Windows 7: Rootkit durch Avast Internet Security blockiert und in Virus Container verschoben

Aprofon · 27.05.2014, 18:47

Hallo,

wie dem Titel schon zu entnehmen ist, habe ich mir gestern offenbar ein Rootkit eingefangen. Ich habe dummerweise einen Link unter einem Youtube Video angeglickt, was man ja eigentlich nicht tun sollte, wenn man sich nicht vollkommen sicher ist, aber gut.
Problematischerweise steckte hinter dem Link eine Datei welche sich im Downloadmanager (Firefox) zwecks Speicherung öffnete. Just in dem Moment schlug auch schon mein Virenscanner (Avast Internet Security - up to date) auf einen Rootkitfund an.
Ich habe daraufhin natürlich ohne zu zögern den "Ziel - speichern" Dialog abgebrochen. Avast hingegen hat die Datei sofort in Quarantäne verschoben aus der ich Sie daraufhin komplett gelöscht habe (in der Hoffnung, dass es damit erledigt wäre).
Zur Sicherheit habe ich, bei getrennter Internetverbindung, einen Startzeitscan mit höchstem Wirkungsgrad und Erkennung von PuP und Entpackung von Archiven durchgeführt, daraufhin einen Scan mit Malwarebytes Anti Malware und dann noch einmal eine Startzeitprüfung mit gleichen Einstellungen.
Malwarebytes erkannte nichts, avast hingegen fand beim 1.Mal einen Virus und verschob diesen in Quarantäne, fand beim zweiten mal jedoch nichts. Diesen habe ich, wie beim ersten Mal auch, anschließend aus der Quarantäne gelöscht.
Anschließend habe ich einen Scan mit GMER versucht, welcher aber an einem Blue Screen scheiterte und anschließend einen Scan mit Eset Online, welcher 7 infizierte Dateien lieferte, wobei ich auch nach PuP suchte. Hierbei habe ich aber nichts entfernt, sondern lediglich einen Logfile erstellt. Anschließend habe ich noch die Schritte in eurem FAQ für neue Themen abgearbeitet.

Ärgerlicherweise sind die Logfiles insgesamt zu umfangreich um sie hier zu posten, daher musste ich Sie in den Anhang packen. Hoffe es geht trotzdem.

Ich bedank mich schonmal an dieser Stelle für jegliche Hilfe.

cosinus · 27.05.2014, 20:08

Hi und

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Aprofon · 27.05.2014, 20:36

Gut mach ich, danke erstma für die schnelle Antwort.
Also hier die Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-05-2014 02
Ran by MF at 2014-05-27 17:56:19
Running from C:\Users\MF\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

 clear.fi SDK - MVP 2 (x32 Version: 2.0.1505 - CyberLink Corp.) Hidden
 clear.fi SDK- Movie 2 (x32 Version: 2.0.1502 - CyberLink Corp.) Hidden
«Eador. Masters of the Broken World» (HKLM-x32\...\{3180F11F-56C8-466c-8A82-599AE28EA34A}_is1) (Version:  - )
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{0B61BBD5-DA3C-409A-8730-0C3DC3B0F270}) (Version: 3.0.0.100 - NTI Corporation)
Acer Crystal Eye Webcam (HKLM-x32\...\InstallShield_{A0382E3C-7384-429A-9BFA-AF5888E5A193}) (Version: 1.5.2108.00 - CyberLink Corp.)
Acer Crystal Eye Webcam (x32 Version: 1.5.2108.00 - CyberLink Corp.) Hidden
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 6.00.3010 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 5.00.3508 - Acer Incorporated)
Acer Instant Update Service (HKLM\...\{682EC6E8-A300-45FD-8F09-0F3A6EA334D6}) (Version: 1.00.3004 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.04.3506 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0913.2011 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.02.3501 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.111 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.7.148 - Adobe Systems, Inc.)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version:  - Gameforge)
ALPS Touch Pad Driver (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.109.2020.209 - Alps Electric)
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.00.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
ArtMoney SE v7.40.2 (HKLM-x32\...\ArtMoney SE_is1) (Version: 7.40.2 - System SoftLab)
Assassin's Creed (HKLM-x32\...\{8CFA9151-6404-409A-AF22-4632D04582FD}) (Version: 1.02 - Ubisoft)
Assassin's Creed IV Black Flag Version 1.0 (HKLM-x32\...\Assassin's Creed IV Black Flag_is1) (Version: 1.0 - Ubisoft)
Assassin's Creed(R) III v1.04 (HKLM-x32\...\{9D15E813-0C26-41E7-ABC5-3EB06FF1B3CF}) (Version: 1.04 - Ubisoft)
Atheros Bluetooth Suite (64) (HKLM\...\{230D1595-57DA-4933-8C4E-375797EBB7E1}) (Version: 7.4.0.126 - Atheros)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.8.8 - Atheros Communications Inc.)
Audacity 2.0.5 (HKLM-x32\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
avast! Internet Security (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software)
Backup Manager V3 (x32 Version: 3.0.0.100 - NTI Corporation) Hidden
Benutzerhandbuch EPSON SX130 Series (HKLM-x32\...\EPSON SX130 Series Useg) (Version:  - )
BioShock (HKCU\...\{E280923D-C5D9-4728-8C79-AC9A0DC75875}) (Version: 2.62.0000 - 2K Games)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon MG5300 series Benutzerregistrierung (HKLM-x32\...\Canon MG5300 series Benutzerregistrierung) (Version:  - )
Canon MG5300 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5300_series) (Version:  - )
Canon MG5300 series On-screen Manual (HKLM-x32\...\Canon MG5300 series On-screen Manual) (Version:  - )
Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
CCleaner (HKLM\...\CCleaner) (Version: 4.10 - Piriform)
clear.fi Media (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.00.3004 - Acer Incorporated)
clear.fi Photo (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 2.00.3004 - Acer Incorporated)
CyberLink PowerDVD 10 (HKLM-x32\...\InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}) (Version: 10.0.4508.52 - CyberLink Corp.)
CyberLink PowerDVD 10 (x32 Version: 10.0.4508.52 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.48.1.0347 - Disc Soft Ltd)
Definition update for Microsoft Office 2010 (KB982726) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{E14AE329-F210-4EDD-B775-290821C66C1F}) (Version:  - Microsoft)
Dolby Home Theater v4 (HKLM-x32\...\{B26438B4-BF51-49C3-9567-7F14A5E40CB9}) (Version: 7.2.7000.7 - Dolby Laboratories Inc)
Driver San Francisco (HKLM-x32\...\Driver San Francisco) (Version: 1.4.0.0 - Ubisoft)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.33 - Dropbox, Inc.)
EAX4 Unified Redist (HKLM-x32\...\{89661B04-C646-4412-B6D3-5E19F02F1F37}) (Version: 4.001 - Creative Labs)
Epson Easy Photo Print 2 (HKLM-x32\...\{A02D7029-C4EF-44C1-9FD4-C0D3CA518113}) (Version: 2.2.4.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (HKLM-x32\...\{B2D55EB8-32C5-4B43-9006-9E97DECBA178}) (Version: 1.00.0000 - SEIKO EPSON CORPORATION)
Epson Event Manager (HKLM-x32\...\{8A17C27D-0325-400C-8AA9-DAA6B16CBD74}) (Version: 2.40.0009 - SEIKO EPSON CORPORATION)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON SX130 Series Printer Uninstall (HKLM\...\EPSON SX130 Series) (Version:  - SEIKO EPSON Corporation)
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
Evernote v. 4.5.2 (HKLM-x32\...\{F77EF646-19EB-11E1-9A9E-984BE15F174E}) (Version: 4.5.2.5866 - Evernote Corp.)
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Obsidian Entertainment)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Gameforge Live 2.0.1 "Baby Genius" (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.1 - Gameforge)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
GTA2 (HKLM-x32\...\{2987EE84-C4EE-4FF5-8160-32DE00D6ABC6}) (Version: 1.00.001 - )
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3501 - Acer Incorporated)
inSSIDer 3 (HKLM-x32\...\{A80CEA4E-74C1-4F9F-806B-E1D9AFC01768}) (Version: 3.0.7.48 - MetaGeek, LLC)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2712 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 5.1.15 - Acer Inc.)
LG Burning Tool (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.2.6009 - CyberLink Corp.)
LG Burning Tool (x32 Version: 6.2.6009 - CyberLink Corp.) Hidden
LG CyberLink BD Advisor (HKLM-x32\...\{2D2D8FE2-605C-4D3C-B706-36E981E7EEF0}) (Version: 2.0.4606 - CyberLink Corp.)
LG CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)
LG CyberLink LabelPrint (x32 Version: 2.5.3624 - CyberLink Corp.) Hidden
LG CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2820 - CyberLink Corp.)
LG CyberLink Media Suite (x32 Version: 8.0.2820 - CyberLink Corp.) Hidden
LG CyberLink MediaEspresso (HKLM-x32\...\InstallShield_{E3739848-5329-48E3-8D28-5BBD6E8BE384}) (Version: 6.5.1622_37397b - CyberLink Corp.)
LG CyberLink MediaEspresso (x32 Version: 6.5.1622_37397b - CyberLink Corp.) Hidden
LG CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 4.1.3402 - CyberLink Corp.)
LG CyberLink MediaShow (x32 Version: 4.1.3402 - CyberLink Corp.) Hidden
LG CyberLink PowerProducer (HKLM-x32\...\InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}) (Version: 5.0.2.2820a - CyberLink Corp.)
LG CyberLink PowerProducer (x32 Version: 5.0.2.2820a - CyberLink Corp.) Hidden
LG CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 2.0.3718 - CyberLink Corp.)
LG CyberLink YouCam (x32 Version: 2.0.3718 - CyberLink Corp.) Hidden
LG Tool Kit (HKLM-x32\...\{6179550A-3E7C-499E-BCC9-9E8113E0A285}) (Version: 10.01.0712.01 - )
Little Fighter 2 version 2.0a (HKLM-x32\...\Little Fighter 2) (Version: version 2.0a - )
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Mass Effect 1 Updated/Improved Textures Mod (HKLM-x32\...\Mass Effect 1 Updated/Improved Textures Mod1.0 (TexMod free)) (Version: 1.0 (TexMod free) - )
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 Service Pack 1 (SP1) (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}) (Version:  - Microsoft)
Microsoft Office 2010 Service Pack 1 (SP1) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.6029.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.6029.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Might and Magic® VI (HKLM-x32\...\Might and Magic® VI) (Version:  - )
Morrowind (HKLM-x32\...\{1D108D70-E7D1-4089-9A0A-99629C4D0CB8}) (Version:  - )
Mozilla Firefox 14.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 14.0.1 (x86 de)) (Version: 14.0.1 - Mozilla)
Mozilla Firefox 29.0.1 (x86 de) (HKCU\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 14.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MyWinLocker (Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker 4 (x32 Version: 4.0.14.27 - Egis Technology Inc.) Hidden
MyWinLocker Suite (HKLM-x32\...\InstallShield_{17DF9714-60C9-43C9-A9C2-32BCAED44CBE}) (Version: 4.0.14.19 - Egis Technology Inc.)
MyWinLocker Suite (x32 Version: 4.0.14.19 - Egis Technology Inc.) Hidden
newsXpresso (HKLM-x32\...\InstallShield_{613C0AC5-3A67-4B94-8B13-9176AD83F5BF}) (Version: 1.0.0.40 - esobi Inc.)
newsXpresso (x32 Version: 1.0.0.40 - esobi Inc.) Hidden
NTI Media Maker 9 (HKLM-x32\...\InstallShield_{D3D5C4E8-040F-4C6F-8105-41D43CF94F44}) (Version: 9.0.2.9006 - NTI Corporation)
NTI Media Maker 9 (x32 Version: 9.0.2.9006 - NTI Corporation) Hidden
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.82 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.82 (Version: 331.82 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
Path of Exile (HKLM-x32\...\{90A4562F-D4A1-4B65-906D-41F236CF6902}) (Version: 1.0.6.31580 - Grinding Gear Games)
Pizza Syndicate deinstallieren (HKLM-x32\...\Pizza Syndicate) (Version:  - )
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Prince of Persia The Sands of Time (HKLM-x32\...\{8C453F13-6877-4D34-8816-009ABDE306DB}) (Version: 1.00.181 - )
PyQt4 - PyQwt5 5.2.1.4 (HKLM-x32\...\PyQt4 - PyQwt5 5.2.1.4) (Version: 5.2.1.4 - pythonxy.com)
PyQt4 - QtHelp 4.8.2 (HKLM-x32\...\PyQt4 - QtHelp 4.8.2) (Version: 4.8.2 - pythonxy.com)
Python 2.7 - cvxopt 1.1.5 (HKLM-x32\...\Python 2.7 - cvxopt 1.1.5) (Version: 1.1.5 - pythonxy.com)
Python 2.7 - cx_Freeze 4.3 (HKLM-x32\...\Python 2.7 - cx_Freeze 4.3) (Version: 4.3 - pythonxy.com)
Python 2.7 - Cython 0.17.1 (HKLM-x32\...\Python 2.7 - Cython 0.17.1) (Version: 0.17.1 - pythonxy.com)
Python 2.7 - distribute 0.6.30-1 (HKLM-x32\...\Python 2.7 - distribute 0.6.30-1) (Version: 0.6.30-1 - pythonxy.com)
Python 2.7 - docutils 0.9.1 (HKLM-x32\...\Python 2.7 - docutils 0.9.1) (Version: 0.9.1 - pythonxy.com)
Python 2.7 - EnthoughtToolSuite 4.2.0-1 (HKLM-x32\...\Python 2.7 - EnthoughtToolSuite 4.2.0-1) (Version: 4.2.0-1 - pythonxy.com)
Python 2.7 - formlayout 1.0.9 (HKLM-x32\...\Python 2.7 - formlayout 1.0.9) (Version: 1.0.9 - pythonxy.com)
Python 2.7 - gdal 1.9.2-2 (HKLM-x32\...\Python 2.7 - gdal 1.9.2-2) (Version: 1.9.2-2 - pythonxy.com)
Python 2.7 - Gnuplot 1.8.0.3 (HKLM-x32\...\Python 2.7 - Gnuplot 1.8.0.3) (Version: 1.8.0.3 - pythonxy.com)
Python 2.7 - guidata 1.5.0 (HKLM-x32\...\Python 2.7 - guidata 1.5.0) (Version: 1.5.0 - pythonxy.com)
Python 2.7 - guiqwt 2.2.0 (HKLM-x32\...\Python 2.7 - guiqwt 2.2.0) (Version: 2.2.0 - pythonxy.com)
Python 2.7 - h5py 2.1.0 (HKLM-x32\...\Python 2.7 - h5py 2.1.0) (Version: 2.1.0 - pythonxy.com)
Python 2.7 - IPython 0.13.1-1 (HKLM-x32\...\Python 2.7 - IPython 0.13.1-1) (Version: 0.13.1-1 - pythonxy.com)
Python 2.7 - itk 4.2.0 (HKLM-x32\...\Python 2.7 - itk 4.2.0) (Version: 4.2.0 - pythonxy.com)
Python 2.7 - jinja2 2.6.0.1 (HKLM-x32\...\Python 2.7 - jinja2 2.6.0.1) (Version: 2.6.0.1 - pythonxy.com)
Python 2.7 - matplotlib 1.1.1 (HKLM-x32\...\Python 2.7 - matplotlib 1.1.1) (Version: 1.1.1 - pythonxy.com)
Python 2.7 - mdp 3.3.0.1 (HKLM-x32\...\Python 2.7 - mdp 3.3.0.1) (Version: 3.3.0.1 - pythonxy.com)
Python 2.7 - mx 3.2.4 (HKLM-x32\...\Python 2.7 - mx 3.2.4) (Version: 3.2.4 - pythonxy.com)
Python 2.7 - netcdf4 1.0.1 (HKLM-x32\...\Python 2.7 - netcdf4 1.0.1) (Version: 1.0.1 - pythonxy.com)
Python 2.7 - networkx 1.7 (HKLM-x32\...\Python 2.7 - networkx 1.7) (Version: 1.7 - pythonxy.com)
Python 2.7 - nose 1.2.1 (HKLM-x32\...\Python 2.7 - nose 1.2.1) (Version: 1.2.1 - pythonxy.com)
Python 2.7 - numexpr 2.0.1 (HKLM-x32\...\Python 2.7 - numexpr 2.0.1) (Version: 2.0.1 - pythonxy.com)
Python 2.7 - numpy 1.6.2 (HKLM-x32\...\Python 2.7 - numpy 1.6.2) (Version: 1.6.2 - pythonxy.com)
Python 2.7 - OpenCV 2.4.2 (HKLM-x32\...\Python 2.7 - OpenCV 2.4.2) (Version: 2.4.2 - pythonxy.com)
Python 2.7 - openpyxl 1.6.1-1 (HKLM-x32\...\Python 2.7 - openpyxl 1.6.1-1) (Version: 1.6.1-1 - pythonxy.com)
Python 2.7 - pandas 0.9.0-1 (HKLM-x32\...\Python 2.7 - pandas 0.9.0-1) (Version: 0.9.0-1 - pythonxy.com)
Python 2.7 - PIL 1.1.7.2 (HKLM-x32\...\Python 2.7 - PIL 1.1.7.2) (Version: 1.1.7.2 - pythonxy.com)
Python 2.7 - pip 1.2.1 (HKLM-x32\...\Python 2.7 - pip 1.2.1) (Version: 1.2.1 - pythonxy.com)
Python 2.7 - ply 3.4 (HKLM-x32\...\Python 2.7 - ply 3.4) (Version: 3.4 - pythonxy.com)
Python 2.7 - pp 1.6.2 (HKLM-x32\...\Python 2.7 - pp 1.6.2) (Version: 1.6.2 - pythonxy.com)
Python 2.7 - psutils 0.6.1 (HKLM-x32\...\Python 2.7 - psutils 0.6.1) (Version: 0.6.1 - pythonxy.com)
Python 2.7 - py2exe 0.6.9 (HKLM-x32\...\Python 2.7 - py2exe 0.6.9) (Version: 0.6.9 - pythonxy.com)
Python 2.7 - pydicom 0.9.7-1 (HKLM-x32\...\Python 2.7 - pydicom 0.9.7-1) (Version: 0.9.7-1 - pythonxy.com)
Python 2.7 - pyfits 3.1 (HKLM-x32\...\Python 2.7 - pyfits 3.1) (Version: 3.1 - pythonxy.com)
Python 2.7 - pygments 1.5.0 (HKLM-x32\...\Python 2.7 - pygments 1.5.0) (Version: 1.5.0 - pythonxy.com)
Python 2.7 - pyhdf 0.8.3 (HKLM-x32\...\Python 2.7 - pyhdf 0.8.3) (Version: 0.8.3 - pythonxy.com)
Python 2.7 - pylint 0.26-1 (HKLM-x32\...\Python 2.7 - pylint 0.26-1) (Version: 0.26-1 - pythonxy.com)
Python 2.7 - PyOpenGL 3.0.2-1 (HKLM-x32\...\Python 2.7 - PyOpenGL 3.0.2-1) (Version: 3.0.2-1 - pythonxy.com)
Python 2.7 - pyparallel 0.2.0.1 (HKLM-x32\...\Python 2.7 - pyparallel 0.2.0.1) (Version: 0.2.0.1 - pythonxy.com)
Python 2.7 - pyparsing 1.5.6 (HKLM-x32\...\Python 2.7 - pyparsing 1.5.6) (Version: 1.5.6 - pythonxy.com)
Python 2.7 - PyQt4 4.9.4 (HKLM-x32\...\Python 2.7 - PyQt4 4.9.4) (Version: 4.9.4 - pythonxy.com)
Python 2.7 - pyreadline 1.7.1 (HKLM-x32\...\Python 2.7 - pyreadline 1.7.1) (Version: 1.7.1 - pythonxy.com)
Python 2.7 - pyserial 2.6.0.1 (HKLM-x32\...\Python 2.7 - pyserial 2.6.0.1) (Version: 2.6.0.1 - pythonxy.com)
Python 2.7 - pytables 2.4.0 (HKLM-x32\...\Python 2.7 - pytables 2.4.0) (Version: 2.4.0 - pythonxy.com)
Python 2.7 - pyvisa 1.4 (HKLM-x32\...\Python 2.7 - pyvisa 1.4) (Version: 1.4 - pythonxy.com)
Python 2.7 - PyWavelets 0.2.2 (HKLM-x32\...\Python 2.7 - PyWavelets 0.2.2) (Version: 0.2.2 - pythonxy.com)
Python 2.7 - pywin32 218-1 (HKLM-x32\...\Python 2.7 - pywin32 218-1) (Version: 218-1 - pythonxy.com)
Python 2.7 - pywinauto 0.4.0 (HKLM-x32\...\Python 2.7 - pywinauto 0.4.0) (Version: 0.4.0 - pythonxy.com)
Python 2.7 - pyzmq 2.2.0.1-1 (HKLM-x32\...\Python 2.7 - pyzmq 2.2.0.1-1) (Version: 2.2.0.1-1 - pythonxy.com)
Python 2.7 - reportlab 2.6 (HKLM-x32\...\Python 2.7 - reportlab 2.6) (Version: 2.6 - pythonxy.com)
Python 2.7 - rst2pdf 0.92 (HKLM-x32\...\Python 2.7 - rst2pdf 0.92) (Version: 0.92 - pythonxy.com)
Python 2.7 - scikits.image 0.7.2-1 (HKLM-x32\...\Python 2.7 - scikits.image 0.7.2-1) (Version: 0.7.2-1 - pythonxy.com)
Python 2.7 - scikits-learn 0.12.1-1 (HKLM-x32\...\Python 2.7 - scikits-learn 0.12.1-1) (Version: 0.12.1-1 - pythonxy.com)
Python 2.7 - scipy 0.11.0 (HKLM-x32\...\Python 2.7 - scipy 0.11.0) (Version: 0.11.0 - pythonxy.com)
Python 2.7 - SendKeys 0.3 (HKLM-x32\...\Python 2.7 - SendKeys 0.3) (Version: 0.3 - pythonxy.com)
Python 2.7 - simplejson 2.6.2-1 (HKLM-x32\...\Python 2.7 - simplejson 2.6.2-1) (Version: 2.6.2-1 - pythonxy.com)
Python 2.7 - sphinx 1.1.3.1 (HKLM-x32\...\Python 2.7 - sphinx 1.1.3.1) (Version: 1.1.3.1 - pythonxy.com)
Python 2.7 - spyder 2.1.11 (HKLM-x32\...\Python 2.7 - spyder 2.1.11) (Version: 2.1.11 - pythonxy.com)
Python 2.7 - SQLAlchemy 0.7.9-1 (HKLM-x32\...\Python 2.7 - SQLAlchemy 0.7.9-1) (Version: 0.7.9-1 - pythonxy.com)
Python 2.7 - statsmodels 0.4.3 (HKLM-x32\...\Python 2.7 - statsmodels 0.4.3) (Version: 0.4.3 - pythonxy.com)
Python 2.7 - sympy 0.7.2-1 (HKLM-x32\...\Python 2.7 - sympy 0.7.2-1) (Version: 0.7.2-1 - pythonxy.com)
Python 2.7 - tornado 2.4 (HKLM-x32\...\Python 2.7 - tornado 2.4) (Version: 2.4 - pythonxy.com)
Python 2.7 - veusz 1.16 (HKLM-x32\...\Python 2.7 - veusz 1.16) (Version: 1.16 - pythonxy.com)
Python 2.7 - virtualenv 1.8.2-1 (HKLM-x32\...\Python 2.7 - virtualenv 1.8.2-1) (Version: 1.8.2-1 - pythonxy.com)
Python 2.7 - vitables 2.1.0.3 (HKLM-x32\...\Python 2.7 - vitables 2.1.0.3) (Version: 2.1.0.3 - pythonxy.com)
Python 2.7 - vpython 5.74 (HKLM-x32\...\Python 2.7 - vpython 5.74) (Version: 5.74 - pythonxy.com)
Python 2.7 - vtk 5.10.0 (HKLM-x32\...\Python 2.7 - vtk 5.10.0) (Version: 5.10.0 - pythonxy.com)
Python 2.7 - winpdb 1.4.8.3 (HKLM-x32\...\Python 2.7 - winpdb 1.4.8.3) (Version: 1.4.8.3 - pythonxy.com)
Python 2.7 - wxPython 2.8.12.1 (HKLM-x32\...\Python 2.7 - wxPython 2.8.12.1) (Version: 2.8.12.1 - pythonxy.com)
Python 2.7 - xlrd 0.8.0 (HKLM-x32\...\Python 2.7 - xlrd 0.8.0) (Version: 0.8.0 - pythonxy.com)
Python 2.7 - xlwt 0.7.4 (HKLM-x32\...\Python 2.7 - xlwt 0.7.4) (Version: 0.7.4 - pythonxy.com)
Python 2.7 - xy 1.2.15 (HKLM-x32\...\Python 2.7 - xy 1.2.15) (Version: 1.2.15 - pythonxy.com)
Python 2.7.3 (x32 Version: 2.7.3150 - Python Software Foundation) Hidden
Python(x,y) - console 2.0.148.7 (HKLM-x32\...\Python(x,y) - console 2.0.148.7) (Version: 2.0.148.7 - pythonxy.com)
Python(x,y) - gettext 0.14.4.3 (HKLM-x32\...\Python(x,y) - gettext 0.14.4.3) (Version: 0.14.4.3 - pythonxy.com)
Python(x,y) - mingw 4.5.2.3 (HKLM-x32\...\Python(x,y) - mingw 4.5.2.3) (Version: 4.5.2.3 - pythonxy.com)
Python(x,y) - SciTE 3.2.2-1 (HKLM-x32\...\Python(x,y) - SciTE 3.2.2-1) (Version: 3.2.2-1 - pythonxy.com)
Python(x,y) - swig 2.0.8 (HKLM-x32\...\Python(x,y) - swig 2.0.8) (Version: 2.0.8 - pythonxy.com)
Python(x,y) - WinMerge 2.12.4.2 (HKLM-x32\...\Python(x,y) - WinMerge 2.12.4.2) (Version: 2.12.4.2 - pythonxy.com)
Python(x,y) - xydoc 1.0.5.1 (HKLM-x32\...\Python(x,y) - xydoc 1.0.5.1) (Version: 1.0.5.1 - pythonxy.com)
Python(x,y) (HKLM-x32\...\Python(x,y)) (Version: 2.7.3.0 - www.pythonxy.com)
Qualcomm Atheros Direct Connect (x32 Version: 3.1 - Qualcomm Atheros) Hidden
Qualcomm Atheros WiFi Driver Installation (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 3.1 - Qualcomm Atheros)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6570 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.1.7601.85 - Realtek Semiconductor Corp.)
Risen 2 - Dark Waters (HKLM-x32\...\Steam App 40390) (Version:  - )
Secunia PSI (3.0.0.7011) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7011 - Secunia)
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Shredder (Version: 2.0.8.9 - Egis Technology Inc.) Hidden
Shredder (x32 Version: 2.0.8.9 - Egis Technology Inc.) Hidden
SketchUp 8 (HKLM-x32\...\{B8F4A45C-581C-4707-8EF2-2B9E6722270C}) (Version: 3.0.16944 - Trimble Navigation Limited)
Skype™ 5.10 (HKLM-x32\...\{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}) (Version: 5.10.116 - Skype Technologies S.A.)
SSC Service Utility v4.30 (HKLM-x32\...\SSC Service Utility_is1) (Version:  - SSC Localization Group)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold (HKLM-x32\...\{C917BA70-28A3-4C74-B163-41FD8C8E1A5A}) (Version:  - )
Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version:  - eTeks)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (HKCU\...\TeamSpeak 3 Client) (Version: 3.0.10.1 - TeamSpeak Systems GmbH)
TES Construction Set (HKLM-x32\...\{58D68DF0-4E8B-4E9E-B425-670F9E37C1A8}) (Version:  - )
The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version:  - Bethesda Game Studios)
Thief - Deadly Shadows (HKLM-x32\...\{FC123EEA-330A-4685-911C-95B8F5E9DE68}) (Version: 1.0 - )
Thief - Deadly Shadows Collective Texture Pack by John P., ver. 1.0.3 (HKLM-x32\...\Collective Thief: DS Texture Pack by John P. 1.03) (Version:  - John P.)
TmNationsForever (HKLM-x32\...\TmNationsForever_is1) (Version:  - Nadeo)
Tom Clancy's Splinter Cell Conviction (HKLM-x32\...\{6D8DDB4A-C263-40DE-BA16-AFDAD159D59A}) (Version: 1.04 - Ubisoft)
Tom Clancy's Splinter Cell Double Agent (HKLM-x32\...\{CAD1691A-FA24-4B95-9009-3257B8440ECC}) (Version: 1.00.0000 - Ubisoft)
Tropico 4 (HKLM-x32\...\Steam App 57690) (Version:  - Haemimont Games)
Two Worlds II (HKLM-x32\...\Two Worlds II) (Version: 1.3.0.0 - Reality Pump)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.5 (HKLM\...\{6C9365EB-1F9E-4893-9196-3EC77C88D0C5}) (Version: 2.5.1.0 - Intel)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2836939) (Version: 1 - Microsoft Corporation)
Uplay (HKLM-x32\...\Uplay) (Version: 2.0 - Ubisoft)
USBFast (HKLM-x32\...\{AED142A8-96EA-42DE-B212-60BFC98D6CC7}) (Version: 1.3.0.30 - Prolific Technology Inc.)
VLC media player 2.0.7 (HKLM-x32\...\VLC media player) (Version: 2.0.7 - VideoLAN)
Warframe (HKLM-x32\...\{81180B49-661E-4B19-AECC-AB58943145F1}) (Version: 1.0.0 - Digital Extremes)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.02.3507 - Acer Incorporated)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

09-05-2014 19:04:42 avast! antivirus system restore point
10-05-2014 16:05:17 DirectX wurde installiert
10-05-2014 17:57:13 DirectX wurde installiert
13-05-2014 10:44:01 Windows Update
14-05-2014 11:01:23 Windows Update
18-05-2014 08:53:29 Windows Update
25-05-2014 13:42:21 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {091B7D86-BB47-4474-989C-480977BCC639} - System32\Tasks\PMMUpdate => C:\Program Files\EgisTec IPS\PMMUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: {23B4AE43-AEAB-45A2-AF80-7891388EB9C4} - System32\Tasks\avast! Emergency Update => C:\Programme und Spiele\Avast Free Antivirus\AvastEmUpdate.exe [2014-05-09] (AVAST Software)
Task: {4A0C4EDA-EB4B-48FA-81EB-90042B1B6F9D} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-07] (Acer Incorporated)
Task: {508235CF-36AC-4590-B89C-48A05FCEA5CC} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-13] (Adobe Systems Incorporated)
Task: {8C1908DD-C7C0-4959-A5D3-E9FFA70A12F9} - System32\Tasks\CCleanerSkipUAC => C:\Programme\CCleaner\CCleaner.exe [2014-01-21] (Piriform Ltd)
Task: {C6BF5EFD-DC0B-4090-9809-DE08C7B5867F} - System32\Tasks\EgisUpdate => C:\Program Files\EgisTec IPS\EgisUpdate.exe [2011-03-29] (Egis Technology Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-12-26 18:24 - 2013-11-11 17:02 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-01-03 15:38 - 2009-07-02 16:02 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2012-04-12 10:09 - 2012-03-26 11:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-04-07 05:29 - 2012-04-07 05:29 - 00040552 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
2012-04-07 05:29 - 2012-04-07 05:29 - 00022120 _____ () C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
2014-05-27 17:51 - 2014-05-27 17:51 - 00050477 _____ () C:\Users\MF\Desktop\Defogger.exe
2014-05-27 13:38 - 2014-05-27 13:38 - 02255872 _____ () C:\Programme und Spiele\Avast Free Antivirus\defs\14052700\algo.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 00465344 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\sqlite3.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 01081368 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\ACE.dll
2012-01-05 23:22 - 2012-01-05 23:22 - 00125464 _____ () C:\Program Files (x86)\NTI\Acer Backup Manager\MailConverter32.dll
2014-05-27 14:15 - 2014-05-27 14:15 - 00041984 _____ () c:\users\mf\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplc6xaq.dll
2013-10-19 01:55 - 2013-10-19 01:55 - 25100288 _____ () C:\Users\MF\AppData\Roaming\Dropbox\bin\libcef.dll
2013-11-29 19:40 - 2013-11-29 19:40 - 19336120 _____ () C:\Programme und Spiele\Avast Free Antivirus\libcef.dll
2014-02-12 10:50 - 2014-02-12 10:50 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\b162055347700182d96325676dd591c4\IsdiInterop.ni.dll
2012-04-10 13:08 - 2011-11-30 05:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-04-29 13:24 - 2011-12-16 04:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2014-05-10 19:57 - 2014-05-10 19:57 - 03839088 _____ () C:\Programme und Spiele\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/27/2014 05:54:33 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/27/2014 05:41:05 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/27/2014 02:26:19 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/27/2014 02:26:01 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.

Error: (05/27/2014 02:15:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 01:37:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wmpnscfg.exe, Version: 12.0.7600.16385, Zeitstempel: 0x4a5bd026
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000055a45
ID des fehlerhaften Prozesses: 0x1638
Startzeit der fehlerhaften Anwendung: 0xwmpnscfg.exe0
Pfad der fehlerhaften Anwendung: wmpnscfg.exe1
Pfad des fehlerhaften Moduls: wmpnscfg.exe2
Berichtskennung: wmpnscfg.exe3

Error: (05/27/2014 00:22:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 10:34:14 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (05/27/2014 09:41:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 01:27:01 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]


System errors:
=============
Error: (05/27/2014 02:14:12 PM) (Source: BugCheck) (EventID: 1001) (User: )
Description: 0x00000109 (0xa3a039d8a0706545, 0xb3b7465ef2eea13f, 0xfffff880033705c0, 0x0000000000000002)C:\Windows\MEMORY.DMP052714-89606-01

Error: (05/27/2014 02:13:59 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎27.‎05.‎2014 um 14:11:02 unerwartet heruntergefahren.

Error: (05/07/2014 01:52:57 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (05/03/2014 03:18:57 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (05/03/2014 03:18:51 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (05/03/2014 03:18:44 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (05/03/2014 03:18:38 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (05/03/2014 03:18:32 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (05/03/2014 03:18:25 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.

Error: (05/03/2014 03:18:19 PM) (Source: cdrom) (EventID: 7) (User: )
Description: Fehlerhafter Block bei Gerät \Device\CdRom0.


Microsoft Office Sessions:
=========================
Error: (05/27/2014 05:54:33 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Downloads\esetsmartinstaller_deu.exe

Error: (05/27/2014 05:41:05 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe

Error: (05/27/2014 02:26:19 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Downloads\esetsmartinstaller_deu.exe

Error: (05/27/2014 02:26:01 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Downloads\esetsmartinstaller_deu.exe

Error: (05/27/2014 02:15:06 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 01:37:47 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: wmpnscfg.exe12.0.7600.163854a5bd026ntdll.dll6.1.7601.18247521eaf24c00000050000000000055a45163801cf79a0147af829C:\Program Files\Windows Media Player\wmpnscfg.exeC:\Windows\SYSTEM32\ntdll.dll53177475-e593-11e3-9f37-e840f2c7d8a0

Error: (05/27/2014 00:22:58 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 10:34:14 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]

Error: (05/27/2014 09:41:54 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 01:27:01 AM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )
Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]


==================== Memory info =========================== 

Percentage of memory in use: 35%
Total physical RAM: 8030.36 MB
Available physical RAM: 5196.73 MB
Total Pagefile: 16058.89 MB
Available Pagefile: 13185.75 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:450.16 GB) (Free:192.4 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 4BB1E99E)
Partition 1: (Not Active) - (Size=16 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=450 GB) - (Type=07 NTFS)

==================== End Of Log ============================

und der FRST Log:

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by MF (administrator) on MF-PC on 27-05-2014 17:55:53
Running from C:\Users\MF\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Programme und Spiele\Avast Free Antivirus\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Atheros) C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Dropbox, Inc.) C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(AVAST Software) C:\Programme und Spiele\Avast Free Antivirus\avastui.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(BL) C:\Program Files\lg_fwupdate\fwupdate.exe
(CyberLink Corp.) C:\Programme und Spiele\CyberLink\PowerDVD10\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Programme und Spiele\Mozilla Firefox\firefox.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
() C:\Users\MF\Desktop\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [InstantUpdate] => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-07] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12448872 2012-02-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [576376 2012-02-02] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1021056 2012-03-08] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800896 2012-03-08] (Atheros Commnucations)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM\...\Run: [OOTag] => C:\Program Files (x86)\Acer\OOBEOffer\ootag.exe [13856 2010-02-23] (Microsoft)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [OOTag] => C:\Program Files (x86)\Acer\OOBEOffer\OOTag.exe [13856 2010-02-23] (Microsoft)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-26] (Intel Corporation)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-08-30] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Programme und Spiele\Avast Free Antivirus\AvastUI.exe [3888648 2014-05-24] (AVAST Software)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Programme\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] => C:\Programme\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [LGODDFU] => C:\Programme\lg_fwupdate\fwupdate.exe [548864 2008-09-19] (BL)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RemoteControl10] => C:\Programme und Spiele\CyberLink\PowerDVD10\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [78352 2012-08-27] (cyberlink)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2216525888-2451706074-2587650537-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2216525888-2451706074-2587650537-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2216525888-2451706074-2587650537-1001\...\MountPoints2: {8076a067-72d8-11e3-9359-e840f2c7d8a0} - E:\Autorun.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-11-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-11-14] (NVIDIA Corporation)
Startup: C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme und Spiele\Avast Free Antivirus\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme und Spiele\Avast Free Antivirus\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme und SpieleMicrosoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 134.109.102.132 134.109.102.133

FireFox:
========
FF ProfilePath: C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default
FF Homepage: https://www.facebook.com/?stype=lo&jlou=AffGtzAocKKX7RTe1BEQPUVxyl_odxtAlwF5_IUDe8Fe5E9RCcYod29C-G5Dl6IWjHkJUfNtHxyPdYasoOI0bNbkfjzrN2JJS_Yljc2GrGcURg&smuh=12611&lh=Ac9pyUxCdFnKRq-p|hxxp://www.amazon.de/Ubisoft-Watch-Dogs/dp/B00BJMAO2W/ref=sr_1_2_title_0?s=videogames&ie=UTF8&qid=1395316174&sr=1-2&keywords=watch+dogs|hxxp://www.nexusmods.com/skyrim/mods/23355/?|hxxp://www.nexusmods.com/skyrim/mods/16374/?|https://navigator.web.de/logout?sid=6c1ca97b2d6777b7ffaa358945c169914aae9939e0971b29274d980fc5f7222341da5441be3fae30fb82b03c1d5ff8b2|hxxp://www.medical-engineering.cc/downloads/downloads1semester/20140128-MKG_AnatomiePhysiologieKopfHals_1623012014-1sem.pdf|hxxp://onepiece-tube.tv/folge/637|hxxp://de.wikipedia.org/wiki/Komplexe_Zahl|https://www.paket.de/pkp/appmanager/pkp/desktop?_nfpb=true&_portlet.async=false&_pageLabel=pkp_portal_page_introduction|hxxp://www.myvideo.de/watch/4014533/Mark_Medlock_Summer_Love|hxxp://www.youtube.com/watch?v=cJ6H0InlpY0|hxxp://onepiece.wikia.com/wiki/Episode_Special_1|hxxp://answers.yahoo.com/question/index?qid=20121006015526AAg9lrP|hxxp://onepiece-tube.tv/movie11|hxxp://www.mathepedia.de/Gram-Schmidtsches_Orthogonalisierungsverfahren.aspx|hxxp://www.mathematik.net/Polynomdivision/py03s8.htm|hxxp://www.tu-chemnitz.de/mathematik/inverse_probleme/Uebungsmaterialien/HATRAFO.pdf|hxxp://www.jobisjob.de/chemnitz/jobs/l#where=chemnitz&jobType=Praktikum|hxxp://voith.com/de/maerkte-branchen/branchen/maschinenbau-215.html|hxxp://voith.com/de/130408_leaflet_student_guide_web.pdf|hxxp://3d-micromac.de/Praktika.html|hxxp://statistik.wu-wien.ac.at/~leydold/MOK/HTML/node77.html|hxxp://www.youtube.com/results?search_query=eigth+days+a+week&sm=12|hxxp://www.onvista.de/analysen/analyzer/isin/DE000VTG9999?zeitraum=1-monat#chart|https://wtc.tu-chemnitz.de/shibboleth/WAYF?shire=https%3A%2F%2Fwww.csn.tu-chemnitz.de%2FShibboleth.sso%2FSAML%2FPOST&time=1395310120&target=https%3A%2F%2Fwww.csn.tu-chemnitz.de%2Fsecure%2Fuser%2F4329&providerId=https%3A%2F%2Fwww.csn.tu-chemnitz.de%2Fshibboleth#traffic|hxxp://www.vbb.de/de/article/fahrpreise/haeufige-fragen/19773.html|hxxp://www.onvista.de/analysen/analyzer/isin/NL0000235190|hxxp://www.onvista.de/analysen/analyzer/isin/DE000A1EWWW0|hxxp://www.onvista.de/analysen/analyzer/isin/DE0005875306|hxxp://de.wikipedia.org/wiki/Immunglobulin|hxxp://www.youtube.com/watch?v=p-o5-DDXxkw&list=PLD2A1BEDEC2B6AB34|hxxp://de.wikipedia.org/wiki/Augenfarbe|hxxp://www.youtube.com/watch?v=PDMhZPYX_Ig|hxxp://de.wikipedia.org/wiki/Prothese|hxxp://www.detektiv-conan.ch/index.php?page=episodes/episodes_jp.php|hxxp://conanwiki.org/wiki/Liste_der_Anime-Episoden/Episode_501_bis_600|hxxp://www.myvideo.de/Top_100/Top_100_Single_Charts|hxxp://www.youtube.com/watch?v=h0gpPs4flw8|hxxp://www.youtube.com/watch?v=D4ZTRhgqsS8|hxxp://24hoursofhappiness.com/|hxxp://www.youtube.com/watch?v=T04aBOxN9AA&list=RDVH_vAfMBy5I|https://www.tu-chemnitz.de/verwaltung/studentenamt/abt12/termine.php|hxxp://goessner.net/download/learn/tm/statik/Statikformeln.pdf|hxxp://dietanzfabrik.de/|hxxp://www.koehler-schimmel.de/|hxxp://www.tu-chemnitz.de/mb/TMD/studium/bachelor/bachelor.php|hxxp://www.tu-chemnitz.de/mb/FestKoerpMech/Lehre_und_Studium/LV_Uebersicht.php|hxxp://www.tu-chemnitz.de/mb/FestKoerpMech/Lehre_und_Studium/LV_Seite.php?LV_ID=1&ln=|https://wtc.tu-chemnitz.de/shibboleth/WAYF?shire=https%3A%2F%2Fwww.tu-chemnitz.de%2FShibboleth.sso%2FSAML%2FPOST&time=1393838632&target=https%3A%2F%2Fwww.tu-chemnitz.de%2Fmb%2FFKM_Daten%2FFKM_Lehrveranstaltungen%2FFKM_Technische_Mechanik_I%2FDownloads%2FProbeklausur_TMI_4.pdf&providerId=https%3A%2F%2Fwww.tu-chemnitz.de%2Fshibboleth|hxxp://www.maschinenbau-wissen.de/skript/mechanik/statik/60-aufgaben-schnittreaktionen|hxxp://de.wikipedia.org/wiki/Schwarzes_Loch#Supermassereiche_Schwarze_L.C3.B6cher|hxxp://www.welt.de/wissenschaft/weltraum/article121231150/Das-grosse-Fressen-am-Schwarzen-Loch.html|hxxp://www.wsj.de/article/SB10001424052702304026804579410742963186828.html?mod=WeltFeed#slide/eos|hxxp://www.youtube.com/watch?v=aZfgd4TMsHI|hxxp://www.youtube.com/watch?v=TOjZ54pdbfI|hxxp://reiseauskunft.bahn.de/bin/query2.exe/dn?ld=96235&seqnr=1&ident=l7.031194235.1393861855&rt=1&rememberSortType=minArrival&HWAI=JS!ajax=yes!&HWAI=CONNECTION$C0-1!id=C0-1!HwaiConId=C0-1!HwaiDetailStatus=details!;~CONNECTION$C0-1!HwaiMapStatus=UNDEFINED!HwaiMapNumber=UNDEFINED!HwaiMapSlider=UNDEFINED!HwaiDetailHimMessage=UNDEFINED!;|hxxp://www.worldofspeed.com/|hxxp://www.chip.de/news/Path-of-Exile-Erstes-Game-Add-On-veroeffentlicht_68377553.html|hxxp://www.gamestar.de/spiele/rollenspiele/genre-261.html#top|hxxp://www.amazon.de/dp/B00BB629SI/ref=asc_df_B00BB629SI17693771/?tag=billigerde-21&creative=22398&creativeASIN=B00BB629SI&linkCode=asn|https://www.pathofexile.com/|hxxp://www.forumla.de/f-pc-spiele-16/t-assassins-creed-1-ruckelt-unertraeglich-195820|https://www.amazon.de/ap/register?_encoding=UTF8&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.de%2Fgp%2Fyourstore%2Fhome%3Fie%3DUTF8%26ref_%3Dgno_newcust|hxxp://www.youtube.com/watch?v=rH9sBF_cUeo&list=PLE4E153A86374F5BB|hxxp://de.wikipedia.org/wiki/Transatlantisches_Freihandelsabkommen|hxxp://www.amazon.de/CSL-Ausf%C3%BChrung-ergonomisches-Vorbeugung-armschonend/dp/B00HYWZSF4/ref=cm_cr_pr_product_top|hxxp://www.youtube.com/watch?v=rfVxOK4oTSw|hxxp://www.immowelt.de/immobilien/immodetail.aspx?id=27032944|hxxp://hemden-meister.de/Hemdenkonfigurator.htm?websale8=hemdenmeister&tpl=tpl_hemdenkonfigurator.htm&pi=MHLANG|hxxp://hemden-meister.de/SCWARZE-ROSE-Hemd-Halbarm-Uni-Popeline-rost-226208%2f66.htm?websale8=hemdenmeister&pi=SRNOS02827&ci=000004&lft=226208/66/37|hxxp://www.tailorjack.de/masshemden/hemden-konfigurator|hxxp://www.spieletipps.de/pc/morrowind/tipps/9531/1/|hxxp://www.spieletipps.de/pc/morrowind/fragen/id-3219971/|hxxp://mwmap.uesp.net/?centeron=Drulene+Falen%27s+Hut|hxxp://www.uesp.net/wiki/Morrowind:Mudcrab_Pests|hxxp://www.yiya.de/games/morrowind/html/mo_cheats.htm|https://www.tu-chemnitz.de/verwaltung/vlvz/plan/anzeige.php?sg=1732&vm=Kalender|hxxp://mwmap.uesp.net/?centeron=Hla+Oad|hxxp://www.uesp.net/wiki/Morrowind:Vivec_(city)|hxxp://www.spieletipps.de/pc/morrowind/tipps/32094/|hxxp://www.uesp.net/wiki/Morrowind:Arkngthand|hxxp://mwmap.uesp.net/?centeron=Rothan+Ancestral+Tomb|hxxp://www.uesp.net/wiki/Morrowind:House_Redoran#Great_House_Redoran_Ranks|hxxp://www.pcgames.de/|hxxp://praxistipps.chip.de/firefox-sitzungen-speichern-und-verwalten_3564|https://www.tu-chemnitz.de/verwaltung/vlvz/plan/anzeige.php?sg=1732&vm=Kalender|hxxp://www.spieletipps.de/pc/morrowind/fragen/id-1803583/|hxxp://www.uesp.net/wiki/Morrowind:Factions|hxxp://www.uesp.net/wiki/Morrowind:House_Redoran
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PR83C6~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PR83C6~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\MF\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: FT DeepDark - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2014-05-24]
FF Extension: FT GraphiteGlow - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{99e34760-2754-11e0-91fa-0800200c9a66} [2014-03-25]
FF Extension: Ghostery - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\firefox@ghostery.com.xpi [2014-03-21]
FF Extension: Webutation - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{15fe27f3-e5ab-2d59-4c5c-dadc7945bdbd}.xpi [2013-04-13]
FF Extension: NoScript - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-03]
FF Extension: Adblock Plus - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-11]
FF Extension: BetterPrivacy - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-03-21]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Programme und Spiele\Avast Free Antivirus\WebRep\FF
FF Extension: avast! Online Security - C:\Programme und Spiele\Avast Free Antivirus\WebRep\FF [2012-08-10]
FF StartMenuInternet: FIREFOX.EXE - C:\Programme und Spiele\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 avast! Antivirus; C:\Programme und Spiele\Avast Free Antivirus\AvastSvc.exe [50344 2014-05-09] (AVAST Software)
R2 avast! Firewall; C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe [109048 2014-05-09] (AVAST Software)
S2 CLKMSVC10_68CF25B3; C:\Programme und Spiele\CyberLink\PowerDVD10\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-08-27] (CyberLink)
S3 DCDhcpService; C:\Program Files (x86)\Acer\WDAgent\DCDhcpService.exe [111776 2012-02-10] (Atheros Communication Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [72864 2012-02-19] (Atheros)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-09] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-04] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-09] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-12] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-12] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-09] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-02-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-01] (Disc Soft Ltd)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-02-02] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-27 17:55 - 2014-05-27 17:56 - 00027363 _____ () C:\Users\MF\Desktop\FRST.txt
2014-05-27 17:55 - 2014-05-27 17:55 - 00000000 ____D () C:\FRST
2014-05-27 17:54 - 2014-05-27 17:54 - 02066944 _____ (Farbar) C:\Users\MF\Desktop\FRST64.exe
2014-05-27 17:53 - 2014-05-27 17:53 - 00000466 _____ () C:\Users\MF\Desktop\defogger_disable.log
2014-05-27 17:53 - 2014-05-27 17:53 - 00000000 _____ () C:\Users\MF\defogger_reenable
2014-05-27 17:51 - 2014-05-27 17:51 - 00050477 _____ () C:\Users\MF\Desktop\Defogger.exe
2014-05-27 14:26 - 2014-05-27 14:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-27 14:22 - 2014-05-27 14:22 - 00000781 _____ () C:\Users\MF\Desktop\Absturzbericht.txt
2014-05-27 14:13 - 2014-05-27 14:14 - 00287160 _____ () C:\Windows\Minidump\052714-89606-01.dmp
2014-05-27 14:13 - 2014-05-27 14:13 - 00000000 ____D () C:\Windows\Minidump
2014-05-27 14:12 - 2014-05-27 14:12 - 734986024 _____ () C:\Windows\MEMORY.DMP
2014-05-14 13:08 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:08 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:08 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:08 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:08 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:08 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 13:01 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 13:01 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 13:01 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 13:01 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 13:01 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 13:01 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 13:01 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-14 13:01 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-14 13:01 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-14 13:01 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-14 13:00 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 13:00 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 13:00 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 13:00 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 13:00 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 13:00 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 13:00 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-14 13:00 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-14 13:00 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 13:00 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-14 13:00 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-13 22:17 - 2014-05-13 22:17 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-10 18:07 - 2014-05-10 19:59 - 00000000 ____D () C:\Users\MF\AppData\Local\Skyrim
2014-05-09 21:07 - 2014-05-09 21:06 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-09 21:06 - 2014-05-12 12:34 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-09 21:06 - 2014-05-09 21:06 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1399890898478
2014-05-09 21:06 - 2014-05-09 21:06 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-05 15:03 - 2014-05-05 15:03 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX2
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonEPP
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Canon
2014-05-05 14:59 - 2011-04-13 05:00 - 00385536 _____ (CANON INC.) C:\Windows\system32\CNMXLMAT.DLL
2014-05-05 14:57 - 2014-05-05 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Benutzerregistrierung
2014-05-05 14:56 - 2014-05-05 14:56 - 00002043 _____ () C:\Users\Public\Desktop\Canon Solution Menu EX.lnk
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-05-05 14:54 - 2014-05-05 14:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series
2014-05-05 14:54 - 2014-05-05 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-05 14:54 - 2014-05-05 14:54 - 00002324 _____ () C:\Users\Public\Desktop\Canon MG5300 series Online-Handbuch.lnk
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Manual
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\Program Files\Canon
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-05 14:53 - 2011-05-23 05:00 - 00385536 _____ (CANON INC.) C:\Windows\system32\CNMLMAT.DLL
2014-05-05 14:53 - 2011-03-31 10:07 - 00302080 _____ (CANON INC.) C:\Windows\system32\CNC_ATC.dll
2014-05-05 14:53 - 2011-03-31 10:07 - 00114688 _____ (CANON INC.) C:\Windows\SysWOW64\CNC_ATU.dll
2014-05-05 14:53 - 2011-03-31 10:06 - 00112128 _____ (CANON INC.) C:\Windows\system32\CNC_ATI.dll
2014-05-05 14:53 - 2011-03-30 12:55 - 00373248 _____ (CANON INC.) C:\Windows\system32\CNC_ATL.dll
2014-05-05 14:53 - 2011-03-30 12:54 - 00323584 _____ (CANON INC.) C:\Windows\SysWOW64\CNC_ATL.dll
2014-05-05 14:53 - 2011-02-03 02:20 - 00256000 _____ (CANON INC.) C:\Windows\system32\CNMIUAT.DLL
2014-05-05 14:53 - 2011-02-01 10:23 - 00355840 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL
2014-05-05 14:53 - 2011-02-01 10:23 - 00038400 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL
2014-05-05 14:53 - 2010-11-18 08:15 - 00098304 _____ (Canon Inc.) C:\Windows\system32\CNC_ATO.dll
2014-05-05 14:53 - 2010-11-12 11:13 - 00068096 _____ () C:\Windows\SysWOW64\CNC1754D.TBL
2014-05-05 14:53 - 2010-11-12 11:13 - 00068096 _____ () C:\Windows\system32\CNC1754D.TBL
2014-05-05 14:53 - 2008-08-25 18:02 - 00017920 _____ (CANON INC.) C:\Windows\system32\CNHMCA6.dll
2014-05-05 14:53 - 2008-08-25 18:02 - 00015872 _____ (CANON INC.) C:\Windows\SysWOW64\CNHMCA.dll
2014-05-05 14:49 - 2014-05-05 14:57 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-03 16:14 - 2014-05-05 22:51 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Tropico 4
2014-05-03 16:09 - 2014-05-03 16:09 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Kalypso Media
2014-05-03 15:28 - 2014-05-03 15:28 - 00000222 _____ () C:\Users\MF\Desktop\Tropico 4.url
2014-04-28 10:26 - 2014-04-28 10:26 - 00002165 _____ () C:\Users\Public\Desktop\CyberLink PowerDVD 10.lnk
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 10
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ____D () C:\Users\MF\AppData\Local\Packages

==================== One Month Modified Files and Folders =======

2014-05-27 17:56 - 2014-05-27 17:55 - 00027363 _____ () C:\Users\MF\Desktop\FRST.txt
2014-05-27 17:55 - 2014-05-27 17:55 - 00000000 ____D () C:\FRST
2014-05-27 17:54 - 2014-05-27 17:54 - 02066944 _____ (Farbar) C:\Users\MF\Desktop\FRST64.exe
2014-05-27 17:53 - 2014-05-27 17:53 - 00000466 _____ () C:\Users\MF\Desktop\defogger_disable.log
2014-05-27 17:53 - 2014-05-27 17:53 - 00000000 _____ () C:\Users\MF\defogger_reenable
2014-05-27 17:53 - 2012-08-10 10:39 - 00000000 ____D () C:\Users\MF
2014-05-27 17:51 - 2014-05-27 17:51 - 00050477 _____ () C:\Users\MF\Desktop\Defogger.exe
2014-05-27 17:17 - 2013-02-28 11:48 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-27 17:05 - 2012-04-29 13:14 - 02045611 _____ () C:\Windows\WindowsUpdate.log
2014-05-27 14:26 - 2014-05-27 14:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-27 14:22 - 2014-05-27 14:22 - 00000781 _____ () C:\Users\MF\Desktop\Absturzbericht.txt
2014-05-27 14:21 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-27 14:21 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-27 14:18 - 2014-01-07 14:43 - 00000000 ___RD () C:\Users\MF\Dropbox
2014-05-27 14:18 - 2014-01-07 14:41 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Dropbox
2014-05-27 14:14 - 2014-05-27 14:13 - 00287160 _____ () C:\Windows\Minidump\052714-89606-01.dmp
2014-05-27 14:14 - 2014-02-11 18:26 - 00022111 _____ () C:\Windows\setupact.log
2014-05-27 14:14 - 2014-01-03 15:46 - 00000262 _____ () C:\Windows\lgfwup.ini
2014-05-27 14:14 - 2014-01-03 15:46 - 00000000 ____D () C:\Program Files\lg_fwupdate
2014-05-27 14:14 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-27 14:13 - 2014-05-27 14:13 - 00000000 ____D () C:\Windows\Minidump
2014-05-27 14:12 - 2014-05-27 14:12 - 734986024 _____ () C:\Windows\MEMORY.DMP
2014-05-27 13:38 - 2012-09-14 17:33 - 00000000 ____D () C:\Users\MF\AppData\Local\CrashDumps
2014-05-27 13:10 - 2014-04-08 12:51 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-26 19:54 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-05-16 11:12 - 2014-01-07 14:49 - 00001009 _____ () C:\Users\MF\Desktop\Dropbox.lnk
2014-05-16 11:12 - 2014-01-07 14:46 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-16 11:12 - 2014-01-07 14:42 - 00000877 _____ () C:\Windows\wininit.ini
2014-05-16 11:12 - 2012-08-10 10:45 - 00000000 ___RD () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-15 14:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-15 13:50 - 2014-02-28 23:12 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-14 19:08 - 2012-08-10 10:45 - 00000000 ___RD () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-14 15:37 - 2012-04-29 23:07 - 00697082 _____ () C:\Windows\system32\perfh007.dat
2014-05-14 15:37 - 2012-04-29 23:07 - 00148346 _____ () C:\Windows\system32\perfc007.dat
2014-05-14 15:37 - 2009-07-14 07:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-14 13:07 - 2013-07-11 08:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:04 - 2012-08-10 13:28 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-13 22:17 - 2014-05-13 22:17 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 22:17 - 2013-02-28 11:48 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-13 22:17 - 2012-04-10 14:15 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-13 22:17 - 2012-04-10 14:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-12 12:34 - 2014-05-09 21:06 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-12 12:34 - 2014-01-03 15:49 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-12 12:34 - 2012-08-10 17:06 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-12 12:34 - 2012-08-10 17:06 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-10 19:59 - 2014-05-10 18:07 - 00000000 ____D () C:\Users\MF\AppData\Local\Skyrim
2014-05-10 19:58 - 2014-03-05 17:58 - 00201081 _____ () C:\Windows\DirectX.log
2014-05-10 19:58 - 2012-08-10 17:03 - 00000000 ____D () C:\Programme und Spiele
2014-05-10 18:05 - 2013-09-28 16:10 - 00000000 ____D () C:\Users\MF\Documents\My Games
2014-05-10 17:56 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-05-10 17:35 - 2012-08-10 17:06 - 00004196 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-09 21:07 - 2013-09-22 21:21 - 00001935 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-09 21:06 - 2014-05-09 21:07 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-09 21:06 - 2014-05-09 21:06 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1399890898478
2014-05-09 21:06 - 2014-05-09 21:06 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-09 21:06 - 2013-03-15 16:37 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-05-09 21:06 - 2013-03-15 16:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-05-09 21:06 - 2012-08-10 17:06 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1399890898478
2014-05-09 21:06 - 2012-08-10 17:06 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1399890898478
2014-05-09 21:06 - 2012-08-10 17:06 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-05-09 21:06 - 2012-08-10 17:06 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-05-09 21:06 - 2012-08-10 17:06 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-05-06 06:40 - 2014-05-14 13:08 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-14 13:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-14 13:08 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-14 13:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-14 13:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-14 13:08 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 22:51 - 2014-05-03 16:14 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Tropico 4
2014-05-05 15:03 - 2014-05-05 15:03 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX2
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonEPP
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Canon
2014-05-05 14:59 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series
2014-05-05 14:58 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-05-05 14:57 - 2014-05-05 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Benutzerregistrierung
2014-05-05 14:57 - 2014-05-05 14:49 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-05 14:56 - 2014-05-05 14:56 - 00002043 _____ () C:\Users\Public\Desktop\Canon Solution Menu EX.lnk
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-05-05 14:56 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-05 14:54 - 2014-05-05 14:54 - 00002324 _____ () C:\Users\Public\Desktop\Canon MG5300 series Online-Handbuch.lnk
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Manual
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\Program Files\Canon
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-03 16:09 - 2014-05-03 16:09 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Kalypso Media
2014-05-03 15:28 - 2014-05-03 15:28 - 00000222 _____ () C:\Users\MF\Desktop\Tropico 4.url
2014-05-03 15:28 - 2012-12-27 12:43 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-04-28 10:26 - 2014-04-28 10:26 - 00002165 _____ () C:\Users\Public\Desktop\CyberLink PowerDVD 10.lnk
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 10
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ____D () C:\Users\MF\AppData\Local\Packages
2014-04-28 10:24 - 2014-01-03 17:14 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2014-04-28 10:24 - 2014-01-03 17:14 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2014-04-28 10:24 - 2014-01-03 17:14 - 00029480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2014-04-28 10:23 - 2014-01-03 15:35 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite
2014-04-28 10:23 - 2014-01-03 15:34 - 00000000 ____D () C:\Program Files\CyberLink
2014-04-28 10:23 - 2012-04-29 13:46 - 00000000 ____D () C:\ProgramData\CyberLink

Some content of TEMP:
====================
C:\Users\MF\AppData\Local\Temp\drm_dialogs.dll
C:\Users\MF\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\MF\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplc6xaq.dll
C:\Users\MF\AppData\Local\Temp\MSETUP4.EXE
C:\Users\MF\AppData\Local\Temp\uninstall.exe
C:\Users\MF\AppData\Local\Temp\_is6A85.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 13:10

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

hier der avast log:

Code:

ATTFilter

04/12/2014 13:08
Prüfung aller lokalen Laufwerke


Prüfung abgebrochen
Anzahl durchsuchter Ordner: 4
Anzahl der geprüften Dateien: 6
Anzahl infizierter Dateien: 0

----------------------------------------
05/27/2014 01:27
Prüfung aller lokalen Laufwerke

Datei C:\Downloads\LF2_v20a_Install.exe ist infiziert von Win32:Adware-gen [Adw], In Container verschoben
Datei C:\Downloads\Grafik Patch Mass effect\ME1UITM.exe|>%AppFolder%\BioGame\CookedPC\Maps\ICE\DSG\BIOA_ICE50_12_DSG.SFM Fehler 42145 {Installationsarchiv ist beschädigt.}
Datei Volume{0e293334-91ec-11e1-8ba0-806e6f6e6963}\D2D\IMAGES\POP010FT0OXX0C7156.SWM|>DemoVideo Fehler 42127 {CAB-Archiv ist beschädigt.}
Anzahl durchsuchter Ordner: 56383
Anzahl der geprüften Dateien: 1162683
Anzahl infizierter Dateien: 1

----------------------------------------
05/27/2014 10:34
Prüfung aller lokalen Laufwerke

Datei C:\Downloads\Grafik Patch Mass effect\ME1UITM.exe|>%AppFolder%\BioGame\CookedPC\Maps\ICE\DSG\BIOA_ICE50_12_DSG.SFM Fehler 42145 {Installationsarchiv ist beschädigt.}
Datei Volume{0e293334-91ec-11e1-8ba0-806e6f6e6963}\D2D\IMAGES\POP010FT0OXX0C7156.SWM|>DemoVideo Fehler 42127 {CAB-Archiv ist beschädigt.}
Anzahl durchsuchter Ordner: 56387
Anzahl der geprüften Dateien: 1161911
Anzahl infizierter Dateien: 0

----------------------------------------
05/27/2014 14:12

Prüfung abgebrochen
Anzahl durchsuchter Ordner: 0
Anzahl der geprüften Dateien: 0
Anzahl infizierter Dateien: 0

hier Eset:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=2ad5028bfae1174c909286c52953c168
# engine=18429
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-05-27 02:31:38
# local_time=2014-05-27 04:31:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 175719 152830948 0 0
# scanned=259380
# found=7
# cleaned=0
# scan_time=7251
sh=6525F85F423A8ACB9DE261FCE7C1BFDCAF0651EC ft=1 fh=e751b5239200023c vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Downloads\ccsetup404.exe"
sh=6585F3BCD797EFC2F81599CDE50115668B677D52 ft=1 fh=c4c5afd1d69feff3 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Downloads\ccsetup408.exe"
sh=0F97FB08E6FC4500F86E64D3285C171C6462BD61 ft=1 fh=acbbffe185c36761 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Downloads\ccsetup410.exe"
sh=8193728637D16FEDD8E5809E6A5F177DEAE87145 ft=1 fh=8b9917ca3e69a6ac vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Downloads\SweetHome3D-4.3-windows-oc.exe"
sh=91F440A8F2A0FFC91EDA87FE5410B93141B1C6B0 ft=1 fh=1ce5d7cf83504dfe vn="Win32/Toolbar.Conduit.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\MF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\32E97684\checktbexist[1].exe"
sh=F89D0D35647789000A23E8BD1E557BEE519A6BAE ft=1 fh=4f81c51847428f3f vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\MF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MR7LI113\statisticsstub[1].exe"
sh=4C265AAF9AE88D06269ADD7034D63A115606DDFA ft=1 fh=3189627c07c08170 vn="Win32/Toolbar.Conduit.S evtl. unerwünschte Anwendung" ac=I fn="C:\Users\MF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MR7LI113\stublogic[1].exe"

bei dem Logfile von GMER sagt er mir das er mit 190000 Zeichen zu lang fürs Forum ist. Was soll ich bei dem machen?

cosinus · 27.05.2014, 20:39

Warum kommst du auf Rootkit? Oder waren das noch nicht alle Funde?

Aprofon · 27.05.2014, 20:40

Ich hab auf Verdacht den GMER Log einfach geteilt:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-05-27 18:22:35
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0001 465,76GB
Running: Gmer-19357(1).exe; Driver: C:\Users\MF\AppData\Local\Temp\pgldypoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                             fffff80002fad000 19 bytes [00, 48, 83, 25, 2F, DF, 09, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 549                                                                                                                                             fffff80002fad015 1 byte [4B]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\wininit.exe[788] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                     000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\services.exe[852] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\nvvsvc.exe[412] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                      000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[656] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                     000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\winlogon.exe[700] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Windows\System32\svchost.exe[1028] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\svchost.exe[1104] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\WLANExt.exe[1528] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                 00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                               00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                          00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                           000000007770ef8d 1 byte [62]
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                        0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                        00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                        0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                 00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                  000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                             000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                               000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                           000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                            000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                          000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                  000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1548] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                 000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Windows\system32\nvvsvc.exe[1556] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                     000000007770ef8d 1 byte [62]
.text     C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe[1912] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                    0000000076488791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text     C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe[1912] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                           00000000764aa2fd 1 byte [62]
.text     C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe[1912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                         0000000076991465 2 bytes [99, 76]
.text     C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe[1912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                        00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe[1988] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                 00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2024] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                       00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Bluetooth Suite\adminservice.exe[1052] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                            000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\Launch Manager\dsiwmis.exe[1360] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                  00000000764aa2fd 1 byte [62]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe[2092] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                         000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                                   0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                                     0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                                     0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                                    000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                               00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                            00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                            0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                            0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                              00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                 0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                               0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                   0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                      0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                      00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                                  00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                                  00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                           0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                              000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                                     00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\Launch Manager\LMutilps32.exe[2100] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                      00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\Acer\Registration\GREGsvc.exe[2176] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                               00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2240] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                             00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                           0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                          00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Program Files\Acer\Acer Updater\UpdaterService.exe[2272] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                              00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2308] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                    00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                  0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe[2308] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                 00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2332] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                          00000000764aa2fd 1 byte [62]
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[2384] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe[2436] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                        00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Secunia\PSI\sua.exe[2484] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                         00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Secunia\PSI\sua.exe[2484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                       0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\Secunia\PSI\sua.exe[2484] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                      00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe[2588] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                   00000000764aa2fd 1 byte [62]
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                          00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                        00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                         00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                   00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                 0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                 00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                 0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                          00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                           000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                      000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                        000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                    000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                     000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                   000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\d3d9.dll!Direct3DCreate9Ex                                                                                           000007fef8332460 5 bytes JMP 000007fefd9f02d0
.text     C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3204] C:\Windows\system32\d3d9.dll!Direct3DCreate9                                                                                             000007fef83696b0 6 bytes JMP 000007fefd9f0298
.text     C:\Windows\system32\conhost.exe[3212] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                              00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                            00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                             00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                                       00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                        000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                                     0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                                     00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                                     0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                              00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                               000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                          000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                            000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                                        000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                         000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                                       000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                                                                               000007fef6fddc88 5 bytes JMP 000007fff6dd00d8
.text     C:\Windows\system32\Dwm.exe[3264] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                                                                              000007fef6fdde10 5 bytes JMP 000007fff6dd0110
.text     C:\Windows\Explorer.EXE[3300] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                            000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                    0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                      0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                      0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                     000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                             00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                             0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                             0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                               00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                  0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                    0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                       0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                       00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                   00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                   00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                            0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                               000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                 000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                      00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                       00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                              0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                             00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Windows\system32\taskhost.exe[3468] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                   000000007770ef8d 1 byte [62]
.text     C:\Windows\System32\rundll32.exe[3572] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                   000000007770ef8d 1 byte [62]
.text     C:\Windows\System32\igfxtray.exe[3944] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                   000000007770ef8d 1 byte [62]
.text     C:\Windows\System32\hkcmd.exe[3952] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                      000000007770ef8d 1 byte [62]
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                         00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                       00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                        00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                                  00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                   000000007770ef8d 1 byte [62]
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                                0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                                00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                                0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                         00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                          000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                     000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                       000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                                   000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                    000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                                  000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                          000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Windows\System32\igfxpers.exe[3964] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                                         000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                          00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                        00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                         00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                   00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                 0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                 00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                 0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                          00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                           000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                      000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                        000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                    000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                     000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                   000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                           000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4080] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                          000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                           00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                         00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                          00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                    00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                     000000007770ef8d 1 byte [62]
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                  0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                  00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                  0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                           00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                            000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                       000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                         000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                     000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                            000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                           000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                      000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3364] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                    000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                     00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                   00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                    00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                              00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                               000000007770ef8d 1 byte [62]
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                            0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                            00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                            0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                     00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                      000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                 000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                   000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                               000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                              000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                      000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files\Apoint2K\Apoint.exe[1640] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                                     000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                      00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                    00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                     00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                               00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                             0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                             00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                             0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                      00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                       000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                  000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                    000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                 000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                               000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                       000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe[4028] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                      000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                   00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                 00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                  00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                            00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                             000000007770ef8d 1 byte [62]
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                          0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                          00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                          0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                   00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                    000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                               000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                 000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                             000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                              000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Apoint2K\ApMsgFwd.exe[4032] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                            000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                     00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                   00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                    00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                              00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                               000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                            0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                            00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                            0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                     00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                      000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                 000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                   000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                               000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                              000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                      000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe[4100] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                     000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                     00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                   00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                    00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                              00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                               000000007770ef8d 1 byte [62]
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                            0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                            00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                            0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                     00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                      000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                 000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                   000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                               000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Apoint2K\Apntex.exe[4156] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                              000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Windows\system32\conhost.exe[4172] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                    00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                  00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                   00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                             00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                              000000007770ef8d 1 byte [62]
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                           0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                           00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                           0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                    00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                     000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                  000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                              000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                               000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Apoint2K\HidFind.exe[4204] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                             000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                              00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                            00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                             00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                       00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                        000000007770ef8d 1 byte [62]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                     0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                     00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                     0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                              00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                               000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                          000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                            000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                        000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                         000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                       000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                               000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4212] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                              000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                  0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                  0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                 000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                            00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                         00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                         0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                         0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                           00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                              0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                            0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                   0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                           000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                             000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                   00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                               00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                               00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                        0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                  00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[4268] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                   00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                             00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                           00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                            00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                      00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                       000000007770ef8d 1 byte [62]
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                    0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                    00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                    0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                             00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                              000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                         000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                           000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                       000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                        000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE[4552] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                      000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                   00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                 00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                  00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                            00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                             000000007770ef8d 1 byte [62]
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                          0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                          00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                          0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                   00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                    000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                               000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                 000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                             000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                              000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4560] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                            000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                   0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                     0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                     0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                    000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                               00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                            00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                            0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                            0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                              00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                 0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                               0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                   0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                      0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                      00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                  00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                  00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                           0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                              000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                     00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                      00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                             0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe[4796] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                            00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!RegSetValueExW                                                                                                                                 00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!RegQueryValueExW                                                                                                                               00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!RegDeleteValueW                                                                                                                                00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!K32GetMappedFileNameW                                                                                                                          00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                                                                           000000007770ef8d 1 byte [62]
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                                                                                        0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!K32GetModuleInformation                                                                                                                        00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                                                                                        0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNEL32.dll!RegSetValueExA                                                                                                                                 00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                                  000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                             000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                               000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                                           000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                            000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                                          000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                                  000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Dolby PCEE4\pcee4.exe[4840] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                                                 000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                                     0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                                       0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                                       0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                                      000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                 00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                              00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                              0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                              0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                                00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                   0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                                 0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                     0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                        0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                  000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                        00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                                    00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                                    00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                             0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                                       00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                        00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                               0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\Launch Manager\LManager.exe[4884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                              00000000769914bb 2 bytes [99, 76]
.text     ...

Aprofon · 27.05.2014, 20:41

Code:

ATTFilter

                                                                                                                                                                                                * 2
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                                    0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                                      0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                                      0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                                     000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                00000000764aa2fd 1 byte [62]
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                             00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                             0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                             0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                               00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                  0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                                0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                    0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                       0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                       00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                                   00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                                   00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                            0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                               000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                 000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                                      00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                       00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 69                                                                                              0000000076991465 2 bytes [99, 76]
.text     C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe[4896] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 155                                                                                             00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                     0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                       0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                       0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                      000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                 00000000764aa2fd 1 byte [62]
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                              00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                              0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                              0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                        00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                    00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                    00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                             0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE[4904] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                  000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                               0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                 0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                 0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                           00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                        00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                        0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                        0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                          00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                             0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                           0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                               0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                  0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                          000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                            000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                  00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                              00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                              00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                       0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                 00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe[4960] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                  0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                    0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                    0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                   000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                              00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                           00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                           0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                           0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                             00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                              0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                  0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                     0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                     00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                 00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                 00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                          0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                             000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                               000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                    00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                     00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                            0000000076991465 2 bytes [99, 76]
.text     C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe[4988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                           00000000769914bb 2 bytes [99, 76]
.text     ...                                                                                                                                                                                                            * 2
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                       00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                     00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                      00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                 000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                              0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                              00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                              0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                       00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                        000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                   000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                     000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                 000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                  000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                        000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe[5032] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                       000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Programme und Spiele\Avast Free Antivirus\avastui.exe[5040] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                    0000000076488791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text     C:\Programme und Spiele\Avast Free Antivirus\avastui.exe[5040] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                           00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                                     0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                                       0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                                       0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                                      000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                 00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                              00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                              0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                              0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                                00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                   0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                                 0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                     0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                        0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                        00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                                    00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                                    00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                             0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                  000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                                       00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\Launch Manager\LMworker.exe[4384] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                        00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Windows\system32\igfxext.exe[4012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\igfxsrvc.exe[4744] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                   000000007770ef8d 1 byte [62]
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                                                  0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                              00000000764aa2fd 1 byte [62]
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                                           00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                                           0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                                           0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                                             00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                                0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                                              0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                                  0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                                     0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                                     00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                                                 00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                                                 00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                          0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                             000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                               000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                                                    00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Programme\lg_fwupdate\fwupdate.exe[4940] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                     00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Programme und Spiele\CyberLink\PowerDVD10\PowerDVD10\PDVD10Serv.exe[4644] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                             00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                                  0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                                    0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                                    0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                                   000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                              00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                           00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                           0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                           0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                             00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                              0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                  0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                     0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                     00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                                 00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                                 00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                          0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                             000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                               000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                                    00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\CyberLink\Shared files\brs.exe[4656] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                     00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                             0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                               0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                               0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                              000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                         00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                      00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                      0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                      0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                        00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                           0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                         0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                             0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                        000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                          000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                            00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                            00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                     0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                               00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE[4984] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                                  00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                                00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                                 00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                                           00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                            000000007770ef8d 1 byte [62]
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                                         0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                                         00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                                         0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                                  00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                                   000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                              000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                                000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                                            000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                             000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                                           000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                                   000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Windows\splwow64.exe[4176] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                                                  000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                    00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                  00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                   00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                             00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                              000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                           0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                           00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                           0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                    00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                     000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                  000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                              000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                     000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                                    000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                               000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Windows\system32\wbem\unsecapp.exe[5252] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                             000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                             00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                           00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                            00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                      00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                       000000007770ef8d 1 byte [62]
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                    0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                    00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                    0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                             00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                              000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                         000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                           000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                       000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                        000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe[5396] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                      000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3524] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                00000000764aa2fd 1 byte [62]
.text     C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe[4060] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                               000000007770ef8d 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3792] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                     00000000764aa2fd 1 byte [62]
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW                                                                          0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW                                                                            0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                                                            0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW                                                                           000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                      00000000764aa2fd 1 byte [62]
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                                                   00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                                                   0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                                                   0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                                                     00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                        0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                      0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                          0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                             0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                     000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                       000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                             00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                         00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                         00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                  0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                            00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe[4524] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                             00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW                                                                       0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW                                                                         0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                                                         0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW                                                                        000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                   00000000764aa2fd 1 byte [62]
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                                                00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                                                0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                                                0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                                                  00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                     0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                   0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                       0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                          0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                  000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                    000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                          00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                      00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                      00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                               0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                         00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe[4528] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                          00000000765e9d0b 5 bytes JMP 000000017116121c
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6020] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                     00000000764aa2fd 1 byte [62]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[2636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                 000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                                                                                          00000000776ba400 7 bytes JMP 000000016fff0260
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                                                                                        00000000776c3f20 5 bytes JMP 000000016fff01b8
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                                                                                         00000000776dffb0 5 bytes JMP 000000016fff01f0
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                                                                                   00000000776ef2e0 5 bytes JMP 000000016fff0148
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                    000000007770ef8d 1 byte [62]
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                                                                                 0000000077719a30 7 bytes JMP 000000016fff00d8
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                                                                                 00000000777294c0 5 bytes JMP 000000016fff0180
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                                                                                 0000000077729630 5 bytes JMP 000000016fff0110
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                                                                          00000000777487e0 7 bytes JMP 000000016fff0228
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                                                           000007fefda02db0 5 bytes JMP 000007fffd9f0180
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                                                                      000007fefda037d0 7 bytes JMP 000007fffd9f00d8
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                                                        000007fefda08ef0 6 bytes JMP 000007fffd9f0148
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                                                    000007fefda1af60 5 bytes JMP 000007fffd9f0110
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                                     000007fefeab89e0 8 bytes JMP 000007fffd9f01f0
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                                   000007fefeabbe40 8 bytes JMP 000007fffd9f01b8
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                                                                           000007feff9f7490 11 bytes JMP 000007fffd9f0228
.text     C:\Windows\system32\taskeng.exe[3580] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                                                                          000007feffa0bf00 7 bytes JMP 000007fffd9f0260
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                                                                  0000000076481f0e 7 bytes JMP 0000000171161695
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                                                                    0000000076485bad 7 bytes JMP 00000001711611a9
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                                                                    0000000076491409 7 bytes JMP 000000017116128a
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                                                                   000000007649ea45 7 bytes JMP 0000000171161244
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                              00000000764aa2fd 1 byte [62]
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                                                           00000000764ab21b 5 bytes JMP 00000001711615aa
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                                                           0000000076528e24 7 bytes JMP 0000000171161339
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                                                           0000000076528ea9 5 bytes JMP 00000001711616d6
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                                                             00000000765291ff 5 bytes JMP 000000017116170d
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                                                                0000000076e31d29 5 bytes JMP 00000001711611c2
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                                                              0000000076e31dd7 5 bytes JMP 0000000171161014
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                                  0000000076e32ab1 5 bytes JMP 0000000171161555
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                                                                     0000000076e32d17 5 bytes JMP 0000000171161271
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                                                             000000007640e96b 5 bytes JMP 00000001711615c3
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                                               000000007640eba5 5 bytes JMP 0000000171161186
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                                                                     00000000775c8a29 5 bytes JMP 0000000171161726
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                                                                 00000000775d4572 5 bytes JMP 00000001711610a0
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                                                                 00000000775ee567 5 bytes JMP 0000000171161415
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                                                                          0000000077627a5c 5 bytes JMP 00000001711615d2
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                                                                    00000000765b5ea5 5 bytes JMP 00000001711615fa
.text     C:\Users\MF\Desktop\Gmer-19357(1).exe[5248] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                                                                     00000000765e9d0b 5 bytes JMP 000000017116121c
---- Processes - GMER 2.1 ----

Library   C:\Users\MF\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe [4896](2014-01-03 03:42:50)                                                0000000003bf0000
Library   c:\users\mf\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplc6xaq.dll (*** suspicious ***) @ C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe [4896](2014-05-27 12:15:09)  00000000044f0000
Library   C:\Users\MF\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe [4896](2013-10-18 23:55:02)                                                      00000000698e0000
Library   C:\Users\MF\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe [4896] (ICU Data DLL/The ICU Project)(2013-10-18 23:55:00)                        0000000068f50000
Process   C:\Programme\lg_fwupdate\fwupdate.exe (*** suspicious ***) @ C:\Programme\lg_fwupdate\fwupdate.exe [4940] (BL)(2014-01-03 13:46:41)                                                                            0000000000400000

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\9cb70df7e825                                                                                                                                    
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\9cb70df7e825 (not active ControlSet)                                                                                                                

---- EOF - GMER 2.1 ----

cosinus · 27.05.2014, 20:50

Ich seh da keine Rootkits.

Bezugnehmen auf deine Überschrift:

Zitat:

Rootkit durch Avast Internet Security blockiert und in Virus Container verschoben

Sollte man verstehen, dass Avast eins gefunden hat. Wo denn bitte?

Aprofon · 27.05.2014, 21:43

Naja das Ding is, Avast hatte gemeldet, dass ein Rootkit gefunden wurde, den dann in Quarantäne verschoben und aus der Quarantäne hab ich den dann gelöscht. Ein Log zu der Meldung hab ich leider nich gefunden. Ich hatte halt daraufhin wie oben beschrieben gescannt und dabei hat er diesen Win32:Adware-gen gefunden. Dann noch der Eset Scan bei dem halt die 7 infizierten Objekte gefunden wurden. Da dachte ich dass doch Rootkits irgendwo in meinem System ne Backdoor ausnutzen oder erzeugen um Schadsoftware für den Urheber nachzuladen oder irre ich? Daher dachte ich, dass zwar Avast nüscht mehr findet, ich aber immernoch nen Rootkit hab der fröhlich Viren nachlädt. Mach halt auch Bankgeschäfte über mein Laptop daher war ich verunsichert und Rootkits sollen ja schwer zu finden sein.
Hoffe das war jetzt nicht zu konfus ^^

Wenn ich mich recht entsinne war der Rootkit übrigens im Temp Ordner von Firefox, falls dir das irgendwie bei meinem Kauderwelsch weiterhilft

zu den Funden nochmal:
Avast hatte halt einmal diesen Rootkit (ich weiß leider echt nich mehr wie der hieß) blockiert
dann noch Win32:Adware-gen [Adw] bei der Startzeitprüfung
Eset hatte die 7 Sachen hier bemängelt:

Code:

ATTFilter

sh=6525F85F423A8ACB9DE261FCE7C1BFDCAF0651EC ft=1 fh=e751b5239200023c vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Downloads\ccsetup404.exe"
sh=6585F3BCD797EFC2F81599CDE50115668B677D52 ft=1 fh=c4c5afd1d69feff3 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Downloads\ccsetup408.exe"
sh=0F97FB08E6FC4500F86E64D3285C171C6462BD61 ft=1 fh=acbbffe185c36761 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Downloads\ccsetup410.exe"
sh=8193728637D16FEDD8E5809E6A5F177DEAE87145 ft=1 fh=8b9917ca3e69a6ac vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Downloads\SweetHome3D-4.3-windows-oc.exe"
sh=91F440A8F2A0FFC91EDA87FE5410B93141B1C6B0 ft=1 fh=1ce5d7cf83504dfe vn="Win32/Toolbar.Conduit.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Users\MF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\32E97684\checktbexist[1].exe"
sh=F89D0D35647789000A23E8BD1E557BEE519A6BAE ft=1 fh=4f81c51847428f3f vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\MF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MR7LI113\statisticsstub[1].exe"
sh=4C265AAF9AE88D06269ADD7034D63A115606DDFA ft=1 fh=3189627c07c08170 vn="Win32/Toolbar.Conduit.S evtl. unerwünschte Anwendung" ac=I fn="C:\Users\MF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MR7LI113\stublogic[1].exe"

Übrigens weiß ich nicht ob das damit im Zusammenhang steht:
Als ich nach der 2. Startzeitprüfung das netzwerkkabel wieder anschloss ploppte im selben moment die Meldung auf, dass die "Windows Media Network Sharing Service Configuration Application" (wmpnscfg.exe) nicht mehr funktionstüchtig sei. Ich dachte nich dass das was damit zu tun hat, bin aber nu echt kein Fachmann.

verzeih bitte sollte, dass jetz ein nutzloser Doppelpost sein

cosinus · 27.05.2014, 21:48

Zitat:

Wenn ich mich recht entsinne war der Rootkit übrigens im Temp Ordner von Firefox, falls dir das irgendwie bei meinem Kauderwelsch weiterhilft

Kommst du an das Log noch ran? Sollte unter C:\ProgramData\AVAST Software\Avast\log zu finden sein

Aprofon · 28.05.2014, 10:47

In dem Ordner sind bestimmt 20 Logs mit lauter kryyptischen Zeichen.

Hab jetz aus dem EventLog (schien mir am sinnvollsten) mal alles seit dem 26.05 rauskopiert

Code:

ATTFilter

26.05.2014	02:23:47	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
26.05.2014	02:23:47	[0000106C] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
26.05.2014	02:23:47	[0000106C] WaitForWscService( 300000 ) -> false
26.05.2014	02:23:47	[0000106C] WriteAVASFirewallStatus - WSC service is not running
26.05.2014	02:23:47	[0000106C] RegisterAVASFirewall preVista 0 pszProductName avast! Antivirus pszProductExe C:\Programme und Spiele\Avast Free Antivirus\VisthAux.exe firewall 1
26.05.2014	02:23:47	[0000106C] WaitForWscService( 300000 ) -> false
26.05.2014	02:23:47	[0000106C] RegisterAVASFirewall - WSC service is not running
26.05.2014	19:52:45	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
26.05.2014	19:52:45	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
26.05.2014	19:52:45	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 2, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
26.05.2014	19:52:45	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
26.05.2014	19:52:45	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
26.05.2014	19:52:45	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
26.05.2014	19:52:45	[00000C04] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
26.05.2014	19:52:55	AAVM - error at Rpc_VpnLicenseInfoUpdated: 000006A6.
26.05.2014	19:52:55	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
26.05.2014	19:52:55	AAVM - error at Rpc_VpnServerRefreshCallback: 000006A6.
26.05.2014	19:52:55	AAVM - error at Rpc_VpnConnectionStateChangedCallback: 000006A6.
26.05.2014	19:52:55	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
26.05.2014	19:53:13	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
26.05.2014	19:53:14	The virus definitions have been automatically updated to version 140526-3.
26.05.2014	19:53:18	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
26.05.2014	19:53:18	[000011BC] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
26.05.2014	19:54:56	[00000C04] WaitForWscService( 346 ) -> true
26.05.2014	19:54:56	[00000C04] Antivirus state 0 updatedSign 1 
26.05.2014	19:54:56	[00000C04] Antispyware state 0 updatedSign 1 
26.05.2014	19:54:56	[00000C04] Firewall enabled 1
26.05.2014	19:54:56	[000011BC] WaitForWscService( 408 ) -> true
26.05.2014	19:54:56	[000011BC] Antivirus state 0 updatedSign 1 
26.05.2014	19:54:56	[000011BC] Antispyware state 0 updatedSign 1 
26.05.2014	19:54:56	[000011BC] Firewall enabled 1
26.05.2014	23:14:21	AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of hxxp://www.youtube.com/watch?v=-Yj3RSxZmBQ&index=2&list=PL6F6EF1FBA7C72E4A failed, 0000A476.
26.05.2014	23:14:21	AAVM - scanning warning: x_AavmCheckFileDirectEx: hxxp://www.youtube.com/watch?v=-Yj3RSxZmBQ&index=2&list=PL6F6EF1FBA7C72E4A (C:\Windows\TEMP\_avast_\ws2294.dat) returning error, 0000A476.
26.05.2014	23:19:53	AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of hxxp://www.youtube.com/watch?v=x5tQQ3hqleE&list=PLgfflnKfhZ9HOpwj1UynaH1lJAEvg6suy&index=5 failed, 0000A476.
26.05.2014	23:19:53	AAVM - scanning warning: x_AavmCheckFileDirectEx: hxxp://www.youtube.com/watch?v=x5tQQ3hqleE&list=PLgfflnKfhZ9HOpwj1UynaH1lJAEvg6suy&index=5 (C:\Windows\TEMP\_avast_\ws2414.dat) returning error, 0000A476.
26.05.2014	23:20:21	AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of hxxp://www.youtube.com/watch?v=LqNuKGkY7L8&list=PLgfflnKfhZ9HOpwj1UynaH1lJAEvg6suy&index=15 failed, 0000A476.
26.05.2014	23:20:21	AAVM - scanning warning: x_AavmCheckFileDirectEx: hxxp://www.youtube.com/watch?v=LqNuKGkY7L8&list=PLgfflnKfhZ9HOpwj1UynaH1lJAEvg6suy&index=15 (C:\Windows\TEMP\_avast_\ws2414.dat) returning error, 0000A476.
26.05.2014	23:20:27	AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of hxxp://www.youtube.com/watch?v=uSGzydGcSPk&index=16&list=PLgfflnKfhZ9HOpwj1UynaH1lJAEvg6suy failed, 0000A476.
26.05.2014	23:20:27	AAVM - scanning warning: x_AavmCheckFileDirectEx: hxxp://www.youtube.com/watch?v=uSGzydGcSPk&index=16&list=PLgfflnKfhZ9HOpwj1UynaH1lJAEvg6suy (C:\Windows\TEMP\_avast_\ws2414.dat) returning error, 0000A476.
27.05.2014	01:27:03	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	01:27:03	[00001698] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	01:27:03	[00001698] WaitForWscService( 300000 ) -> false
27.05.2014	01:27:03	[00001698] WriteAVASFirewallStatus - WSC service is not running
27.05.2014	01:27:03	[00001698] RegisterAVASFirewall preVista 0 pszProductName avast! Antivirus pszProductExe C:\Programme und Spiele\Avast Free Antivirus\VisthAux.exe firewall 1
27.05.2014	01:27:03	[00001698] WaitForWscService( 300000 ) -> false
27.05.2014	01:27:03	[00001698] RegisterAVASFirewall - WSC service is not running
27.05.2014	09:41:30	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	09:41:32	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	09:41:33	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 2, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	09:41:33	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	09:41:34	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	09:41:34	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	09:41:34	[00000670] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	09:41:34	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	09:41:57	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
27.05.2014	09:41:57	AAVM - error at Rpc_VpnErrorOccurredCallback: 000006A6.
27.05.2014	09:41:57	AAVM - error at Rpc_VpnConnectionStateChangedCallback: 000006A6.
27.05.2014	09:41:57	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
27.05.2014	09:43:58	[00000670] WaitForWscService( 320 ) -> true
27.05.2014	09:43:58	[00000670] Antivirus state 0 updatedSign 1 
27.05.2014	09:43:58	[00000670] Antispyware state 0 updatedSign 1 
27.05.2014	09:43:58	[00000670] Firewall enabled 1
27.05.2014	10:34:17	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	10:34:17	[00000504] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	10:34:17	[00000504] WaitForWscService( 300000 ) -> false
27.05.2014	10:34:17	[00000504] WriteAVASFirewallStatus - WSC service is not running
27.05.2014	10:34:17	[00000504] RegisterAVASFirewall preVista 0 pszProductName avast! Antivirus pszProductExe C:\Programme und Spiele\Avast Free Antivirus\VisthAux.exe firewall 1
27.05.2014	10:34:17	[00000504] WaitForWscService( 300000 ) -> false
27.05.2014	10:34:17	[00000504] RegisterAVASFirewall - WSC service is not running
27.05.2014	12:22:34	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	12:22:35	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	12:22:36	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 2, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	12:22:36	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	12:22:36	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	12:22:36	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	12:22:36	[0000080C] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	12:22:37	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	12:23:03	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
27.05.2014	12:23:03	AAVM - error at Rpc_VpnErrorOccurredCallback: 000006A6.
27.05.2014	12:23:03	AAVM - error at Rpc_VpnConnectionStateChangedCallback: 000006A6.
27.05.2014	12:23:03	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
27.05.2014	12:25:03	[0000080C] WaitForWscService( 315 ) -> true
27.05.2014	12:25:03	[0000080C] Antivirus state 0 updatedSign 1 
27.05.2014	12:25:03	[0000080C] Antispyware state 0 updatedSign 1 
27.05.2014	12:25:03	[0000080C] Firewall enabled 1
27.05.2014	13:38:10	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	13:38:10	The virus definitions have been automatically updated to version 140527-0.
27.05.2014	13:38:15	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	13:38:15	[000016C0] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	13:38:15	[000016C0] WaitForWscService( 600 ) -> true
27.05.2014	13:38:15	[000016C0] Antivirus state 0 updatedSign 1 
27.05.2014	13:38:15	[000016C0] Antispyware state 0 updatedSign 1 
27.05.2014	13:38:15	[000016C0] Firewall enabled 1
27.05.2014	14:14:07	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	14:14:08	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	14:14:08	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 2, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	14:14:08	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	14:14:08	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	14:14:08	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	14:14:08	[00000BD4] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	14:16:19	[00000BD4] WaitForWscService( 340 ) -> true
27.05.2014	14:16:19	[00000BD4] Antivirus state 0 updatedSign 1 
27.05.2014	14:16:19	[00000BD4] Antispyware state 0 updatedSign 1 
27.05.2014	14:16:19	[00000BD4] Firewall enabled 1
27.05.2014	18:06:03	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:06:03	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	18:06:03	[000013E0] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	18:06:03	[000013E0] WaitForWscService( 600 ) -> true
27.05.2014	18:06:03	[000013E0] Antivirus state 0 updatedSign 1 
27.05.2014	18:06:03	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:06:03	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	18:06:03	[000013E0] Antispyware state 0 updatedSign 1 
27.05.2014	18:06:03	[00000D78] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	18:06:03	[00000D78] WaitForWscService( 600 ) -> true
27.05.2014	18:06:03	[00000D78] Antivirus state 2 updatedSign 1 
27.05.2014	18:06:03	[000013E0] Firewall enabled 0
27.05.2014	18:06:03	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:06:03	[00000D78] Antispyware state 2 updatedSign 1 
27.05.2014	18:06:03	[00000D78] Firewall enabled 0
27.05.2014	18:06:03	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:06:03	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 2, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:07:20	An error has occured while attempting to update. Please check the logs.
27.05.2014	18:21:13	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:21:13	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 2, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:21:13	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	18:21:13	[000007CC] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	18:21:13	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:21:13	[000007CC] WaitForWscService( 600 ) -> true
27.05.2014	18:21:13	[000007CC] Antivirus state 0 updatedSign 1 
27.05.2014	18:21:13	[000007CC] Antispyware state 0 updatedSign 1 
27.05.2014	18:21:13	[000007CC] Firewall enabled 1
27.05.2014	18:21:13	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	18:21:13	[0000170C] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	18:21:13	[0000170C] WaitForWscService( 600 ) -> true
27.05.2014	18:21:13	[0000170C] Antivirus state 0 updatedSign 1 
27.05.2014	18:21:13	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:21:13	[0000170C] Antispyware state 0 updatedSign 1 
27.05.2014	18:21:13	[0000170C] Firewall enabled 1
27.05.2014	18:21:13	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	18:21:14	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
27.05.2014	22:45:40	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
27.05.2014	22:45:40	[0000088C] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
27.05.2014	22:45:40	[0000088C] WaitForWscService( 300000 ) -> false
27.05.2014	22:45:40	[0000088C] WriteAVASFirewallStatus - WSC service is not running
27.05.2014	22:45:40	[0000088C] RegisterAVASFirewall preVista 0 pszProductName avast! Antivirus pszProductExe C:\Programme und Spiele\Avast Free Antivirus\VisthAux.exe firewall 1
27.05.2014	22:45:40	[0000088C] WaitForWscService( 300000 ) -> false
27.05.2014	22:45:40	[0000088C] RegisterAVASFirewall - WSC service is not running
28.05.2014	11:10:09	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
28.05.2014	11:10:09	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 0, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
28.05.2014	11:10:10	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 2, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
28.05.2014	11:10:11	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 1, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
28.05.2014	11:10:11	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
28.05.2014	11:10:11	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
28.05.2014	11:10:11	[00000B74] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
28.05.2014	11:10:19	AAVM - error at Rpc_VpnLicenseInfoUpdated: 000006A6.
28.05.2014	11:10:19	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
28.05.2014	11:10:19	AAVM - error at Rpc_VpnServerRefreshCallback: 000006A6.
28.05.2014	11:10:19	AAVM - error at Rpc_VpnConnectionStateChangedCallback: 000006A6.
28.05.2014	11:10:19	AAVM - error at Rpc_VpnCurrentStateUpdatedCallback: 000006A6.
28.05.2014	11:10:32	Aavm AUID event 8, product 3,  ARCEn 0, rn , status 0, progver 150996962, Guid afba1aa1-1e2c-4ebe-937b-b65b95ac93e4, Auid T1w5vKKZpzpTiUsP
28.05.2014	11:10:32	The virus definitions have been automatically updated to version 140528-0.
28.05.2014	11:10:35	Maj 6 Min 1 GetVersionEx 6.1 Stored 6.1
28.05.2014	11:10:35	[00000F44] WriteAVASFirewallStatus preVista 0 IsWin8 0 Expired 0 Firewall 1
28.05.2014	11:12:22	[00000F44] WaitForWscService( 393 ) -> true
28.05.2014	11:12:22	[00000F44] Antivirus state 0 updatedSign 1 
28.05.2014	11:12:22	[00000B74] WaitForWscService( 345 ) -> true
28.05.2014	11:12:22	[00000B74] Antivirus state 0 updatedSign 1 
28.05.2014	11:12:22	[00000F44] Antispyware state 0 updatedSign 1 
28.05.2014	11:12:22	[00000F44] Firewall enabled 1
28.05.2014	11:12:22	[00000B74] Antispyware state 0 updatedSign 1 
28.05.2014	11:12:22	[00000B74] Firewall enabled 1

Da is offenbar zumindest der Link des verhängnissvollen Videos drin glaub ich

Welche Logdateien könnten denn noch hilfreich sein
Enthalten sind:
aswAR.log (27.05), aswAR1.log (8.04), aswBoot.log(28.05), Autorenewal.log (24.05), autosandbox.log (19.04), Avast Browser cleanup.log (27.05), avastium.log (27.05), Chest.log (28.05), EventLog.log (28.05), FilterEngine.log (28.05), Firewall.log (27.05), GrimeFigther.log (28.05), HtmlRemoteContent.log (28.05), Mail.log (28.05), PushPin.log (9.05), Resident.log (28.05), SecureLine.log (28.05), selfdef.log (27.05), softwarehealth.log (28.05), SpamEngine.log (28.05), StreamFilter.log (28.05), UITracking.log (28.05), usntr.log (28.05)

Hab in alle mal reingeguckt aber nicht wirklich was gerafft.

cosinus · 28.05.2014, 11:59

Bevor wir hier unzählige Postings haben um das richtige Log zu finden: ausnahmsweise alle darin enthaltenen Log-Dateien in eine Datei zippen und im nächsten Beitrag als Anhang posten.

Aprofon · 28.05.2014, 20:50

Oh mein Gott sorry. Ich hab jetzt den ganzen Tag auf eine Antwort gewartet, die schon lange da war. Ich hab gar nicht mitgekrigt, dass die auf der nächsten Seite stand. Entschuldige bitte tausendmal.
Zu den Logfiles muss ich sagen, dass sich 3 nicht packen ließen, weil gerade verwendet. Hab dann deren Inhalt 1 zu 1 in Textdateien kopiert. (avastium.txt, selfdef.txt und softwarehealth.txt)

cosinus · 28.05.2014, 21:28

Auch damit komm ich nicht weiter. Seh da keinen Zusammenhang mit einem Rootkit. Du hast wenn überhaupt nur Adware/Junkware drauf

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Aprofon · 28.05.2014, 21:54

Also hier AdwCleaner:

Code:

ATTFilter

# AdwCleaner v3.211 - Bericht erstellt am 28/05/2014 um 22:34:36
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : MF - MF-PC
# Gestartet von : C:\Users\MF\Desktop\adwcleaner_3.211.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\MF\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\MF\AppData\Local\Software
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Users\MF\AppData\Local\Temp\Uninstall.exe

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software
Schlüssel Gelöscht : HKLM\Software\PIP

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v14.0.1 (de)

[ Datei : C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [1191 octets] - [28/05/2014 22:33:04]
AdwCleaner[S0].txt - [1062 octets] - [28/05/2014 22:34:36]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1122 octets] ##########

dann JRT:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by MF on 28.05.2014 at 22:40:44,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.05.2014 at 22:48:45,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by MF (administrator) on MF-PC on 28-05-2014 22:51:26
Running from C:\Users\MF\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Programme und Spiele\Avast Free Antivirus\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Atheros) C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Apoint.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHJE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHJE.EXE
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApMsgFwd.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\Hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint2K\ApntEx.exe
(Dolby Laboratories Inc.) C:\Dolby PCEE4\pcee4.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(AVAST Software) C:\Programme und Spiele\Avast Free Antivirus\avastui.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dropbox, Inc.) C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Microsoft Corporation) C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(BL) C:\Program Files\lg_fwupdate\fwupdate.exe
(CyberLink Corp.) C:\Programme und Spiele\CyberLink\PowerDVD10\PowerDVD10\PDVD10Serv.exe
(cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuBrowserIEAgent.exe
() C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuEmailOutlookAgent.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\PmmUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec IPS\EgisUpdate.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Programme und Spiele\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [InstantUpdate] => C:\Program Files\Acer\Acer Instant Service\InstantUpdate\iuDaemon.exe [124520 2012-04-07] ()
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12448872 2012-02-14] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-02-08] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint2K\Apoint.exe [576376 2012-02-02] (Alps Electric Co., Ltd.)
HKLM\...\Run: [AtherosBtStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [1021056 2012-03-08] (Atheros Communications)
HKLM\...\Run: [AthBtTray] => C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [800896 2012-03-08] (Atheros Commnucations)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [Power Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1829768 2012-02-07] (Acer Incorporated)
HKLM\...\Run: [OOTag] => C:\Program Files (x86)\Acer\OOBEOffer\ootag.exe [13856 2010-02-23] (Microsoft)
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap64.dll [1100248 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [SuiteTray] => C:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe [341360 2011-09-20] (Egis Technology Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe [296984 2012-01-05] (NTI Corporation)
HKLM-x32\...\Run: [OOTag] => C:\Program Files (x86)\Acer\OOBEOffer\OOTag.exe [13856 2010-02-23] (Microsoft)
HKLM-x32\...\Run: [Dolby Home Theater v4] => C:\Dolby PCEE4\pcee4.exe [506712 2011-06-01] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1105488 2012-03-23] (Dritek System Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-26] (Intel Corporation)
HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-08-30] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Programme und Spiele\Avast Free Antivirus\AvastUI.exe [3888648 2014-05-24] (AVAST Software)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Programme\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [UCam_Menu] => C:\Programme\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM-x32\...\Run: [LGODDFU] => C:\Programme\lg_fwupdate\fwupdate.exe [548864 2008-09-19] (BL)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RemoteControl10] => C:\Programme und Spiele\CyberLink\PowerDVD10\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [78352 2012-08-27] (cyberlink)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\.DEFAULT\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\.DEFAULT\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-19\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-20\...\RunOnce: [IsMyWinLockerReboot] - msiexec.exe /qn /x{voidguid}
HKU\S-1-5-21-2216525888-2451706074-2587650537-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2216525888-2451706074-2587650537-1001\...\Run: [EPLTarget\P0000000000000001] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIHJE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2216525888-2451706074-2587650537-1001\...\MountPoints2: {8076a067-72d8-11e3-9359-e840f2c7d8a0} - E:\Autorun.exe
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-11-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-11-14] (NVIDIA Corporation)
Startup: C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\MF\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Programme und SpieleMicrosoft Office 2010\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme und Spiele\Avast Free Antivirus\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme und Spiele\Avast Free Antivirus\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme und SpieleMicrosoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 134.109.102.132 134.109.102.133

FireFox:
========
FF ProfilePath: C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default
FF Homepage: https://www.facebook.com/?stype=lo&jlou=AffGtzAocKKX7RTe1BEQPUVxyl_odxtAlwF5_IUDe8Fe5E9RCcYod29C-G5Dl6IWjHkJUfNtHxyPdYasoOI0bNbkfjzrN2JJS_Yljc2GrGcURg&smuh=12611&lh=Ac9pyUxCdFnKRq-p|hxxp://www.amazon.de/Ubisoft-Watch-Dogs/dp/B00BJMAO2W/ref=sr_1_2_title_0?s=videogames&ie=UTF8&qid=1395316174&sr=1-2&keywords=watch+dogs|hxxp://www.nexusmods.com/skyrim/mods/23355/?|hxxp://www.nexusmods.com/skyrim/mods/16374/?|https://navigator.web.de/logout?sid=6c1ca97b2d6777b7ffaa358945c169914aae9939e0971b29274d980fc5f7222341da5441be3fae30fb82b03c1d5ff8b2|hxxp://www.medical-engineering.cc/downloads/downloads1semester/20140128-MKG_AnatomiePhysiologieKopfHals_1623012014-1sem.pdf|hxxp://onepiece-tube.tv/folge/637|hxxp://de.wikipedia.org/wiki/Komplexe_Zahl|https://www.paket.de/pkp/appmanager/pkp/desktop?_nfpb=true&_portlet.async=false&_pageLabel=pkp_portal_page_introduction|hxxp://www.myvideo.de/watch/4014533/Mark_Medlock_Summer_Love|hxxp://www.youtube.com/watch?v=cJ6H0InlpY0|hxxp://onepiece.wikia.com/wiki/Episode_Special_1|hxxp://answers.yahoo.com/question/index?qid=20121006015526AAg9lrP|hxxp://onepiece-tube.tv/movie11|hxxp://www.mathepedia.de/Gram-Schmidtsches_Orthogonalisierungsverfahren.aspx|hxxp://www.mathematik.net/Polynomdivision/py03s8.htm|hxxp://www.tu-chemnitz.de/mathematik/inverse_probleme/Uebungsmaterialien/HATRAFO.pdf|hxxp://www.jobisjob.de/chemnitz/jobs/l#where=chemnitz&jobType=Praktikum|hxxp://voith.com/de/maerkte-branchen/branchen/maschinenbau-215.html|hxxp://voith.com/de/130408_leaflet_student_guide_web.pdf|hxxp://3d-micromac.de/Praktika.html|hxxp://statistik.wu-wien.ac.at/~leydold/MOK/HTML/node77.html|hxxp://www.youtube.com/results?search_query=eigth+days+a+week&sm=12|hxxp://www.onvista.de/analysen/analyzer/isin/DE000VTG9999?zeitraum=1-monat#chart|https://wtc.tu-chemnitz.de/shibboleth/WAYF?shire=https%3A%2F%2Fwww.csn.tu-chemnitz.de%2FShibboleth.sso%2FSAML%2FPOST&time=1395310120&target=https%3A%2F%2Fwww.csn.tu-chemnitz.de%2Fsecure%2Fuser%2F4329&providerId=https%3A%2F%2Fwww.csn.tu-chemnitz.de%2Fshibboleth#traffic|hxxp://www.vbb.de/de/article/fahrpreise/haeufige-fragen/19773.html|hxxp://www.onvista.de/analysen/analyzer/isin/NL0000235190|hxxp://www.onvista.de/analysen/analyzer/isin/DE000A1EWWW0|hxxp://www.onvista.de/analysen/analyzer/isin/DE0005875306|hxxp://de.wikipedia.org/wiki/Immunglobulin|hxxp://www.youtube.com/watch?v=p-o5-DDXxkw&list=PLD2A1BEDEC2B6AB34|hxxp://de.wikipedia.org/wiki/Augenfarbe|hxxp://www.youtube.com/watch?v=PDMhZPYX_Ig|hxxp://de.wikipedia.org/wiki/Prothese|hxxp://www.detektiv-conan.ch/index.php?page=episodes/episodes_jp.php|hxxp://conanwiki.org/wiki/Liste_der_Anime-Episoden/Episode_501_bis_600|hxxp://www.myvideo.de/Top_100/Top_100_Single_Charts|hxxp://www.youtube.com/watch?v=h0gpPs4flw8|hxxp://www.youtube.com/watch?v=D4ZTRhgqsS8|hxxp://24hoursofhappiness.com/|hxxp://www.youtube.com/watch?v=T04aBOxN9AA&list=RDVH_vAfMBy5I|https://www.tu-chemnitz.de/verwaltung/studentenamt/abt12/termine.php|hxxp://goessner.net/download/learn/tm/statik/Statikformeln.pdf|hxxp://dietanzfabrik.de/|hxxp://www.koehler-schimmel.de/|hxxp://www.tu-chemnitz.de/mb/TMD/studium/bachelor/bachelor.php|hxxp://www.tu-chemnitz.de/mb/FestKoerpMech/Lehre_und_Studium/LV_Uebersicht.php|hxxp://www.tu-chemnitz.de/mb/FestKoerpMech/Lehre_und_Studium/LV_Seite.php?LV_ID=1&ln=|https://wtc.tu-chemnitz.de/shibboleth/WAYF?shire=https%3A%2F%2Fwww.tu-chemnitz.de%2FShibboleth.sso%2FSAML%2FPOST&time=1393838632&target=https%3A%2F%2Fwww.tu-chemnitz.de%2Fmb%2FFKM_Daten%2FFKM_Lehrveranstaltungen%2FFKM_Technische_Mechanik_I%2FDownloads%2FProbeklausur_TMI_4.pdf&providerId=https%3A%2F%2Fwww.tu-chemnitz.de%2Fshibboleth|hxxp://www.maschinenbau-wissen.de/skript/mechanik/statik/60-aufgaben-schnittreaktionen|hxxp://de.wikipedia.org/wiki/Schwarzes_Loch#Supermassereiche_Schwarze_L.C3.B6cher|hxxp://www.welt.de/wissenschaft/weltraum/article121231150/Das-grosse-Fressen-am-Schwarzen-Loch.html|hxxp://www.wsj.de/article/SB10001424052702304026804579410742963186828.html?mod=WeltFeed#slide/eos|hxxp://www.youtube.com/watch?v=aZfgd4TMsHI|hxxp://www.youtube.com/watch?v=TOjZ54pdbfI|hxxp://reiseauskunft.bahn.de/bin/query2.exe/dn?ld=96235&seqnr=1&ident=l7.031194235.1393861855&rt=1&rememberSortType=minArrival&HWAI=JS!ajax=yes!&HWAI=CONNECTION$C0-1!id=C0-1!HwaiConId=C0-1!HwaiDetailStatus=details!;~CONNECTION$C0-1!HwaiMapStatus=UNDEFINED!HwaiMapNumber=UNDEFINED!HwaiMapSlider=UNDEFINED!HwaiDetailHimMessage=UNDEFINED!;|hxxp://www.worldofspeed.com/|hxxp://www.chip.de/news/Path-of-Exile-Erstes-Game-Add-On-veroeffentlicht_68377553.html|hxxp://www.gamestar.de/spiele/rollenspiele/genre-261.html#top|hxxp://www.amazon.de/dp/B00BB629SI/ref=asc_df_B00BB629SI17693771/?tag=billigerde-21&creative=22398&creativeASIN=B00BB629SI&linkCode=asn|https://www.pathofexile.com/|hxxp://www.forumla.de/f-pc-spiele-16/t-assassins-creed-1-ruckelt-unertraeglich-195820|https://www.amazon.de/ap/register?_encoding=UTF8&openid.assoc_handle=deflex&openid.claimed_id=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.identity=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0%2Fidentifier_select&openid.mode=checkid_setup&openid.ns=http%3A%2F%2Fspecs.openid.net%2Fauth%2F2.0&openid.ns.pape=http%3A%2F%2Fspecs.openid.net%2Fextensions%2Fpape%2F1.0&openid.pape.max_auth_age=0&openid.return_to=https%3A%2F%2Fwww.amazon.de%2Fgp%2Fyourstore%2Fhome%3Fie%3DUTF8%26ref_%3Dgno_newcust|hxxp://www.youtube.com/watch?v=rH9sBF_cUeo&list=PLE4E153A86374F5BB|hxxp://de.wikipedia.org/wiki/Transatlantisches_Freihandelsabkommen|hxxp://www.amazon.de/CSL-Ausf%C3%BChrung-ergonomisches-Vorbeugung-armschonend/dp/B00HYWZSF4/ref=cm_cr_pr_product_top|hxxp://www.youtube.com/watch?v=rfVxOK4oTSw|hxxp://www.immowelt.de/immobilien/immodetail.aspx?id=27032944|hxxp://hemden-meister.de/Hemdenkonfigurator.htm?websale8=hemdenmeister&tpl=tpl_hemdenkonfigurator.htm&pi=MHLANG|hxxp://hemden-meister.de/SCWARZE-ROSE-Hemd-Halbarm-Uni-Popeline-rost-226208%2f66.htm?websale8=hemdenmeister&pi=SRNOS02827&ci=000004&lft=226208/66/37|hxxp://www.tailorjack.de/masshemden/hemden-konfigurator|hxxp://www.spieletipps.de/pc/morrowind/tipps/9531/1/|hxxp://www.spieletipps.de/pc/morrowind/fragen/id-3219971/|hxxp://mwmap.uesp.net/?centeron=Drulene+Falen%27s+Hut|hxxp://www.uesp.net/wiki/Morrowind:Mudcrab_Pests|hxxp://www.yiya.de/games/morrowind/html/mo_cheats.htm|https://www.tu-chemnitz.de/verwaltung/vlvz/plan/anzeige.php?sg=1732&vm=Kalender|hxxp://mwmap.uesp.net/?centeron=Hla+Oad|hxxp://www.uesp.net/wiki/Morrowind:Vivec_(city)|hxxp://www.spieletipps.de/pc/morrowind/tipps/32094/|hxxp://www.uesp.net/wiki/Morrowind:Arkngthand|hxxp://mwmap.uesp.net/?centeron=Rothan+Ancestral+Tomb|hxxp://www.uesp.net/wiki/Morrowind:House_Redoran#Great_House_Redoran_Ranks|hxxp://www.pcgames.de/|hxxp://praxistipps.chip.de/firefox-sitzungen-speichern-und-verwalten_3564|https://www.tu-chemnitz.de/verwaltung/vlvz/plan/anzeige.php?sg=1732&vm=Kalender|hxxp://www.spieletipps.de/pc/morrowind/fragen/id-1803583/|hxxp://www.uesp.net/wiki/Morrowind:Factions|hxxp://www.uesp.net/wiki/Morrowind:House_Redoran
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1207148.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PR83C6~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PR83C6~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\MF\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Extension: FT DeepDark - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2014-05-24]
FF Extension: FT GraphiteGlow - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{99e34760-2754-11e0-91fa-0800200c9a66} [2014-03-25]
FF Extension: Ghostery - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\firefox@ghostery.com.xpi [2014-03-21]
FF Extension: Webutation - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{15fe27f3-e5ab-2d59-4c5c-dadc7945bdbd}.xpi [2013-04-13]
FF Extension: NoScript - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-03]
FF Extension: Adblock Plus - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-02-11]
FF Extension: BetterPrivacy - C:\Users\MF\AppData\Roaming\Mozilla\Firefox\Profiles\4e0xm2f7.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi [2014-03-21]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Programme und Spiele\Avast Free Antivirus\WebRep\FF
FF Extension: avast! Online Security - C:\Programme und Spiele\Avast Free Antivirus\WebRep\FF [2012-08-10]
FF StartMenuInternet: FIREFOX.EXE - C:\Programme und Spiele\Mozilla Firefox\firefox.exe

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 avast! Antivirus; C:\Programme und Spiele\Avast Free Antivirus\AvastSvc.exe [50344 2014-05-09] (AVAST Software)
R2 avast! Firewall; C:\Programme und Spiele\Avast Free Antivirus\afwServ.exe [109048 2014-05-09] (AVAST Software)
S2 CLKMSVC10_68CF25B3; C:\Programme und Spiele\CyberLink\PowerDVD10\PowerDVD10\NavFilter\kmsvc.exe [243728 2012-08-27] (CyberLink)
S3 DCDhcpService; C:\Program Files (x86)\Acer\WDAgent\DCDhcpService.exe [111776 2012-02-10] (Atheros Communication Inc.)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256536 2012-01-05] (NTI Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-07-02] ()
S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)
R2 ZAtheros Wlan Agent; C:\Program Files (x86)\Atheros\Ath_WlanAgent.exe [72864 2012-02-19] (Atheros)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-09] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-04] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-09] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-12] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-09] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-09] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-12] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-12] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-12] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-09] ()
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-02-02] ()
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-01-01] (Disc Soft Ltd)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-02-02] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-28 22:51 - 2014-05-28 22:51 - 00027272 _____ () C:\Users\MF\Desktop\FRST.txt
2014-05-28 22:48 - 2014-05-28 22:48 - 00000622 _____ () C:\Users\MF\Desktop\JRT.txt
2014-05-28 22:40 - 2014-05-28 22:40 - 00000000 ____D () C:\Windows\ERUNT
2014-05-28 22:39 - 2014-05-28 22:39 - 01016261 _____ (Thisisu) C:\Users\MF\Desktop\JRT.exe
2014-05-28 22:33 - 2014-05-28 22:34 - 00000000 ____D () C:\AdwCleaner
2014-05-28 22:31 - 2014-05-28 22:31 - 01327971 _____ () C:\Users\MF\Desktop\adwcleaner_3.211.exe
2014-05-27 21:38 - 2014-05-28 22:51 - 00000000 ____D () C:\Users\MF\Desktop\Virencleaning
2014-05-27 17:55 - 2014-05-28 22:51 - 00000000 ____D () C:\FRST
2014-05-27 17:54 - 2014-05-27 17:54 - 02066944 _____ (Farbar) C:\Users\MF\Desktop\FRST64.exe
2014-05-27 17:53 - 2014-05-27 17:53 - 00000000 _____ () C:\Users\MF\defogger_reenable
2014-05-27 14:26 - 2014-05-27 14:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-27 14:13 - 2014-05-27 14:14 - 00287160 _____ () C:\Windows\Minidump\052714-89606-01.dmp
2014-05-27 14:13 - 2014-05-27 14:13 - 00000000 ____D () C:\Windows\Minidump
2014-05-27 14:12 - 2014-05-27 14:12 - 734986024 _____ () C:\Windows\MEMORY.DMP
2014-05-14 13:08 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-14 13:08 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-14 13:08 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-14 13:08 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-14 13:08 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-14 13:08 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-14 13:01 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-14 13:01 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-14 13:01 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-14 13:01 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-14 13:01 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-14 13:01 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-14 13:01 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-14 13:01 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-14 13:01 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-14 13:01 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-14 13:00 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-14 13:00 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-14 13:00 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-14 13:00 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-14 13:00 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-14 13:00 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-14 13:00 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-14 13:00 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-14 13:00 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-14 13:00 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-14 13:00 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-14 13:00 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-14 13:00 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-14 13:00 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-13 22:17 - 2014-05-13 22:17 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-10 18:07 - 2014-05-10 19:59 - 00000000 ____D () C:\Users\MF\AppData\Local\Skyrim
2014-05-09 21:07 - 2014-05-09 21:06 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-09 21:06 - 2014-05-12 12:34 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-09 21:06 - 2014-05-09 21:06 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1399890898478
2014-05-09 21:06 - 2014-05-09 21:06 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-05 15:03 - 2014-05-05 15:03 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX2
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonEPP
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Canon
2014-05-05 14:59 - 2011-04-13 05:00 - 00385536 _____ (CANON INC.) C:\Windows\system32\CNMXLMAT.DLL
2014-05-05 14:57 - 2014-05-05 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Benutzerregistrierung
2014-05-05 14:56 - 2014-05-05 14:56 - 00002043 _____ () C:\Users\Public\Desktop\Canon Solution Menu EX.lnk
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-05-05 14:54 - 2014-05-05 14:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series
2014-05-05 14:54 - 2014-05-05 14:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-05 14:54 - 2014-05-05 14:54 - 00002324 _____ () C:\Users\Public\Desktop\Canon MG5300 series Online-Handbuch.lnk
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Manual
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\Program Files\Canon
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-05 14:53 - 2011-05-23 05:00 - 00385536 _____ (CANON INC.) C:\Windows\system32\CNMLMAT.DLL
2014-05-05 14:53 - 2011-03-31 10:07 - 00302080 _____ (CANON INC.) C:\Windows\system32\CNC_ATC.dll
2014-05-05 14:53 - 2011-03-31 10:07 - 00114688 _____ (CANON INC.) C:\Windows\SysWOW64\CNC_ATU.dll
2014-05-05 14:53 - 2011-03-31 10:06 - 00112128 _____ (CANON INC.) C:\Windows\system32\CNC_ATI.dll
2014-05-05 14:53 - 2011-03-30 12:55 - 00373248 _____ (CANON INC.) C:\Windows\system32\CNC_ATL.dll
2014-05-05 14:53 - 2011-03-30 12:54 - 00323584 _____ (CANON INC.) C:\Windows\SysWOW64\CNC_ATL.dll
2014-05-05 14:53 - 2011-02-03 02:20 - 00256000 _____ (CANON INC.) C:\Windows\system32\CNMIUAT.DLL
2014-05-05 14:53 - 2011-02-01 10:23 - 00355840 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL
2014-05-05 14:53 - 2011-02-01 10:23 - 00038400 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL
2014-05-05 14:53 - 2010-11-18 08:15 - 00098304 _____ (Canon Inc.) C:\Windows\system32\CNC_ATO.dll
2014-05-05 14:53 - 2010-11-12 11:13 - 00068096 _____ () C:\Windows\SysWOW64\CNC1754D.TBL
2014-05-05 14:53 - 2010-11-12 11:13 - 00068096 _____ () C:\Windows\system32\CNC1754D.TBL
2014-05-05 14:53 - 2008-08-25 18:02 - 00017920 _____ (CANON INC.) C:\Windows\system32\CNHMCA6.dll
2014-05-05 14:53 - 2008-08-25 18:02 - 00015872 _____ (CANON INC.) C:\Windows\SysWOW64\CNHMCA.dll
2014-05-05 14:49 - 2014-05-05 14:57 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-03 16:14 - 2014-05-05 22:51 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Tropico 4
2014-05-03 16:09 - 2014-05-03 16:09 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Kalypso Media
2014-05-03 15:28 - 2014-05-03 15:28 - 00000222 _____ () C:\Users\MF\Desktop\Tropico 4.url
2014-04-28 10:26 - 2014-04-28 10:26 - 00002165 _____ () C:\Users\Public\Desktop\CyberLink PowerDVD 10.lnk
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 10
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ____D () C:\Users\MF\AppData\Local\Packages

==================== One Month Modified Files and Folders =======

2014-05-28 22:51 - 2014-05-28 22:51 - 00027272 _____ () C:\Users\MF\Desktop\FRST.txt
2014-05-28 22:51 - 2014-05-27 21:38 - 00000000 ____D () C:\Users\MF\Desktop\Virencleaning
2014-05-28 22:51 - 2014-05-27 17:55 - 00000000 ____D () C:\FRST
2014-05-28 22:48 - 2014-05-28 22:48 - 00000622 _____ () C:\Users\MF\Desktop\JRT.txt
2014-05-28 22:43 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-28 22:43 - 2009-07-14 06:45 - 00016752 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-28 22:40 - 2014-05-28 22:40 - 00000000 ____D () C:\Windows\ERUNT
2014-05-28 22:39 - 2014-05-28 22:39 - 01016261 _____ (Thisisu) C:\Users\MF\Desktop\JRT.exe
2014-05-28 22:37 - 2014-01-07 14:46 - 00000000 ____D () C:\Users\MF\AppData\Roaming\DropboxMaster
2014-05-28 22:37 - 2014-01-07 14:43 - 00000000 ___RD () C:\Users\MF\Dropbox
2014-05-28 22:37 - 2014-01-07 14:41 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Dropbox
2014-05-28 22:37 - 2014-01-03 15:46 - 00000262 _____ () C:\Windows\lgfwup.ini
2014-05-28 22:37 - 2014-01-03 15:46 - 00000000 ____D () C:\Program Files\lg_fwupdate
2014-05-28 22:37 - 2012-08-10 17:06 - 00004196 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-28 22:36 - 2014-02-11 18:26 - 00022447 _____ () C:\Windows\setupact.log
2014-05-28 22:36 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-28 22:35 - 2014-03-01 10:23 - 00005658 _____ () C:\Windows\PFRO.log
2014-05-28 22:34 - 2014-05-28 22:33 - 00000000 ____D () C:\AdwCleaner
2014-05-28 22:34 - 2012-04-29 13:14 - 02070281 _____ () C:\Windows\WindowsUpdate.log
2014-05-28 22:31 - 2014-05-28 22:31 - 01327971 _____ () C:\Users\MF\Desktop\adwcleaner_3.211.exe
2014-05-28 22:17 - 2013-02-28 11:48 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-28 19:28 - 2012-04-29 23:07 - 00697082 _____ () C:\Windows\system32\perfh007.dat
2014-05-28 19:28 - 2012-04-29 23:07 - 00148346 _____ () C:\Windows\system32\perfc007.dat
2014-05-28 19:28 - 2009-07-14 07:13 - 01613340 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-28 11:18 - 2014-01-07 14:42 - 00001043 _____ () C:\Windows\wininit.ini
2014-05-28 11:18 - 2012-08-10 10:45 - 00000000 ___RD () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-28 11:17 - 2014-01-07 14:49 - 00001009 _____ () C:\Users\MF\Desktop\Dropbox.lnk
2014-05-28 11:17 - 2014-01-07 14:46 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-28 11:17 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-05-27 18:36 - 2014-04-08 12:51 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-27 17:54 - 2014-05-27 17:54 - 02066944 _____ (Farbar) C:\Users\MF\Desktop\FRST64.exe
2014-05-27 17:53 - 2014-05-27 17:53 - 00000000 _____ () C:\Users\MF\defogger_reenable
2014-05-27 17:53 - 2012-08-10 10:39 - 00000000 ____D () C:\Users\MF
2014-05-27 14:26 - 2014-05-27 14:26 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-05-27 14:14 - 2014-05-27 14:13 - 00287160 _____ () C:\Windows\Minidump\052714-89606-01.dmp
2014-05-27 14:13 - 2014-05-27 14:13 - 00000000 ____D () C:\Windows\Minidump
2014-05-27 14:12 - 2014-05-27 14:12 - 734986024 _____ () C:\Windows\MEMORY.DMP
2014-05-27 13:38 - 2012-09-14 17:33 - 00000000 ____D () C:\Users\MF\AppData\Local\CrashDumps
2014-05-15 14:15 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-15 13:50 - 2014-02-28 23:12 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-14 19:08 - 2012-08-10 10:45 - 00000000 ___RD () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-14 13:07 - 2013-07-11 08:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-14 13:04 - 2012-08-10 13:28 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-13 22:17 - 2014-05-13 22:17 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 22:17 - 2013-02-28 11:48 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-13 22:17 - 2012-04-10 14:15 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-13 22:17 - 2012-04-10 14:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-12 12:34 - 2014-05-09 21:06 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-12 12:34 - 2014-01-03 15:49 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-12 12:34 - 2012-08-10 17:06 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-12 12:34 - 2012-08-10 17:06 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-10 19:59 - 2014-05-10 18:07 - 00000000 ____D () C:\Users\MF\AppData\Local\Skyrim
2014-05-10 19:58 - 2014-03-05 17:58 - 00201081 _____ () C:\Windows\DirectX.log
2014-05-10 19:58 - 2012-08-10 17:03 - 00000000 ____D () C:\Programme und Spiele
2014-05-10 18:05 - 2013-09-28 16:10 - 00000000 ____D () C:\Users\MF\Documents\My Games
2014-05-10 17:56 - 2009-07-14 07:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-05-09 21:07 - 2013-09-22 21:21 - 00001935 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-09 21:06 - 2014-05-09 21:07 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-09 21:06 - 2014-05-09 21:06 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1399890898478
2014-05-09 21:06 - 2014-05-09 21:06 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-09 21:06 - 2013-03-15 16:37 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-05-09 21:06 - 2013-03-15 16:37 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-05-09 21:06 - 2012-08-10 17:06 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1399890898478
2014-05-09 21:06 - 2012-08-10 17:06 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1399890898478
2014-05-09 21:06 - 2012-08-10 17:06 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-05-09 21:06 - 2012-08-10 17:06 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-05-09 21:06 - 2012-08-10 17:06 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-05-06 06:40 - 2014-05-14 13:08 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-14 13:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-14 13:08 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-14 13:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-14 13:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-14 13:08 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 22:51 - 2014-05-03 16:14 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Tropico 4
2014-05-05 15:03 - 2014-05-05 15:03 - 00000000 ___HD () C:\ProgramData\CanonIJEGV
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonIJEPPEX2
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ___HD () C:\ProgramData\CanonEPP
2014-05-05 15:02 - 2014-05-05 15:02 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Canon
2014-05-05 14:59 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series
2014-05-05 14:58 - 2009-07-14 05:20 - 00000000 __RSD () C:\Windows\Media
2014-05-05 14:57 - 2014-05-05 14:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Benutzerregistrierung
2014-05-05 14:57 - 2014-05-05 14:49 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-05-05 14:56 - 2014-05-05 14:56 - 00002043 _____ () C:\Users\Public\Desktop\Canon Solution Menu EX.lnk
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\ProgramData\CanonIJWSpt
2014-05-05 14:56 - 2014-05-05 14:56 - 00000000 ____D () C:\Program Files\Common Files\CANON
2014-05-05 14:56 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon Utilities
2014-05-05 14:54 - 2014-05-05 14:54 - 00002324 _____ () C:\Users\Public\Desktop\Canon MG5300 series Online-Handbuch.lnk
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MG5300 series Manual
2014-05-05 14:54 - 2014-05-05 14:54 - 00000000 ____D () C:\Program Files\Canon
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-05-05 14:53 - 2014-05-05 14:53 - 00000000 ____D () C:\Windows\system32\STRING
2014-05-03 16:09 - 2014-05-03 16:09 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Kalypso Media
2014-05-03 15:28 - 2014-05-03 15:28 - 00000222 _____ () C:\Users\MF\Desktop\Tropico 4.url
2014-05-03 15:28 - 2012-12-27 12:43 - 00000000 ____D () C:\Users\MF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-04-28 10:26 - 2014-04-28 10:26 - 00002165 _____ () C:\Users\Public\Desktop\CyberLink PowerDVD 10.lnk
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 10
2014-04-28 10:26 - 2014-04-28 10:26 - 00000000 ____D () C:\Users\MF\AppData\Local\Packages
2014-04-28 10:24 - 2014-01-03 17:14 - 00499712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll
2014-04-28 10:24 - 2014-01-03 17:14 - 00348160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll
2014-04-28 10:24 - 2014-01-03 17:14 - 00029480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3a.dll
2014-04-28 10:23 - 2014-01-03 15:35 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink Blu-ray Disc Suite
2014-04-28 10:23 - 2014-01-03 15:34 - 00000000 ____D () C:\Program Files\CyberLink
2014-04-28 10:23 - 2012-04-29 13:46 - 00000000 ____D () C:\ProgramData\CyberLink

Some content of TEMP:
====================
C:\Users\MF\AppData\Local\Temp\drm_dialogs.dll
C:\Users\MF\AppData\Local\Temp\drm_dyndata_7340014.dll
C:\Users\MF\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmplncmeu.dll
C:\Users\MF\AppData\Local\Temp\MSETUP4.EXE
C:\Users\MF\AppData\Local\Temp\Quarantine.exe
C:\Users\MF\AppData\Local\Temp\_is6A85.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 13:10

==================== End Of Log ============================

--- --- ---

--- --- ---

cosinus · 28.05.2014, 22:59

Okay, dann bitte Kontrollscans mit MBAM bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

27.05.2014, 20:39	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 7: Rootkit durch Avast Internet Security blockiert und in Virus Container verschoben Warum kommst du auf Rootkit? Oder waren das noch nicht alle Funde? __________________ Logfiles bitte immer in CODE-Tags posten

28.05.2014, 11:59	#11
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Windows 7: Rootkit durch Avast Internet Security blockiert und in Virus Container verschoben Bevor wir hier unzählige Postings haben um das richtige Log zu finden: ausnahmsweise alle darin enthaltenen Log-Dateien in eine Datei zippen und im nächsten Beitrag als Anhang posten. __________________ Logfiles bitte immer in CODE-Tags posten

Windows 7: Rootkit durch Avast Internet Security blockiert und in Virus Container verschoben

Log-Analyse und Auswertung: Windows 7: Rootkit durch Avast Internet Security blockiert und in Virus Container verschoben