| |
| |||||||
Log-Analyse und Auswertung: qvo6.com entfernen, diverse ProblemeWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
| |
04.02.2014, 18:56
| #1 |
| |  qvo6.com entfernen, diverse Probleme Hallo liebes Forum, heute bin ich das erste `Mal bei Euch und hoffe sehr, dass Ihr mir weiterhelfen könnt. Die Regeln habe ich gelesen, verstanden und ich hoffe, dass ich nun Alles richtig machen werde. Seit ca. 6 Monaten startet mein Brower (Opera) mit www.qvo6.com. Eine, wie ich mittlerweile weiß, böse Seite. In letzter Zeit bekomme ich immer mehr Fehlermeldungen und Abstürze und ich vermute, dass qvo6 damit zu tun hat. Hier meine logs: defogger.disable.txt Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:58 on 04/02/2014
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-02-04 18:21:28
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000041 ST750LM022_HN-M750MBB rev.2AR10001 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\*****\AppData\Local\Temp\uxloapow.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\wininit.exe[596] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wininit.exe[596] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\winlogon.exe[668] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\winlogon.exe[668] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[912] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[912] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[948] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[948] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[140] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[140] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\svchost.exe[368] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\svchost.exe[368] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df70260
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df702d0
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70298
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70228
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70308
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\dwm.exe[720] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[836] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[836] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[328] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[328] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df702d0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df70340
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70308
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70298
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70378
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 000007fa9e1b2100 5 bytes JMP 000007fb9df70228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 000007fa9e1c5d4c 7 bytes JMP 000007fb9df70260
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1092] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1104] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1104] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1104] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1104] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\nvvsvc.exe[1104] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\System32\svchost.exe[1172] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\svchost.exe[1172] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[1368] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[1368] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[1416] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\WLANExt.exe[1608] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\WLANExt.exe[1608] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\WLANExt.exe[1608] C:\Windows\system32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\WLANExt.exe[1608] C:\Windows\system32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\WLANExt.exe[1608] C:\Windows\system32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\conhost.exe[1620] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\conhost.exe[1620] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\spoolsv.exe[1944] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\spoolsv.exe[1944] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[1996] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[1996] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1040] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1040] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1040] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1040] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1040] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1040] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007fa96341b32 4 bytes [34, 96, FA, 07]
.text C:\Program Files\Intel\WiFi\bin\EvtEng.exe[1040] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007fa96341b3a 4 bytes [34, 96, FA, 07]
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[260] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\iCLS Client\HeciServer.exe[260] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[1516] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe[1516] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2344] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2344] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2344] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2344] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe[2344] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\svchost.exe[2416] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\svchost.exe[2416] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df702d0
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df70340
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70308
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70298
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70378
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Program Files\ASUS\P4G\BatteryLife.exe[3208] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df70260
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df702d0
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70298
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70228
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70308
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\taskhostex.exe[3236] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\Explorer.EXE[3408] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\Explorer.EXE[3408] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\Explorer.EXE[3408] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Windows\Explorer.EXE[3408] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\Explorer.EXE[3408] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df702d0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df70340
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70308
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70298
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70378
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 000007fa9e1b2100 5 bytes JMP 000007fb9df70228
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 000007fa9e1c5d4c 7 bytes JMP 000007fb9df70260
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3804] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[3996] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wbem\unsecapp.exe[3996] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[4024] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[4024] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[4024] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[4024] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[4024] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe[3396] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe[3396] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe[3396] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe[3396] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Windows\System32\igfxtray.exe[3664] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\igfxtray.exe[3664] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe[2236] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe[2236] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe[2236] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe[2236] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe[3724] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 000007fa9e1b2100 5 bytes JMP 000007fb9df70228
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe[3724] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 000007fa9e1c5d4c 7 bytes JMP 000007fb9df70260
.text C:\Windows\System32\hkcmd.exe[3064] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\hkcmd.exe[3064] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df702d0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df70340
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70308
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70298
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70378
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 000007fa9e1b2100 5 bytes JMP 000007fb9df70228
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 000007fa9e1c5d4c 7 bytes JMP 000007fb9df70260
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2588] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df702d0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df70340
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70308
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70298
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70378
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 000007fa9e1b2100 5 bytes JMP 000007fb9df70228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 000007fa9e1c5d4c 7 bytes JMP 000007fb9df70260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3620] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[3752] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\wbem\wmiprvse.exe[3752] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\rundll32.exe[4204] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\rundll32.exe[4204] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\System32\rundll32.exe[4204] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007fa9a251532 4 bytes [25, 9A, FA, 07]
.text C:\Windows\System32\rundll32.exe[4204] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007fa9a25153a 4 bytes [25, 9A, FA, 07]
.text C:\Windows\System32\rundll32.exe[4204] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007fa9a25165a 4 bytes [25, 9A, FA, 07]
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe[5088] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe[5088] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df702d0
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df70340
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70308
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70298
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70378
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\SYSTEM32\combase.dll!CoCreateInstance 000007fa9e1b2100 5 bytes JMP 000007fb9df70228
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\SYSTEM32\combase.dll!CoSetProxyBlanket 000007fa9e1c5d4c 7 bytes JMP 000007fb9df70260
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\igfxpers.exe[3600] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 000007faa09e5658 7 bytes JMP 000007fb9df70260
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 000007faa09e5778 7 bytes JMP 000007fb9df702d0
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 000007faa0a140e4 7 bytes JMP 000007fb9df70298
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 000007faa0a14178 8 bytes JMP 000007fb9df70228
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 000007faa0a1479c 8 bytes JMP 000007fb9df70308
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fa9dfb28a0 7 bytes JMP 000007fb9df700d8
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fa9dfb28e8 5 bytes JMP 000007fb9df70180
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fa9dfcf590 6 bytes JMP 000007fb9df70148
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fa9dfcf8ac 5 bytes JMP 000007fb9df70110
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fa9fcc1070 8 bytes JMP 000007fb9df701f0
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fa9fce0c10 8 bytes JMP 000007fb9df701b8
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Windows\system32\taskeng.exe[5060] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[5044] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe[5044] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[4728] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007faa094177a 4 bytes [94, A0, FA, 07]
.text C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe[4728] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007faa0941782 4 bytes [94, A0, FA, 07]
---- Threads - GMER 2.1 ----
Thread C:\Windows\system32\csrss.exe [612:644] fffff960009745e8
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:2652] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:696] 0000000067f76224
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4828] 000000006172f677
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4880] 000000006172f677
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4864] 000000006172f677
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4868] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:3052] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4852] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:3808] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:3120] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4168] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4744] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4752] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4780] 0000000067f76dc4
Thread C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [4508:4784] 0000000067f76dc4
---- Processes - GMER 2.1 ----
Process C:\Users\*****\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe (*** suspicious ***) @ C:\Users\*****\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe [4308](2012-10-26 06:49:04) 0000000000a90000
Library C:\PROGRA~3\Wincert\WIN64C~1.DLL (*** suspicious ***) @ C:\Windows\system32\msiexec.exe [3708](2013-02-07 12:11:46) 000007fa96de0000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2014
Ran by ***** at 2014-02-04 18:00:23
Running from C:\Users\*****\Downloads\1
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Adobe AIR (x32 Version: 3.4.0.2540 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.4.0.2540 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
ANNO 1404 (x32 Version: 1.03.0000 - Ubisoft)
Apple Application Support (x32 Version: 2.3 - Apple Inc.)
Assassin's Creed (x32 Version: 1.02 - Ubisoft)
Assassin's Creed Brotherhood (x32 Version: 1.03 - Ubisoft)
Assassin's Creed II (x32 Version: 1.01 - Ubisoft)
Assassin's Creed Revelations 1.03 (x32 Version: 1.03 - Ubisoft)
Assassin's Creed(R) III v1.06 (x32 Version: 1.06 - Ubisoft)
ASUS Instant Connect (x32 Version: 1.2.8 - ASUS)
ASUS Instant Key (x32 Version: 1.0.5 - ASUS)
ASUS InstantOn (x32 Version: 3.0.2 - ASUS)
ASUS LifeFrame3 (x32 Version: 3.1.5 - ASUS)
ASUS Live Update (x32 Version: 3.1.8 - ASUS)
ASUS N Series Demo (x32 Version: 1.0.0002 - ASUS)
ASUS Power4Gear Hybrid (Version: 2.0.4 - ASUS)
ASUS Smart Gesture (x32 Version: 1.0.35 - ASUS)
ASUS Splendid Video Enhancement Technology (x32 Version: 1.03.0004 - ASUS)
ASUS Tutor (x32 Version: 1.0.7 - ASUS)
ASUS USB Charger Plus (x32 Version: 2.1.4 - ASUS)
ASUS Video Magic (x32 Version: 6.0.4712 - CyberLink Corp.)
ASUS Video Magic (x32 Version: 6.0.4712 - CyberLink Corp.) Hidden
ASUS WebStorage Sync Agent (x32 Version: 1.1.9.120 - ASUS Cloud Corporation)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.)
ASUSDVD (x32 Version: 10.0.4126.52 - CyberLink Corp.) Hidden
AsusVibe2.0 (x32 Version: 2.0.10.168 - ASUSTEK)
ATK Package (x32 Version: 1.0.0022 - ASUS)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3019_44673 - CyberLink Corp.)
CyberLink MediaEspresso 6.5 (x32 Version: 6.5.3019_44673 - CyberLink Corp.) Hidden
CyberLink PowerDirector (x32 Version: 8.0.4905d - CyberLink Corp.)
CyberLink PowerDirector (x32 Version: 8.0.4905d - CyberLink Corp.) Hidden
FLV Player (HKCU Version: 1.0 - Somoto Ltd.) <==== ATTENTION
grandMA 3D 6 [2.6.0][6.6] v6.0.21.11028 (x32 Version: 6.0.21.11028 - MA Lighting Technologies)
grandMA2 onPC 2.6.0.5 (x32 Version: - )
Intel PROSet Wireless (Version: - ) Hidden
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.2828 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) + High Speed (Version: 15.5.0.0344 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 2.5.0.0248 - Motorola Solutions, Inc)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel(R) WiDi (Version: 3.5.34.0 - Intel Corporation)
Intel® PROSet/Wireless WiFi Software (Version: 15.05.2000.1462 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Microsoft Office Home and Student 2013 - de-de (Version: 15.0.4551.1512 - Microsoft Corporation)
Microsoft Silverlight (x32 Version: 5.1.20125.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU Version: 17.0.2003.1112 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (x32 Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
NVIDIA 3D Vision Treiber 306.97 (Version: 306.97 - NVIDIA Corporation)
NVIDIA Grafiktreiber 306.97 (Version: 306.97 - NVIDIA Corporation)
NVIDIA HD Audio Driver 1.3.18.0 (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.85.551 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.10.8 (Version: 1.10.8 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.0613 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.12.0613 (Version: 9.12.0613 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.0697 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 306.97 (Version: 306.97 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4551.1512 - Microsoft Corporation) Hidden
Opera 12.16 (x32 Version: 12.16.1860 - Opera Software ASA)
Plus-HD-1.6 (x32 Version: 1.28.153.1 - Plus HD) <==== ATTENTION
QuickTime (x32 Version: 7.73.80.64 - Apple Inc.)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6710 - Realtek Semiconductor Corp.)
Search-Results Toolbar (x32 Version: 1.2.0.0 - APN LLC) <==== ATTENTION
Shared C Run-time for x64 (Version: 10.0.0 - McAfee)
Uplay (x32 Version: 2.0 - Ubisoft)
Vectorworks 2014 Hilfe (x32 Version: 1.0 - UNKNOWN)
Vectorworks 2014 Hilfe (x32 Version: 1.0 - UNKNOWN) Hidden
Windows-Treiberpaket - ASUS (ATP) Mouse (10/29/2012 1.0.0.148) (Version: 10/29/2012 1.0.0.148 - ASUS)
WinFlash (x32 Version: 2.41.1 - ASUS)
==================== Restore Points =========================
15-01-2014 15:44:45 Intel® PROSet/Wireless Software
19-01-2014 19:28:39 Windows Update
27-01-2014 12:59:30 Geplanter Prüfpunkt
==================== Hosts content: ==========================
2012-07-26 06:26 - 2012-07-26 06:26 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {012B7602-18C5-4F0F-BE08-487B87C13D5E} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2012-07-25] (ASUSTeK Computer Inc.)
Task: {0C229760-9D45-46BD-9388-8B69F5E3F547} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [2013-10-31] (Microsoft Corporation)
Task: {199898F6-1015-4C1B-A07D-06B5EA9B94AF} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-01-15] (Microsoft Corporation)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {331D377C-434B-4C8E-A17A-345274B0B3E6} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2012-08-24] (ASUS)
Task: {3DD517C7-8980-4CB9-A475-92D57D779E88} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-07-24] (ASUSTek Computer Inc.)
Task: {44B3F1B8-5943-4072-8D8C-A9484676AC44} - \Microsoft\Windows\Live\Roaming\SynchronizeWithStorage No Task File
Task: {49FC7463-2AC3-4FFE-B2F5-F62F0C733354} - System32\Tasks\Plus-HD-1.6-firefoxinstaller => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe [2013-09-24] (Plus HD) <==== ATTENTION
Task: {4D9B6102-C913-45B2-9C72-6797EFE8F6FC} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Laptop-***** Laptop => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-01-15] (Microsoft Corporation)
Task: {4E49F99F-04B0-4424-91CD-2F484095DB37} - System32\Tasks\ASUS Touchpad Launcher (x64) => C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLauncher.exe [2012-10-31] (AsusTek)
Task: {64C9990C-9328-4FF0-ACFD-60ECE759E517} - System32\Tasks\Plus-HD-1.6-enabler => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-enabler.exe [2013-12-26] (Plus HD) <==== ATTENTION
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {A800277E-E202-4492-AD38-3312641CBC04} - \Microsoft\Windows\Live\Roaming\MaintenanceTask No Task File
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {D0F64C83-248B-469C-9D0B-179E45DE50DD} - System32\Tasks\Test TimeTrigger => C:\Users\*****\AppData\Local\Temp\Runner.exe [2012-11-02] () <==== ATTENTION
Task: {DA561495-AB29-46D0-9143-A4D56BEB87E0} - System32\Tasks\UpdaterEX => C:\Users\*****\AppData\Roaming\UpdaterEX\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {E24987FC-E0CF-4A92-BE11-02AC02A5AEE0} - System32\Tasks\ASUS InstantOn Config => C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnCfg.exe [2012-08-06] (ASUS)
Task: {E2583EED-7ED9-4A28-8F95-8BE6A7F512DC} - System32\Tasks\Plus-HD-1.6-updater => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-updater.exe [2013-09-24] (Plus HD) <==== ATTENTION
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {F605ADB3-B5CD-49F1-890D-D0390E11DDE2} - System32\Tasks\Plus-HD-1.6-codedownloader => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe [2013-09-24] (Plus HD) <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.6-enabler.job => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-1.6-updater.job => C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\*****\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
==================== Loaded Modules (whitelisted) =============
2012-09-24 22:19 - 2012-07-31 17:02 - 00004096 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2012-08-24 17:26 - 2012-08-24 17:26 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll
2012-08-31 02:33 - 2012-08-15 18:52 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll
2012-08-24 17:17 - 2012-08-24 17:17 - 00009216 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
2012-09-24 22:19 - 2012-07-31 17:02 - 00004096 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2013-11-13 07:22 - 2013-11-13 07:22 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll
2014-01-15 00:43 - 2014-01-15 00:43 - 00359592 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\c2r32.dll
2012-09-24 22:16 - 2012-06-25 10:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: USB-IF xHCI USB Host Controller
Description: USB-IF xHCI USB Host Controller
Class Guid: {8a2edc79-c759-46f2-88af-9d4efe3b5eee}
Manufacturer: Intel Corporation
Service: XHCIPort
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver
==================== Event log errors: =========================
Application errors:
==================
Error: (02/04/2014 05:59:26 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: consent.exe, Version: 6.2.9200.16550, Zeitstempel: 0x5136a1c9
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000095799
ID des fehlerhaften Prozesses: 0xcf4
Startzeit der fehlerhaften Anwendung: 0xconsent.exe0
Pfad der fehlerhaften Anwendung: consent.exe1
Pfad des fehlerhaften Moduls: consent.exe2
Berichtskennung: consent.exe3
Vollständiger Name des fehlerhaften Pakets: consent.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: consent.exe5
Error: (02/04/2014 05:50:42 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsusTPLoader.exe, Version: 1.0.13.0, Zeitstempel: 0x5087952f
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005af85
ID des fehlerhaften Prozesses: 0xf44
Startzeit der fehlerhaften Anwendung: 0xAsusTPLoader.exe0
Pfad der fehlerhaften Anwendung: AsusTPLoader.exe1
Pfad des fehlerhaften Moduls: AsusTPLoader.exe2
Berichtskennung: AsusTPLoader.exe3
Vollständiger Name des fehlerhaften Pakets: AsusTPLoader.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AsusTPLoader.exe5
Error: (02/04/2014 04:30:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: MpCmdRun.exe, Version: 4.3.215.0, Zeitstempel: 0x51c3c73f
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000056b2a
ID des fehlerhaften Prozesses: 0x16ec
Startzeit der fehlerhaften Anwendung: 0xMpCmdRun.exe0
Pfad der fehlerhaften Anwendung: MpCmdRun.exe1
Pfad des fehlerhaften Moduls: MpCmdRun.exe2
Berichtskennung: MpCmdRun.exe3
Vollständiger Name des fehlerhaften Pakets: MpCmdRun.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: MpCmdRun.exe5
Error: (02/04/2014 00:53:34 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error: (02/04/2014 00:53:34 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/04/2014 00:53:34 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error: (02/03/2014 11:58:28 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: AsusTPCfg64.exe, Version: 1.0.69.1, Zeitstempel: 0x4ffcd70c
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005af85
ID des fehlerhaften Prozesses: 0x10d0
Startzeit der fehlerhaften Anwendung: 0xAsusTPCfg64.exe0
Pfad der fehlerhaften Anwendung: AsusTPCfg64.exe1
Pfad des fehlerhaften Moduls: AsusTPCfg64.exe2
Berichtskennung: AsusTPCfg64.exe3
Vollständiger Name des fehlerhaften Pakets: AsusTPCfg64.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: AsusTPCfg64.exe5
Error: (02/03/2014 11:58:27 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: taskhostex.exe, Version: 6.2.9200.16547, Zeitstempel: 0x51301b12
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000005af85
ID des fehlerhaften Prozesses: 0x848
Startzeit der fehlerhaften Anwendung: 0xtaskhostex.exe0
Pfad der fehlerhaften Anwendung: taskhostex.exe1
Pfad des fehlerhaften Moduls: taskhostex.exe2
Berichtskennung: taskhostex.exe3
Vollständiger Name des fehlerhaften Pakets: taskhostex.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: taskhostex.exe5
Error: (02/03/2014 01:06:32 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: conhost.exe, Version: 6.2.9200.16579, Zeitstempel: 0x516363f3
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000006daa4
ID des fehlerhaften Prozesses: 0x142c
Startzeit der fehlerhaften Anwendung: 0xconhost.exe0
Pfad der fehlerhaften Anwendung: conhost.exe1
Pfad des fehlerhaften Moduls: conhost.exe2
Berichtskennung: conhost.exe3
Vollständiger Name des fehlerhaften Pakets: conhost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: conhost.exe5
Error: (02/03/2014 11:18:46 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: conhost.exe, Version: 6.2.9200.16579, Zeitstempel: 0x516363f3
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.2.9200.16579, Zeitstempel: 0x51637f77
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000006daa4
ID des fehlerhaften Prozesses: 0x548
Startzeit der fehlerhaften Anwendung: 0xconhost.exe0
Pfad der fehlerhaften Anwendung: conhost.exe1
Pfad des fehlerhaften Moduls: conhost.exe2
Berichtskennung: conhost.exe3
Vollständiger Name des fehlerhaften Pakets: conhost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: conhost.exe5
System errors:
=============
Error: (02/04/2014 05:50:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde mit folgendem Fehler beendet:
%%2147770990
Error: (02/04/2014 05:50:20 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Search Protect by Conduit Updater" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (02/04/2014 05:50:06 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 04.02.2014 um 17:26:00 unerwartet heruntergefahren.
Error: (02/04/2014 05:45:18 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}TrustedInstaller
Error: (02/04/2014 05:41:18 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}TrustedInstaller
Error: (02/04/2014 05:37:17 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}TrustedInstaller
Error: (02/04/2014 05:33:16 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}TrustedInstaller
Error: (02/04/2014 05:29:15 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}TrustedInstaller
Error: (02/04/2014 05:25:13 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}TrustedInstaller
Error: (02/04/2014 05:21:13 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}TrustedInstaller
Microsoft Office Sessions:
=========================
Error: (02/04/2014 05:59:26 PM) (Source: Application Error)(User: )
Description: consent.exe6.2.9200.165505136a1c9ntdll.dll6.2.9200.1657951637f77c00000050000000000095799cf401cf21ca759ac071C:\Windows\system32\consent.exeC:\Windows\SYSTEM32\ntdll.dllb39abf91-8dbd-11e3-bf20-685d43ad1fdc
Error: (02/04/2014 05:50:42 PM) (Source: Application Error)(User: )
Description: AsusTPLoader.exe1.0.13.05087952fntdll.dll6.2.9200.1657951637f77c0000005000000000005af85f4401cf21c93d63ae54C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exeC:\Windows\SYSTEM32\ntdll.dll7b2a745b-8dbc-11e3-bf20-685d43ad1fdc
Error: (02/04/2014 04:30:10 PM) (Source: Application Error)(User: )
Description: MpCmdRun.exe4.3.215.051c3c73fntdll.dll6.2.9200.1657951637f77c00000050000000000056b2a16ec01cf21bdc0ca7617C:\Program Files\Windows Defender\MpCmdRun.exeC:\Windows\SYSTEM32\ntdll.dll3b64e31d-8db1-11e3-bf1f-685d43ad1fdc
Error: (02/04/2014 00:53:34 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F2030000E5050000
Error: (02/04/2014 00:53:34 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
Error: (02/04/2014 00:53:34 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance163707000000000000000000008F020000
Error: (02/03/2014 11:58:28 PM) (Source: Application Error)(User: )
Description: AsusTPCfg64.exe1.0.69.14ffcd70cntdll.dll6.2.9200.1657951637f77c0000005000000000005af8510d001cf21336da85aa9C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsusTPCfg64.exeC:\Windows\SYSTEM32\ntdll.dllb14f9f7c-8d26-11e3-bf1f-685d43ad1fdc
Error: (02/03/2014 11:58:27 PM) (Source: Application Error)(User: )
Description: taskhostex.exe6.2.9200.1654751301b12ntdll.dll6.2.9200.1657951637f77c0000005000000000005af8584801cf21336d148713C:\Windows\system32\taskhostex.exeC:\Windows\SYSTEM32\ntdll.dllb0e1f1f3-8d26-11e3-bf1f-685d43ad1fdc
Error: (02/03/2014 01:06:32 PM) (Source: Application Error)(User: )
Description: conhost.exe6.2.9200.16579516363f3ntdll.dll6.2.9200.1657951637f77c0000005000000000006daa4142c01cf20d8594cfb00C:\Windows\system32\conhost.exeC:\Windows\SYSTEM32\ntdll.dll9e505b2d-8ccb-11e3-bf1f-685d43ad1fdc
Error: (02/03/2014 11:18:46 AM) (Source: Application Error)(User: )
Description: conhost.exe6.2.9200.16579516363f3ntdll.dll6.2.9200.1657951637f77c0000005000000000006daa454801cf20c94c7fd01eC:\Windows\system32\conhost.exeC:\Windows\SYSTEM32\ntdll.dll903f3a10-8cbc-11e3-bf1f-685d43ad1fdc
==================== Memory info ===========================
Percentage of memory in use: 19%
Total physical RAM: 8077.58 MB
Available physical RAM: 6475.35 MB
Total Pagefile: 16269.58 MB
Available Pagefile: 14597.58 MB
Total Virtual: 8192 MB
Available Virtual: 8191.75 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:279.11 GB) (Free:118.17 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:398.18 GB) (Free:398.03 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 4B834568)
Partition: GPT Partition Type
==================== End Of Log ============================
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014
Ran by ***** (administrator) on LAPTOP on 04-02-2014 17:59:45
Running from C:\Users\*****\Downloads\1
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
() C:\Users\*****\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Bandoo Media Inc) C:\Program Files (x86)\Search Results Toolbar\Datamngr\datamngrUI.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13192848 2012-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1215632 2012-08-17] (Realtek Semiconductor)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [11554688 2012-08-08] (Motorola Solutions, Inc.)
HKLM\...\Run: [ACMON] - C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [107192 2012-08-24] (ASUS)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
HKLM-x32\...\Run: [ASUS InstantKey] - C:\Program Files (x86)\ASUS\ASUS Instant Key\Ikey_start.exe [20456 2012-02-20] (ASUS)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdatePSTShortCut] - C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe [222504 2012-07-03] (CyberLink Corp.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.9.120\AsusWSPanel.exe [3417984 2012-08-28] (ASUS Cloud Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-10-11] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [DATAMNGR] - C:\Program Files (x86)\Search Results Toolbar\Datamngr\datamngrUI.exe [1683456 2013-02-14] (Bandoo Media Inc)
HKLM-x32\...\Run: [SearchProtectAll] - C:\Program Files (x86)\SearchProtect\bin\cltmng.exe
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [SearchProtect] - \SearchProtect\bin\cltmng.exe
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\Run: [SearchProtect] - C:\Users\*****\AppData\Roaming\SearchProtect\bin\cltmng.exe
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\Run: [FLV Player] - C:\Users\*****\AppData\Local\WebPlayer\FLV Player\WebPlayer.exe [202752 2012-10-26] ()
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: F - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {69dbf0c6-ffa9-11e2-bebd-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {69dbf0fd-ffa9-11e2-bebd-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {9da3b62c-ebce-11e2-beab-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {9e485176-ed18-11e2-beaf-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {9e4851b3-ed18-11e2-beaf-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {a92a9f30-0979-11e3-bebe-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {a92a9f6a-0979-11e3-bebe-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {c879efbb-d459-11e2-be9b-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {c879f005-d459-11e2-be9b-685d43ad1fdc} - "F:\AutoRun.exe"
HKU\S-1-5-21-2535559688-3033760251-4133012995-1002\...\MountPoints2: {cf7342ea-ec7c-11e2-beac-685d43ad1fdc} - "F:\AutoRun.exe"
AppInit_DLLs: C:\PROGRA~3\Wincert\WIN64C~1.DLL => C:\ProgramData\Wincert\win64cert.dll [8704 2013-02-07] ()
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\datamngr.dll => C:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\datamngr.dll [2018680 2013-02-14] (Bandoo Media Inc)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\Datamngr\x64\IEBHO.dll => C:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\IEBHO.dll [1531256 2013-02-14] (Bandoo Media Inc)
AppInit_DLLs: C:\PROGRA~2\NVIDIA~1\3DVISI~1\NVSTIN~1.DLL,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [247144 2012-10-08] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=DE&userid=ee990984-7337-4a5e-a456-1fc492481553&searchtype=ds&q={searchTerms}&installDate=18/07/2013
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=3A39685D43AD1FD9&affID=125288&tsp=5034
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=DE&userid=ee990984-7337-4a5e-a456-1fc492481553&searchtype=ds&q={searchTerms}&installDate=18/07/2013
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.delta-search.com/?babsrc=HP_ss&mntrId=3A39685D43AD1FD9&affID=125288&tsp=5034
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=hp&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610
URLSearchHook: HKLM-x32 - (No Name) - {8686b6b5-4734-4d4a-a246-5efbd9ebb200} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=sc&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610&type=default&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610&type=default&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=394&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=4205180611234571&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=394&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=4205180611234571&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=3A39685D43AD1FD9&affID=125288&tsp=5034
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoGOblidooYB&dpid=SnapdoGOblidooYB&co=DE&userid=ee990984-7337-4a5e-a456-1fc492481553&searchtype=ds&q={searchTerms}&installDate=18/07/2013
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=3A39685D43AD1FD9&affID=125288&tsp=5034
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=cor&utm_campaign=eXQ&utm_content=ds&from=cor&uid=ST750LM022XHN-M750MBB_S2UQJ9FC803439&ts=1381009610&type=default&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=394&systemid=406&apn_dtid=BND406&apn_ptnrs=AG6&o=APN10645&apn_uid=4205180611234571&q={searchTerms}
BHO: Plus-HD-1.6 - {11111111-1111-1111-1111-110311201102} - C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-bho64.dll (Plus HD)
BHO: Snap.DoEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: DataMngr - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\x64\BrowserConnection.dll (Bandoo Media Inc)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Plus-HD-1.6 - {11111111-1111-1111-1111-110311201102} - C:\Program Files (x86)\Plus-HD-1.6\Plus-HD-1.6-bho.dll (Plus HD)
BHO-x32: Snap.DoEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
BHO-x32: No Name - {8686b6b5-4734-4d4a-a246-5efbd9ebb200} - No File
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: DataMngr - {C1ED9DA0-AFD0-4b90-AC6A-D3874F591014} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media Inc)
BHO-x32: smartdownloader Class - {F1AF26F8-1828-4279-ABCE-074EF3235BD7} - C:\Program Files (x86)\PutLockerDownloader\smarterdownloader.dll (TODO: <Company name>)
Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Search-Results Toolbar - {377e5d4d-77e5-476a-8716-7e70a9272da0} - C:\Program Files (x86)\Search Results Toolbar\Datamngr\SRTOOL~1\searchresultsDx.dll (APN LLC)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {8686B6B5-4734-4D4A-A246-5EFBD9EBB200} - No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: No Name - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\profiles\extensions\extensions [2013-10-13]
FF Extension: Movie2kDownloader - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\profiles\extensions\movie2kdownloader@movie2kdownloader.com.xpi [2012-12-13]
FF Extension: PutLockerDownloader 2 - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\profiles\extensions\putlockerdownloader2@putlockerdownloader.com.xpi [2013-02-11]
FF Extension: PutLockerDownloader - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\profiles\extensions\putlockerdownloader@putlockerdownloader.com.xpi [2012-11-06]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF HKCU\...\Firefox\Extensions: [{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}] - C:\Program Files (x86)\Wajam\Firefox\{5a95a9e0-59dd-4314-bd84-4d18ca83a0e2}.xpi
FF HKCU\...\Firefox\Extensions: [Lyrics@LyricsContainer.co] - C:\Program Files (x86)\LyricsContainer\128.xpi
==================== Services (Whitelisted) =================
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [272176 2012-07-18] ()
R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-10-31] (Microsoft Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-04-17] ()
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
S2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2699568 2012-07-18] (Intel® Corporation)
S2 CltMngSvc; C:\Program Files (x86)\SearchProtect\bin\CltMngSvc.exe [X]
==================== Drivers (Whitelisted) ====================
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-03-10] ()
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-02] ( )
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-03-10] ()
R3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew00.sys [3345376 2013-10-08] (Intel Corporation)
R1 nvkflt; C:\Windows\system32\DRIVERS\nvkflt.sys [284008 2012-10-08] (NVIDIA Corporation)
S3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [48096 2012-08-09] (Windows (R) Win 7 DDK provider)
S3 XHCIPort; C:\Windows\System32\drivers\XHCIPort.sys [188384 2012-08-09] (Windows (R) Win 7 DDK provider)
S3 ewusbnet; \SystemRoot\system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; \SystemRoot\system32\DRIVERS\ew_hwusbdev.sys [X]
S1 hseewpra; \??\C:\Windows\system32\drivers\hseewpra.sys [X]
S3 huawei_enumerator; \SystemRoot\System32\drivers\ew_jubusenum.sys [X]
S3 hwdatacard; \SystemRoot\system32\DRIVERS\ewusbmdm.sys [X]
S3 L1C; \SystemRoot\system32\DRIVERS\L1C63x64.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 massfilter_hs; system32\drivers\massfilter_hs.sys [X]
S0 msahci;
S1 wziujphd; \??\C:\Windows\system32\drivers\wziujphd.sys [X]
S3 ZTEusbmdm6k; \SystemRoot\system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; \SystemRoot\system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; \SystemRoot\system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-04 17:59 - 2014-02-04 17:59 - 00000000 ____D () C:\FRST
2014-02-04 17:58 - 2014-02-04 17:58 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-02-04 17:41 - 2014-02-04 18:00 - 00000000 ____D () C:\Users\*****\Downloads\1
2014-02-01 10:27 - 2014-02-01 10:27 - 00289872 _____ () C:\Windows\Minidump\020114-27609-01.dmp
2014-01-27 21:53 - 2014-01-27 21:58 - 00000000 ____D () C:\Users\*****\Documents\Stunden J u C
2014-01-19 19:04 - 2013-12-07 07:37 - 00688640 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-01-19 19:04 - 2013-12-07 07:37 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-19 19:04 - 2013-12-07 06:15 - 00562688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-01-19 19:04 - 2013-12-07 06:15 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-01-19 19:04 - 2013-10-31 06:56 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\MPSSVC.dll
2014-01-19 19:04 - 2013-10-31 06:56 - 00758784 _____ (Microsoft Corporation) C:\Windows\system32\FirewallAPI.dll
2014-01-19 19:04 - 2013-10-31 05:01 - 00550400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FirewallAPI.dll
2014-01-19 19:04 - 2013-10-31 04:42 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mpsdrv.sys
2014-01-19 19:04 - 2013-10-28 06:50 - 00588288 _____ (Microsoft Corporation) C:\Windows\system32\SHCore.dll
2014-01-19 19:04 - 2013-10-28 05:05 - 00452608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SHCore.dll
2014-01-19 19:04 - 2013-10-13 21:49 - 00100696 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\disk.sys
2014-01-19 19:04 - 2013-08-27 06:21 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2014-01-19 19:04 - 2013-08-27 06:19 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2014-01-19 19:04 - 2013-08-26 23:29 - 00199168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2014-01-19 19:04 - 2013-08-26 23:28 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2014-01-17 16:38 - 2014-01-17 16:43 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-15 16:24 - 2014-01-15 16:24 - 02135150 _____ () C:\Users\*****\Desktop\projekt_2_klassen.show.gz
2014-01-14 20:21 - 2014-01-14 20:21 - 00000287 _____ () C:\Users\*****\AppData\Local\VersionChecker_19.xml
2014-01-13 19:18 - 2014-01-15 18:09 - 00000000 ____D () C:\Users\*****\Documents\Theaterprojekt
2014-01-11 16:42 - 2014-01-11 16:42 - 00007686 _____ () C:\Users\*****\Documents\Teilzahlungsgeschäfte.odt
2014-01-11 16:40 - 2014-01-11 16:41 - 00008320 _____ () C:\Users\*****\Documents\verbraucherberatung.odt
2014-01-08 21:32 - 2014-01-08 21:32 - 00001102 _____ () C:\Users\*****\Desktop\Vectorworks2014E.lnk
2014-01-08 21:26 - 2014-01-08 21:26 - 00000000 ____D () C:\Program Files (x86)\Vectorworks 2014 Hilfe
2014-01-08 21:12 - 2014-01-15 16:45 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-08 20:53 - 2014-01-14 20:22 - 00000000 ____D () C:\Program Files (x86)\Vectorworks2014
==================== One Month Modified Files and Folders =======
2014-02-04 18:00 - 2014-02-04 17:41 - 00000000 ____D () C:\Users\*****\Downloads\1
2014-02-04 18:00 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\sru
2014-02-04 17:59 - 2014-02-04 17:59 - 00000000 ____D () C:\FRST
2014-02-04 17:58 - 2014-02-04 17:58 - 00000000 _____ () C:\Users\*****\defogger_reenable
2014-02-04 17:58 - 2013-03-08 02:25 - 00000000 ____D () C:\Users\*****
2014-02-04 17:56 - 2013-03-08 02:33 - 00003598 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2535559688-3033760251-4133012995-1002
2014-02-04 17:52 - 2014-01-04 14:40 - 00005128 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Laptop-***** Laptop
2014-02-04 17:51 - 2013-03-08 02:28 - 00000408 _____ () C:\Users\*****\AppData\Roaming\sp_data.sys
2014-02-04 17:50 - 2013-09-24 14:46 - 00001840 _____ () C:\Windows\Tasks\Plus-HD-1.6-firefoxinstaller.job
2014-02-04 17:50 - 2013-09-24 14:46 - 00001304 _____ () C:\Windows\Tasks\Plus-HD-1.6-updater.job
2014-02-04 17:50 - 2013-09-24 14:46 - 00001208 _____ () C:\Windows\Tasks\Plus-HD-1.6-codedownloader.job
2014-02-04 17:50 - 2013-09-24 14:46 - 00001108 _____ () C:\Windows\Tasks\Plus-HD-1.6-enabler.job
2014-02-04 17:50 - 2012-09-24 22:20 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-02-04 17:50 - 2012-07-26 08:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-04 17:49 - 2013-10-05 22:47 - 00000306 _____ () C:\Windows\Tasks\UpdaterEX.job
2014-02-04 17:49 - 2013-03-08 02:24 - 01848034 _____ () C:\Windows\WindowsUpdate.log
2014-02-04 00:53 - 2012-08-03 00:02 - 01082642 _____ () C:\Windows\system32\perfh007.dat
2014-02-04 00:53 - 2012-08-03 00:02 - 00253074 _____ () C:\Windows\system32\perfc007.dat
2014-02-04 00:53 - 2012-07-26 08:28 - 00005430 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-04 00:53 - 2012-07-26 08:21 - 00575856 _____ () C:\Windows\setupact.log
2014-02-01 10:27 - 2014-02-01 10:27 - 00289872 _____ () C:\Windows\Minidump\020114-27609-01.dmp
2014-02-01 10:27 - 2013-03-27 12:53 - 458059785 _____ () C:\Windows\MEMORY.DMP
2014-01-27 21:58 - 2014-01-27 21:53 - 00000000 ____D () C:\Users\*****\Documents\Stunden J u C
2014-01-26 08:49 - 2013-12-18 17:49 - 00000125 _____ () C:\Users\*****\AppData\Roaming\WB.CFG
2014-01-21 13:22 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\rescache
2014-01-20 07:54 - 2012-07-26 06:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-01-20 07:53 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\WinStore
2014-01-19 20:39 - 2013-09-07 12:06 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-19 20:38 - 2013-03-10 16:18 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-19 08:33 - 2013-03-19 17:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-18 19:51 - 2012-08-02 14:24 - 00057336 _____ () C:\Windows\PFRO.log
2014-01-17 16:43 - 2014-01-17 16:38 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-17 16:43 - 2013-10-05 22:46 - 00000000 ____D () C:\Users\*****\AppData\Local\Google
2014-01-17 16:39 - 2013-03-08 19:06 - 00000000 ____D () C:\Users\*****\AppData\Local\Adobe
2014-01-15 20:55 - 2012-09-24 22:16 - 00000000 ____D () C:\Intel
2014-01-15 18:09 - 2014-01-13 19:18 - 00000000 ____D () C:\Users\*****\Documents\Theaterprojekt
2014-01-15 16:45 - 2014-01-08 21:12 - 00000000 ____D () C:\ProgramData\Package Cache
2014-01-15 16:24 - 2014-01-15 16:24 - 02135150 _____ () C:\Users\*****\Desktop\projekt_2_klassen.show.gz
2014-01-15 16:19 - 2013-03-09 01:50 - 00000000 ____D () C:\Users\*****\AppData\Roaming\MAXON
2014-01-15 07:17 - 2013-03-11 15:48 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-01-14 20:22 - 2014-01-08 20:53 - 00000000 ____D () C:\Program Files (x86)\Vectorworks2014
2014-01-14 20:21 - 2014-01-14 20:21 - 00000287 _____ () C:\Users\*****\AppData\Local\VersionChecker_19.xml
2014-01-14 16:44 - 2013-03-09 01:47 - 00000287 _____ () C:\Users\*****\AppData\Local\VersionChecker_18.xml
2014-01-11 16:42 - 2014-01-11 16:42 - 00007686 _____ () C:\Users\*****\Documents\Teilzahlungsgeschäfte.odt
2014-01-11 16:41 - 2014-01-11 16:40 - 00008320 _____ () C:\Users\*****\Documents\verbraucherberatung.odt
2014-01-09 09:02 - 2012-07-26 09:14 - 00694240 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-01-09 09:02 - 2012-07-26 09:14 - 00078296 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-08 21:32 - 2014-01-08 21:32 - 00001102 _____ () C:\Users\*****\Desktop\Vectorworks2014E.lnk
2014-01-08 21:26 - 2014-01-08 21:26 - 00000000 ____D () C:\Program Files (x86)\Vectorworks 2014 Hilfe
2014-01-08 10:45 - 2012-07-26 09:12 - 00000000 ____D () C:\Windows\system32\NDF
Files to move or delete:
====================
C:\ProgramData\SetStretch.exe
Some content of TEMP:
====================
C:\Users\*****\AppData\Local\Temp\bi_cleaner.exe
C:\Users\*****\AppData\Local\Temp\card_setup.exe
C:\Users\*****\AppData\Local\Temp\COMAP.EXE
C:\Users\*****\AppData\Local\Temp\DataCard_Setup64.exe
C:\Users\*****\AppData\Local\Temp\DeltaTB.exe
C:\Users\*****\AppData\Local\Temp\DNS.exe
C:\Users\*****\AppData\Local\Temp\FLVPlayerSetup.exe
C:\Users\*****\AppData\Local\Temp\FLVPlayerUpdate_downloader_by_FLVPlayerUpdate.exe
C:\Users\*****\AppData\Local\Temp\installhelper.dll
C:\Users\*****\AppData\Local\Temp\Notification.exe
C:\Users\*****\AppData\Local\Temp\nsbEBAC.exe
C:\Users\*****\AppData\Local\Temp\nse16AF.exe
C:\Users\*****\AppData\Local\Temp\nsp4BCF.exe
C:\Users\*****\AppData\Local\Temp\nsq4895.exe
C:\Users\*****\AppData\Local\Temp\nsu1846.exe
C:\Users\*****\AppData\Local\Temp\nsw4A8A.exe
C:\Users\*****\AppData\Local\Temp\nswD591.exe
C:\Users\*****\AppData\Local\Temp\nswD62E.exe
C:\Users\*****\AppData\Local\Temp\OfficeSetup.exe
C:\Users\*****\AppData\Local\Temp\OptimizerPro.exe
C:\Users\*****\AppData\Local\Temp\pricepeep_130001_0101.exe
C:\Users\*****\AppData\Local\Temp\ResetDevice.exe
C:\Users\*****\AppData\Local\Temp\Runner.exe
C:\Users\*****\AppData\Local\Temp\SecondStepInstaller.exe
C:\Users\*****\AppData\Local\Temp\Setup.X86.de-DE_HomeStudentRetail_4b52f185-682e-48d7-9f65-258fe117f709_TX_DB_.exe
C:\Users\*****\AppData\Local\Temp\SPStub.exe
C:\Users\*****\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\*****\AppData\Local\Temp\ubi5B95.tmp.exe
C:\Users\*****\AppData\Local\Temp\ubi8B58.tmp.exe
C:\Users\*****\AppData\Local\Temp\ubi8C39.tmp.exe
C:\Users\*****\AppData\Local\Temp\ubiB5B6.tmp.exe
C:\Users\*****\AppData\Local\Temp\uninst1.exe
C:\Users\*****\AppData\Local\Temp\UpdateCheckerSetup.exe
C:\Users\*****\AppData\Local\Temp\WajamC.exe
C:\Users\*****\AppData\Local\Temp\wajam_download.exe
C:\Users\*****\AppData\Local\Temp\wajam_install.exe
C:\Users\*****\AppData\Local\Temp\_is7031.exe
C:\Users\*****\AppData\Local\Temp\_is7C61.exe
C:\Users\*****\AppData\Local\Temp\_is983E.exe
C:\Users\*****\AppData\Local\Temp\_isCAB9.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-01-27 13:28
==================== End Of Log ============================
kle |
Baum-Darstellung