| |
| |||||||
Log-Analyse und Auswertung: Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel RamWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
03.03.2014, 18:44
| #1 |
 |  Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram Hallo, ich wollte mal meinen Laptop ein bisschen aufräumen und auch mal nach Viren oder Trojanern schauen. Mir ist aufgefallen das der Svchost.exe Prozess viel RAM verbraucht ca. 200.000K. Die svchost wird vom Dienst wlansvc gestartet(glaub ich). Den mbam log habe ich ohne defogger gemacht alles andere nach Anleitung. defogger_disable.log: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:13 on 03/03/2014 (Jonas)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-03-2014 Ran by Jonas (administrator) on JONAS-PC on 03-03-2014 18:13:47 Running from C:\Users\Jonas\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Locktime Software) C:\Program Files\NetLimiter 3\nlsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Atheros) C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Locktime Software) C:\Program Files\NetLimiter 3\NLClientApp.exe (Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Don HO don.h@free.fr) C:\Program Files (x86)\Notepad++\notepad++.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13513288 2013-03-29] (Realtek Semiconductor) HKLM\...\Run: [NvBackend] - C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] - C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation) HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [88984 2013-03-10] (Elaborate Bytes AG) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-509002210-509805973-1439757681-1000\...\Run: [NetLimiter] - C:\Program Files\NetLimiter 3\NLClientApp.exe [2915968 2013-10-10] (Locktime Software) HKU\S-1-5-21-509002210-509805973-1439757681-1000\...\MountPoints2: {137357d9-ea1f-11e2-9ec8-e86f201a21ea} - G:\setup.exe AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174296 2014-02-08] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [148528 2014-02-08] (NVIDIA Corporation) ==================== Internet (Whitelisted) ==================== ProxyServer: 74.208.123.225:3128 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x6109E71583CECE01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope value is missing. BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: No Name - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No File BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.178.1 FireFox: ======== FF ProfilePath: C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll () FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.0.6 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jonas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll () FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: DownloadHelper - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2013-11-25] FF Extension: NoScript - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2013-07-21] FF Extension: Adblock Plus - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-07-21] FF Extension: Greasemonkey - C:\Users\Jonas\AppData\Roaming\Mozilla\Firefox\Profiles\6nc1l8eu.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-01-08] Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR RestoreOnStartup: "hxxp://www.google.com/" CHR DefaultSearchKeyword: https://www.google.de/ CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\31.0.1650.57\pdf.dll () CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) CHR Plugin: (Java Deployment Toolkit 7.0.450.18) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) CHR Plugin: (Java(TM) Platform SE 7 U45) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) CHR Plugin: (Pando Web Plugin) - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) CHR Plugin: (Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (QUAKE LIVE) - C:\ProgramData\id Software\QuakeLive\npquakezero.dll No File CHR Plugin: (Unity Player) - C:\Users\Jonas\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll No File CHR Extension: (ProxTube) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-02-27] CHR Extension: (Google Drive) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-05-30] CHR Extension: (YouTube) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-05-30] CHR Extension: (Google-Suche) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-05-30] CHR Extension: (Give Up) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\diippoclinjdbklinhchgedilfncehbi [2013-07-22] CHR Extension: (AdBlock) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-10-30] CHR Extension: (ProxMate - Proxy on steroids!) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgjpnmnpjmabddgmjdiaggacbololbjm [2013-05-30] CHR Extension: (convert2mp3.net Online Video Converter) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\lmhoigapbeidamhadadmpbhpaodamjce [2014-02-12] CHR Extension: (Google Wallet) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-07] CHR Extension: (Google Mail) - C:\Users\Jonas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-05-30] ==================== Services (Whitelisted) ================= R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 nlsvc; C:\Program Files\NetLimiter 3\nlsvc.exe [1851008 2013-10-10] (Locktime Software) S4 nTuneService; C:\Program Files (x86)\NVIDIA Corporation\nTune\nTuneService.exe [278336 2011-09-19] (NVIDIA) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation) R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Qualcomm Atheros Fast Reconnect\Ath_WlanAgent.exe [57344 2011-08-10] (Atheros) ==================== Drivers (Whitelisted) ==================== R3 avmaura; C:\Windows\System32\DRIVERS\avmaura.sys [116480 2013-07-01] (AVM Berlin) R3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [66800 2013-01-17] (Logitech Inc.) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R1 nltdi; C:\Program Files\NetLimiter 3\nltdi.sys [87472 2013-06-12] (Locktime Software) R2 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.) R3 nvoclk64; C:\Windows\System32\DRIVERS\nvoclk64.sys [42088 2009-09-15] (NVIDIA Corp.) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) S3 SjtWinIo; C:\Windows\System32\DRIVERS\SjtWinIo.sys [9216 2013-06-13] (SpeedJet Technology INC.) S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.) S3 VBoxUSB; C:\Windows\System32\Drivers\VBoxUSB.sys [106256 2013-09-06] (Oracle Corporation) R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Downloads\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00000472 _____ () C:\Users\Jonas\Desktop\defogger_disable.log 2014-03-03 18:13 - 2014-03-03 18:13 - 00000000 _____ () C:\Users\Jonas\defogger_reenable 2014-03-03 18:10 - 2014-03-03 18:13 - 00015384 _____ () C:\Users\Jonas\Desktop\FRST.txt 2014-03-03 18:09 - 2014-03-03 18:13 - 00000000 ____D () C:\FRST 2014-03-03 16:09 - 2014-03-03 16:10 - 02156544 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe 2014-03-02 19:54 - 2014-03-02 19:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-02 19:54 - 2014-03-02 19:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-02 19:54 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\ProgramData\Sony Mobile 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\Program Files (x86)\Sony Mobile 2014-03-01 23:45 - 2014-03-01 23:45 - 00142620 _____ () C:\Windows\DPINST.LOG 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\Users\Jonas\Documents\Elder Scrolls Online 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online 2014-02-28 22:59 - 2014-02-28 23:01 - 00000000 ____D () C:\Program Files (x86)\Zenimax Online 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\ProgramData\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Program Files\NetLimiter 3 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\SysWOW64\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\system32\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-19 16:44 - 2014-02-08 19:34 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2014-02-19 16:44 - 2014-02-08 19:34 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 01075488 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-02-19 16:44 - 2014-02-08 18:42 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 00067072 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll 2014-02-19 16:44 - 2014-02-08 18:42 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-02-19 16:44 - 2014-02-05 18:52 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin 2014-02-19 16:39 - 2014-02-08 19:34 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-02-19 16:39 - 2014-02-08 19:34 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2014-02-19 16:39 - 2014-02-08 19:34 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys 2014-02-19 16:39 - 2014-02-08 19:34 - 00024544 _____ () C:\Windows\system32\nvinfo.pb 2014-02-16 12:23 - 2013-12-10 03:15 - 00982232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll 2014-02-16 12:23 - 2013-12-10 03:14 - 01100248 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll 2014-02-16 12:22 - 2014-02-16 13:46 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA 2014-02-16 12:18 - 2013-12-05 09:42 - 00039200 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2014-02-16 12:18 - 2013-12-05 09:42 - 00035104 _____ (NVIDIA Corporation) C:\Windows\system32\nvaudcap64v.dll 2014-02-16 12:18 - 2013-12-05 09:42 - 00032544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll 2014-02-16 12:02 - 2014-02-16 12:02 - 00000000 ____D () C:\Users\Jonas\Documents\Respawn 2014-02-15 23:55 - 2014-02-15 23:55 - 00017513 _____ () C:\Windows\DirectX.log 2014-02-14 22:10 - 2014-02-14 22:10 - 00000000 ____D () C:\Users\Jonas\Desktop\GCC_pre_C11 2014-02-14 21:17 - 2014-02-14 21:19 - 00000000 ____D () C:\Users\Jonas\.designer 2014-02-06 17:58 - 2013-01-13 22:17 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:17 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:16 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 22:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:35 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:35 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:35 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:32 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:31 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-02-06 17:58 - 2013-01-13 21:22 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-02-06 17:58 - 2013-01-13 21:20 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll 2014-02-06 17:58 - 2013-01-13 21:09 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll 2014-02-06 17:58 - 2013-01-13 21:08 - 01504768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll 2014-02-06 17:58 - 2013-01-13 21:08 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll 2014-02-06 17:58 - 2013-01-13 20:59 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2014-02-06 17:58 - 2013-01-13 20:58 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2014-02-06 17:58 - 2013-01-13 20:54 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll 2014-02-06 17:58 - 2013-01-13 20:53 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll 2014-02-06 17:58 - 2013-01-13 20:53 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll 2014-02-06 17:58 - 2013-01-13 20:51 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-02-06 17:58 - 2013-01-13 20:49 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll 2014-02-06 17:58 - 2013-01-13 20:48 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll 2014-02-06 17:58 - 2013-01-13 20:46 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll 2014-02-06 17:58 - 2013-01-13 20:43 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-02-06 17:58 - 2013-01-13 20:38 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll 2014-02-06 17:58 - 2013-01-13 20:38 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2014-02-06 17:58 - 2013-01-13 20:38 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2014-02-06 17:58 - 2013-01-13 20:37 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-02-06 17:58 - 2013-01-13 20:25 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll 2014-02-06 17:58 - 2013-01-13 20:24 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2014-02-06 17:58 - 2013-01-13 20:24 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll 2014-02-06 17:58 - 2013-01-13 20:20 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2014-02-06 17:58 - 2013-01-13 20:20 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2014-02-06 17:58 - 2013-01-13 20:15 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-02-06 17:58 - 2013-01-13 20:10 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-02-06 17:58 - 2013-01-13 20:02 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2014-02-06 17:58 - 2013-01-13 19:34 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll 2014-02-06 17:58 - 2013-01-13 19:32 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2014-02-06 17:58 - 2013-01-13 19:09 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll 2014-02-06 17:58 - 2013-01-13 18:26 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll 2014-02-06 17:58 - 2013-01-13 18:05 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll 2014-02-06 17:58 - 2013-01-04 07:11 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-02-06 17:58 - 2013-01-04 07:11 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-02-06 17:54 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2014-02-06 17:53 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2014-02-06 17:53 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2014-02-06 17:53 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-02-06 17:53 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-02-06 17:53 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-02-06 17:53 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-02-06 17:53 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-02-06 17:53 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-02-06 17:53 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-02-06 17:53 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-02-06 17:53 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-02-06 17:53 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-02-06 17:53 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-02-06 17:53 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-02-06 17:53 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-02-06 17:53 - 2013-08-02 03:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-02-06 17:53 - 2013-08-02 03:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2014-02-06 17:53 - 2013-08-02 03:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2014-02-06 17:53 - 2013-08-02 03:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2014-02-06 17:53 - 2013-08-02 03:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2014-02-06 17:53 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2014-02-06 17:53 - 2013-08-02 03:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2014-02-06 17:53 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-02-06 17:53 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-02-06 17:53 - 2013-08-02 02:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-02-06 17:53 - 2013-08-02 02:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2014-02-06 17:53 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2014-02-06 17:53 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-02-06 17:53 - 2013-08-02 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2014-02-06 17:53 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2014-02-06 17:53 - 2013-08-02 01:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2014-02-06 17:53 - 2013-08-02 01:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2014-02-06 17:53 - 2013-08-02 01:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2014-02-06 17:53 - 2013-08-02 01:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2014-02-06 17:53 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2014-02-06 17:53 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2014-02-06 17:53 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-02-06 17:53 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll 2014-02-06 17:53 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-02-06 17:53 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2014-02-06 17:53 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2014-02-06 17:53 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2014-02-06 17:53 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2014-02-06 17:53 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2014-02-06 17:53 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2014-02-06 17:53 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2014-02-06 17:53 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2014-02-06 17:53 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2014-02-06 17:53 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2014-02-06 17:53 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2014-02-06 17:53 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2014-02-06 17:53 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2014-02-06 17:53 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2014-02-06 17:53 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2014-02-06 17:53 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2014-02-06 17:53 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2014-02-06 17:53 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2014-02-06 17:53 - 2013-02-27 07:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-02-06 17:53 - 2013-02-27 06:48 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-02-06 17:53 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll 2014-02-06 17:53 - 2013-02-27 05:49 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-02-06 17:52 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-02-06 17:52 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-02-06 17:52 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-02-06 17:52 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-02-06 17:52 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-02-06 17:52 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2014-02-06 17:52 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2014-02-06 17:52 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2014-02-06 17:52 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2014-02-06 17:52 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-02-06 17:52 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-02-06 17:52 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-02-06 17:52 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2014-02-06 17:52 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2014-02-06 17:52 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2014-02-06 17:52 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2014-02-06 17:52 - 2013-07-12 11:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys 2014-02-06 17:52 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2014-02-06 17:52 - 2013-07-12 11:40 - 00109824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys 2014-02-06 17:52 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-02-06 17:52 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-02-06 17:52 - 2013-07-06 07:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-02-06 17:52 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2014-02-06 17:52 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2014-02-06 17:52 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2014-02-06 17:52 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2014-02-06 17:52 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2014-02-06 17:52 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2014-02-06 17:52 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-02-06 17:52 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-02-06 17:52 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll 2014-02-06 17:52 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe 2014-02-06 17:52 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe 2014-02-06 17:52 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll 2014-02-06 17:52 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-02-06 17:52 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2014-02-06 17:52 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe 2014-02-06 17:46 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2014-02-06 17:46 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2014-02-06 17:46 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2014-02-06 17:46 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2014-02-06 17:46 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2014-02-06 17:46 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2014-02-06 17:46 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2014-02-06 17:46 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2014-02-06 17:46 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-02-06 17:46 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2014-02-06 17:46 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-02-06 17:45 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2014-02-06 17:45 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2014-02-06 17:45 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2014-02-06 17:45 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2014-02-06 17:45 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2014-02-06 17:16 - 2014-02-06 17:16 - 00002762 _____ () C:\Windows\PFRO.log 2014-02-06 17:11 - 2014-02-19 16:44 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-02-06 16:48 - 2014-02-06 16:48 - 00000000 ____D () C:\Program Files\Intel 2014-02-05 19:17 - 2014-02-05 19:17 - 00004500 _____ () C:\Users\Jonas\AppData\Local\recently-used.xbel 2014-02-05 18:39 - 2014-02-05 18:39 - 00069120 ___SH () C:\Users\Jonas\Documents\Thumbs.db ==================== One Month Modified Files and Folders ======= 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Downloads\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00050477 _____ () C:\Users\Jonas\Desktop\Defogger.exe 2014-03-03 18:13 - 2014-03-03 18:13 - 00000472 _____ () C:\Users\Jonas\Desktop\defogger_disable.log 2014-03-03 18:13 - 2014-03-03 18:13 - 00000000 _____ () C:\Users\Jonas\defogger_reenable 2014-03-03 18:13 - 2014-03-03 18:10 - 00015384 _____ () C:\Users\Jonas\Desktop\FRST.txt 2014-03-03 18:13 - 2014-03-03 18:09 - 00000000 ____D () C:\FRST 2014-03-03 18:13 - 2013-05-30 19:38 - 00000000 ____D () C:\Users\Jonas 2014-03-03 16:31 - 2013-09-20 16:41 - 00000000 ____D () C:\Users\Jonas\Documents\Schule 2014-03-03 16:11 - 2013-07-17 20:34 - 00000000 ____D () C:\Program Files (x86)\Ubisoft 2014-03-03 16:10 - 2014-03-03 16:09 - 02156544 _____ (Farbar) C:\Users\Jonas\Desktop\FRST64.exe 2014-03-03 15:41 - 2013-06-10 11:43 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\QtProject 2014-03-03 15:23 - 2013-07-03 14:55 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\.minecraft 2014-03-03 14:34 - 2013-10-10 16:52 - 01724351 _____ () C:\Windows\WindowsUpdate.log 2014-03-03 14:17 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-03 14:17 - 2009-07-14 05:45 - 00019312 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-03 14:13 - 2014-01-31 14:21 - 00008712 _____ () C:\Windows\setupact.log 2014-03-03 14:09 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-02 20:58 - 2013-11-25 21:10 - 00000000 ____D () C:\Program Files (x86)\JDownloader 2014-03-02 20:56 - 2013-07-11 13:28 - 00000000 ____D () C:\Users\Jonas\AppData\Local\JDownloader v2.0 2014-03-02 19:54 - 2014-03-02 19:54 - 00001109 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2014-03-02 19:54 - 2014-03-02 19:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-02 17:45 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2014-03-02 16:28 - 2013-06-10 10:49 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\foobar2000 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\ProgramData\Sony Mobile 2014-03-01 23:48 - 2014-03-01 23:48 - 00000000 ____D () C:\Program Files (x86)\Sony Mobile 2014-03-01 23:45 - 2014-03-01 23:45 - 00142620 _____ () C:\Windows\DPINST.LOG 2014-03-01 23:45 - 2013-05-30 20:09 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2014-03-01 19:07 - 2013-05-30 19:56 - 00000000 ____D () C:\Users\Jonas\Desktop\Spiele 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\Users\Jonas\Documents\Elder Scrolls Online 2014-03-01 17:30 - 2014-03-01 17:30 - 00000000 ____D () C:\ProgramData\Elder Scrolls Online 2014-03-01 15:57 - 2013-06-19 18:11 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Skype 2014-02-28 23:01 - 2014-02-28 22:59 - 00000000 ____D () C:\Program Files (x86)\Zenimax Online 2014-02-28 22:49 - 2013-07-24 23:27 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\TS3Client 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\ProgramData\Locktime 2014-02-27 20:39 - 2014-02-27 20:39 - 00000000 ____D () C:\Program Files\NetLimiter 3 2014-02-27 20:39 - 2013-07-18 14:00 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin 2014-02-25 19:54 - 2013-05-31 14:53 - 00000000 ____D () C:\Program Files (x86)\Steam 2014-02-24 21:37 - 2013-11-22 18:42 - 00000000 ____D () C:\ProgramData\tmp 2014-02-23 17:48 - 2013-06-22 20:49 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Windows Live 2014-02-21 19:03 - 2013-12-09 22:16 - 00000000 ____D () C:\Program Files (x86)\Battle.net 2014-02-21 19:02 - 2013-12-09 22:16 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Battle.net 2014-02-21 19:02 - 2013-05-31 13:24 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\NVIDIA 2014-02-21 14:43 - 2013-05-30 19:56 - 00000000 ___RD () C:\Users\Jonas\Desktop\Alles 2014-02-19 22:17 - 2013-06-13 14:32 - 00000000 ____D () C:\ProgramData\Origin 2014-02-19 22:16 - 2013-06-13 14:32 - 00000000 ____D () C:\Program Files (x86)\Origin 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\SysWOW64\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\Windows\system32\NV 2014-02-19 20:42 - 2014-02-19 20:42 - 00000000 ____D () C:\ProgramData\NVIDIA 2014-02-19 16:44 - 2014-02-06 17:11 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation 2014-02-19 16:44 - 2013-08-13 17:01 - 00000000 ____D () C:\Program Files\NVIDIA Corporation 2014-02-19 16:44 - 2013-05-30 21:22 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2014-02-19 15:20 - 2013-05-30 20:18 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\ftblauncher 2014-02-16 16:37 - 2009-07-14 18:58 - 00702388 _____ () C:\Windows\system32\perfh007.dat 2014-02-16 16:37 - 2009-07-14 18:58 - 00151022 _____ () C:\Windows\system32\perfc007.dat 2014-02-16 16:37 - 2009-07-14 06:13 - 01628890 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-02-16 13:46 - 2014-02-16 12:22 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA 2014-02-16 12:27 - 2013-11-04 14:43 - 00000000 ____D () C:\Users\Jonas\AppData\Local\NVIDIA Corporation 2014-02-16 12:02 - 2014-02-16 12:02 - 00000000 ____D () C:\Users\Jonas\Documents\Respawn 2014-02-15 23:55 - 2014-02-15 23:55 - 00017513 _____ () C:\Windows\DirectX.log 2014-02-15 18:45 - 2013-06-13 14:34 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Origin 2014-02-15 17:30 - 2013-06-13 14:34 - 00000000 ____D () C:\Program Files (x86)\Origin Games 2014-02-15 14:48 - 2013-08-02 19:36 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-02-14 22:10 - 2014-02-14 22:10 - 00000000 ____D () C:\Users\Jonas\Desktop\GCC_pre_C11 2014-02-14 21:19 - 2014-02-14 21:17 - 00000000 ____D () C:\Users\Jonas\.designer 2014-02-14 21:08 - 2014-01-29 23:02 - 00000000 ____D () C:\Program Files (x86)\osu! 2014-02-14 14:41 - 2013-10-11 16:30 - 00000000 ____D () C:\ProgramData\VMware 2014-02-12 16:10 - 2013-08-01 16:38 - 00000000 ____D () C:\Users\Jonas\Documents\Bewerbungen 2014-02-09 01:16 - 2013-06-27 14:29 - 00000000 ____D () C:\Users\Jonas\AppData\Roaming\Notepad++ 2014-02-08 19:34 - 2014-02-19 16:44 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll 2014-02-08 19:34 - 2014-02-19 16:44 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 31432480 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 23683360 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 18257576 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 17715784 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 17560352 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 15740232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 14669032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvd3dum.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 12324640 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2014-02-08 19:34 - 2014-02-19 16:39 - 11636176 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 11589272 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 09728064 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 09690424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 03142432 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 03090184 _____ (NVIDIA Corporation) C:\Windows\system32\nvapi64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02956576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02782496 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02713728 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 02410784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 01885472 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433489.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433489.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00947296 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00892192 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00875296 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00863520 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00844576 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00832424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00353504 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00305600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00174296 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00148528 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2014-02-08 19:34 - 2014-02-19 16:39 - 00032544 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvpciflt.sys 2014-02-08 19:34 - 2014-02-19 16:39 - 00024544 _____ () C:\Windows\system32\nvinfo.pb 2014-02-08 18:42 - 2014-02-19 16:44 - 06712608 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 03498272 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 02559776 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 01075488 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshext.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 00923936 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe 2014-02-08 18:42 - 2014-02-19 16:44 - 00386336 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 00067072 _____ (NVIDIA Corporation) C:\Windows\system32\nv3dappshextr.dll 2014-02-08 18:42 - 2014-02-19 16:44 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll 2014-02-08 16:31 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-02-07 22:39 - 2014-01-11 16:38 - 00000000 ____D () C:\Projects 2014-02-06 20:29 - 2014-01-31 10:14 - 00000000 ____D () C:\Program Files (x86)\Dragon's Prophet 2014-02-06 19:47 - 2013-05-30 19:39 - 00000000 ___RD () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-02-06 19:47 - 2013-05-30 19:39 - 00000000 ___RD () C:\Users\Jonas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-02-06 19:45 - 2009-07-14 05:45 - 00415056 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-02-06 19:42 - 2009-07-14 19:18 - 00000000 ____D () C:\Program Files\Windows Journal 2014-02-06 19:42 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender 2014-02-06 19:42 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\zh-HK 2014-02-06 19:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\tr-TR 2014-02-06 18:19 - 2013-05-31 12:49 - 01603170 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-02-06 18:11 - 2013-05-30 20:01 - 00000000 ____D () C:\Program Files (x86)\Intel 2014-02-06 17:57 - 2013-10-21 19:25 - 00000000 ____D () C:\Windows\system32\MRT 2014-02-06 17:16 - 2014-02-06 17:16 - 00002762 _____ () C:\Windows\PFRO.log 2014-02-06 17:02 - 2013-07-22 11:09 - 00053248 _____ (Windows XP Bundled build C-Centric Single User) C:\Windows\SysWOW64\CSVer.dll 2014-02-06 16:48 - 2014-02-06 16:48 - 00000000 ____D () C:\Program Files\Intel 2014-02-06 16:29 - 2013-07-22 11:31 - 00000000 ____D () C:\Program Files (x86)\SystemRequirementsLab 2014-02-05 19:17 - 2014-02-05 19:17 - 00004500 _____ () C:\Users\Jonas\AppData\Local\recently-used.xbel 2014-02-05 19:17 - 2013-08-21 17:38 - 00000000 ____D () C:\Users\Jonas\AppData\Local\gtk-2.0 2014-02-05 19:17 - 2013-07-26 16:54 - 00000000 ____D () C:\Users\Jonas\.gimp-2.8 2014-02-05 18:52 - 2014-02-19 16:44 - 03573739 _____ () C:\Windows\system32\nvcoproc.bin 2014-02-05 18:39 - 2014-02-05 18:39 - 00069120 ___SH () C:\Users\Jonas\Documents\Thumbs.db 2014-02-05 17:29 - 2013-05-30 19:43 - 00000000 ____D () C:\Users\Jonas\AppData\Local\Google 2014-02-05 17:29 - 2013-05-30 19:43 - 00000000 ____D () C:\Program Files (x86)\Google 2014-02-01 14:49 - 2013-06-01 15:11 - 00000000 ____D () C:\Users\Jonas\Documents\Visual Studio 2012 Some content of TEMP: ==================== C:\Users\Jonas\AppData\Local\Temp\npp.6.5.2.Installer.exe C:\Users\Jonas\AppData\Local\Temp\NVI2_29.DLL C:\Users\Jonas\AppData\Local\Temp\xmlUpdater.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-01 01:20 ==================== End Of Log ============================ Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-03-03 18:34:28
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500325AS rev.0001SDM1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Jonas\AppData\Local\Temp\kgloypow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800031b2000 45 bytes [00, 00, 10, 02, 4E, 74, 66, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 591 fffff800031b202f 10 bytes [00, 01, 00, 06, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff7f7490 11 bytes JMP 000007fffe3a0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1456] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff80bf00 7 bytes JMP 000007fffe3a0260
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\d3d9.dll!Direct3DCreate9Ex 000007fef92f2460 5 bytes JMP 000007fefe3a02d0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2840] C:\Windows\system32\d3d9.dll!Direct3DCreate9 000007fef93296b0 6 bytes JMP 000007fefe3a0298
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef85cdc88 5 bytes JMP 000007fff85a00d8
.text C:\Windows\system32\Dwm.exe[2900] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef85cde10 5 bytes JMP 000007fff85a0110
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075561eee 7 bytes JMP 0000000172973550
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075565b85 7 bytes JMP 00000001729737f0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755713e1 7 bytes JMP 0000000172973650
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007557ea0d 7 bytes JMP 0000000172973540
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756088b4 7 bytes JMP 0000000172973310
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075608939 5 bytes JMP 00000001729733c0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075608c8f 5 bytes JMP 0000000172973320
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075671d1b 5 bytes JMP 00000001729732b0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075671dc9 5 bytes JMP 0000000172973270
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075672aa4 5 bytes JMP 00000001729733d0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075672d0a 5 bytes JMP 00000001729730b0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076d88a29 5 bytes JMP 0000000172972c60
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076d94572 5 bytes JMP 0000000172973030
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076dae567 5 bytes JMP 00000001729730a0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076de7a5c 5 bytes JMP 0000000172973020
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000075b2e96b 5 bytes JMP 0000000172972cd0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000075b2eba5 5 bytes JMP 0000000172972ce0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000077135ea5 5 bytes JMP 0000000172972c20
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000077169d0b 5 bytes JMP 0000000172972bb0
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075e81465 2 bytes [E8, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000075e814bb 2 bytes [E8, 75]
.text ... * 2
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff7f7490 11 bytes JMP 000007fffe3a0228
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[2372] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff80bf00 7 bytes JMP 000007fffe3a0260
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\ole32.dll!CoCreateInstance 000007feff7f7490 11 bytes JMP 000007fffe3a0228
.text C:\Windows\System32\igfxpers.exe[2204] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007feff80bf00 7 bytes JMP 000007fffe3a0260
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075561eee 7 bytes JMP 0000000172973550
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075565b85 7 bytes JMP 00000001729737f0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755713e1 7 bytes JMP 0000000172973650
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007557ea0d 7 bytes JMP 0000000172973540
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756088b4 7 bytes JMP 0000000172973310
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075608939 5 bytes JMP 00000001729733c0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075608c8f 5 bytes JMP 0000000172973320
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075671d1b 5 bytes JMP 00000001729732b0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075671dc9 5 bytes JMP 0000000172973270
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075672aa4 5 bytes JMP 00000001729733d0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075672d0a 5 bytes JMP 00000001729730b0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076d88a29 5 bytes JMP 0000000172972c60
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076d94572 5 bytes JMP 0000000172973030
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076dae567 5 bytes JMP 00000001729730a0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076de7a5c 5 bytes JMP 0000000172973020
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000075b2e96b 5 bytes JMP 0000000172972cd0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000075b2eba5 5 bytes JMP 0000000172972ce0
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000077135ea5 5 bytes JMP 0000000172972c20
.text C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe[1500] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000077169d0b 5 bytes JMP 0000000172972bb0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegSetValueExW 0000000077b1af40 7 bytes JMP 000000016fff0228
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegQueryValueExW 0000000077b24a60 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegDeleteValueW 0000000077b42990 5 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 0000000077b4efe0 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077b799b0 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 0000000077b894d0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegSetValueExA 0000000077baa500 3 bytes JMP 000000016fff01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\kernel32.dll!RegSetValueExA + 4 0000000077baa504 3 bytes [F8, CC, CC]
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefe3b2db0 5 bytes JMP 000007fffe3a0180
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefe3b37d0 7 bytes JMP 000007fffe3a00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefe3b8ef0 6 bytes JMP 000007fffe3a0148
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefe3caf60 5 bytes JMP 000007fffe3a0110
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feffed89e0 8 bytes JMP 000007fffe3a01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1764] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feffedbe40 8 bytes JMP 000007fffe3a01b8
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW 0000000075561eee 7 bytes JMP 0000000172973550
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegSetValueExW 0000000075565b85 7 bytes JMP 00000001729737f0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755713e1 7 bytes JMP 0000000172973650
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW 000000007557ea0d 7 bytes JMP 0000000172973540
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 00000000756088b4 7 bytes JMP 0000000172973310
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075608939 5 bytes JMP 00000001729733c0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 0000000075608c8f 5 bytes JMP 0000000172973320
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075671d1b 5 bytes JMP 00000001729732b0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075671dc9 5 bytes JMP 0000000172973270
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075672aa4 5 bytes JMP 00000001729733d0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075672d0a 5 bytes JMP 00000001729730b0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 0000000075b2e96b 5 bytes JMP 0000000172972cd0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 0000000075b2eba5 5 bytes JMP 0000000172972ce0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!CreateWindowExW 0000000076d88a29 5 bytes JMP 0000000172972c60
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000076d94572 5 bytes JMP 0000000172973030
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW 0000000076dae567 5 bytes JMP 00000001729730a0
.text C:\Users\Jonas\Desktop\Gmer-19357.exe[3272] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo 0000000076de7a5c 5 bytes JMP 0000000172973020
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015834b5420
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015834b5420@d05162c96a94 0xE0 0xB8 0xDF 0xC9 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015834b5420 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015834b5420@d05162c96a94 0xE0 0xB8 0xDF 0xC9 ...
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2014.03.03.05 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Jonas :: JONAS-PC [Administrator] 03.03.2014 17:11:40 MBAM-log-2014-03-03 (18-10-17).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 436623 Laufzeit: 56 Minute(n), 54 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 4 HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 2 C:\Users\Jonas\AppData\Roaming\Iminent\Mediator (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. Infizierte Dateien: 3 C:\Users\Jonas\AppData\Local\Temp\is-BKDPR.tmp\itdownload_stub.exe (PUP.Optional.Monetizer) -> Keine Aktion durchgeführt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas\globalcache.dat (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. C:\Users\Jonas\AppData\Roaming\Iminent\Mediator\Datas\user.dat (PUP.Optional.Iminent.A) -> Keine Aktion durchgeführt. (Ende) Mit freundlichen Grüßen Jonas |
| Themen zu Allgemeine Säuberung/ Svchost.exe ->Wlansvc brauch viel Ram |
| adobe, adware.agent, aufräumen, converter, helper, homepage, iexplore.exe, installation, prozess, pup.optional.iminent.a, pup.optional.monetizer, realtek, registry, rundll, scan, services.exe, software, svchost, svchost.exe, system, trojaner, viren, windows xp, wlansvc |
Baum-Darstellung