt
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description                                                                                      avast! Revert
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt                                                                                                  
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type                                                                                              2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start                                                                                             1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl                                                                                      1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName                                                                                       aswSnx
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group                                                                                             FSFilter Virtualization
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService                                                                                   FltMgr?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description                                                                                       avast! virtualization driver (aswSnx)
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag                                                                                               2
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances                                                                                         
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance                                                                         aswSnx Instance
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance                                                                         
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                137600
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags                                                                   0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters                                                                                        
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder                                                                          \DosDevices\C:\Program Files\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder                                                                             \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSnx                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type                                                                                               1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start                                                                                              1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl                                                                                       1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName                                                                                        aswSP
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description                                                                                        avast! Self Protection
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters                                                                                         
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield                                                                             1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder                                                                           \DosDevices\C:\Program Files\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder                                                                              \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder                                                                      \DosDevices\C:\Program Files
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder                                                                            \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswSP                                                                                                    
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type                                                                                              1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start                                                                                             1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl                                                                                      1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName                                                                                       avast! Network Shield Support
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group                                                                                             PNP_TDI
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService                                                                                   tcpip?
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description                                                                                       avast! Network Shield TDI driver
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag                                                                                               9
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswTdi                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type                                                                                              1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start                                                                                             0
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl                                                                                      1
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName                                                                                       aswVmm
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description                                                                                       avast! VM Monitor
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters                                                                                        
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswVmm                                                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type                                                                                    32
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start                                                                                   2
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl                                                                            1
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath                                                                               "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName                                                                             avast! Antivirus
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group                                                                                   ShellSvcGroup
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService                                                                         aswMonFlt?RpcSS?
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64                                                                                   1
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName                                                                              LocalSystem
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType                                                                          1
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description                                                                             Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg       HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus                                                                                         

---- EOF - GMER 2.1 ----