Hallo liebe Gemeinde,

ich habe hier einen Laptop vor mir stehen, der scheinbar etwas verseucht ist. Gern würde ich eine Neuinstallation vermeiden wollen und poste daher die Logs von Fabar und Gmer.
Ich würde Euch bitten einmal einen Blick über die Auswertungen zu werfen.
Vielen Dank....
FRST.txt

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-10-2014
Ran by Stefanie (administrator) on STEFANIE-PC on 21-10-2014 19:40:44
Running from D:\Stefanie\Downloads
Loaded Profile: Stefanie (Available profiles: Stefanie)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
() C:\Program Files (x86)\SupTab\HpUI.exe
(Fuyu LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
() C:\Program Files (x86)\SupTab\Loader64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
() C:\Program Files (x86)\SupTab\Loader32.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
(Bandoo Media Inc.) C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
() C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
(Garmin Ltd or its subsidiaries) C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [608112 2011-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3668336 2011-03-24] (Dell Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-04] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [mbot_de_96] => [X]
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2283762676-3508335138-3058622962-1001\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2283762676-3508335138-3058622962-1001\...\Run: [iLivid] => C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [8271360 2014-04-08] (Bandoo Media Inc.)
HKU\S-1-5-21-2283762676-3508335138-3058622962-1001\...\Run: [Browser Infrastructure Helper] => C:\Users\Stefanie\AppData\Local\Smartbar\Application\Shopop.exe [29720 2014-08-28] (Smartbar)
HKU\S-1-5-21-2283762676-3508335138-3058622962-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-09-18] (Garmin Ltd or its subsidiaries)
AppInit_DLLs-x32: c:\progra~3\browse~2\251005~1.80\{c16c1~1\browse~1.dll => "c:\progra~3\browse~2\251005~1.80\{c16c1~1\browse~1.dll" File Not Found
AppInit_DLLs-x32:  c:\progra~3\pcperf~1\23811~1.154\{61d8b~1\pcpmngr.dll => "c:\progra~3\pcperf~1\23811~1.154\{61d8b~1\pcpmngr.dll" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ImageBrowser EX Agent.lnk
ShortcutTarget: ImageBrowser EX Agent.lnk -> C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe ()
Startup: C:\Users\Stefanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.trovi.com/?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=M259D3C00-7165-421B-B5A5-48AB17F09E27&SearchSource=55&CUI=&UM=2&UP=SP7D8D6AE5-615A-4873-BEBA-5F01F64CEE24&SSPV=
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = hxxp://search.babylon.com/?affID=100346&tt=120812_bandext_3312_7&babsrc=HP_ss&mntrId=7c4e86d4000000000000e4d53deed6cd
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=prc265
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://istart.webssearches.com/?type=hp&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://istart.webssearches.com/?type=hp&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - C:\Program Files\Internet Explorer\iexplore.exe hxxp://istart.webssearches.com/?type=sc&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
SearchScopes: HKLM-x32 - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=M259D3C00-7165-421B-B5A5-48AB17F09E27&SearchSource=58&CUI=&UM=2&UP=SP7D8D6AE5-615A-4873-BEBA-5F01F64CEE24&q={searchTerms}&SSPV=
SearchScopes: HKCU - BrowserMngrDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=M259D3C00-7165-421B-B5A5-48AB17F09E27&SearchSource=58&CUI=&UM=2&UP=SP7D8D6AE5-615A-4873-BEBA-5F01F64CEE24&q={searchTerms}&SSPV=
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.claro-search.com/?q={searchTerms}&affID=114506&tt=5212_3&babsrc=SP_clro&mntrId=7c4e86d4000000000000e4d53deed6cd
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://istart.webssearches.com/web/?type=ds&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672&q={searchTerms}
SearchScopes: HKCU - {37692885-2503-44A6-BC37-195C6514BC0A} URL = hxxp://www.bing.com/search?q={searchTerms}&r=
SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
BHO: Shopop WidgetEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Shopop WidgetEngine -> {31ad400d-1b06-4e33-a59a-90c2c140cba0} -> C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\SupTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM - Shopop Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - No Name - {98889811-442D-49dd-99D7-DC866BE87DBC} -  No File
Toolbar: HKLM-x32 - Shopop Widget - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\windows\SysWOW64\mscoree.dll (Microsoft Corporation)
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com/bin/srldetect_intel_4.5.15.0.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default
FF NewTab: hxxp://www.trovi.com/?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=M259D3C00-7165-421B-B5A5-48AB17F09E27&SearchSource=69&CUI=&SSPV=&Lay=1&UM=2&UP=SP7D8D6AE5-615A-4873-BEBA-5F01F64CEE24
FF DefaultSearchEngine: webssearches
FF DefaultSearchUrl: hxxp://de.yhs4.search.yahoo.com/yhs/search
FF SearchEngineOrder.1: Yahoo! (Avast)
FF SelectedSearchEngine: Trovi search
FF Homepage: hxxp://www.trovi.com/?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=M259D3C00-7165-421B-B5A5-48AB17F09E27&SearchSource=55&CUI=&UM=2&UP=SP7D8D6AE5-615A-4873-BEBA-5F01F64CEE24&SSPV=
FF Keyword.URL: hxxp://de.yhs4.search.yahoo.com/yhs/search
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\user.js
FF SearchPlugin: C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\searchplugins\BabylonMngr.xml
FF SearchPlugin: C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\searchplugins\claro.xml
FF SearchPlugin: C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\searchplugins\softonic.xml
FF SearchPlugin: C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\searchplugins\trovi-search.xml
FF SearchPlugin: C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\searchplugins\yahoo-avast.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\webssearches.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Fast Start - C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\Extensions\faststartff@gmail.com [2014-09-20]
FF Extension: Shopop Widget - C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\Extensions\{7cf839ac-10a0-5871-0e1d-b492e31178c9} [2014-09-24]
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-07-16]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-07-29]
FF HKLM-x32\...\Firefox\Extensions: [faststartff@gmail.com] - C:\Users\Stefanie\AppData\Roaming\Mozilla\Firefox\Profiles\u2biie47.default\extensions\faststartff@gmail.com
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox\firefox.exe hxxp://istart.webssearches.com/?type=sc&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-07]
CHR Extension: (Google Drive) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-07]
CHR Extension: (Google-Suche) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-07]
CHR Extension: (FileConverter 1.3) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\engeblojhfeingnjnfpiceofljnjpldp [2014-06-07]
CHR Extension: (Google Wallet) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-09]
CHR Extension: (Quick start) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pelmeidfhdlhlbjimpabfcbnnojbboma [2014-09-20]
CHR Extension: (Google Mail) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-07]
CHR HKCU\...\Chrome\Extension: [engeblojhfeingnjnfpiceofljnjpldp] - C:\Users\Stefanie\AppData\Local\CRE\engeblojhfeingnjnfpiceofljnjpldp.crx [2012-12-01]
CHR HKLM-x32\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Users\Stefanie\AppData\Roaming\BabylonToolbar\CR\BabylonChrome1.crx [2012-12-01]
CHR HKLM-x32\...\Chrome\Extension: [engeblojhfeingnjnfpiceofljnjpldp] - C:\Users\Stefanie\AppData\Local\CRE\engeblojhfeingnjnfpiceofljnjpldp.crx [2012-12-01]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-20]
CHR HKLM-x32\...\Chrome\Extension: [pelmeidfhdlhlbjimpabfcbnnojbboma] - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtabv3.crx [2014-09-20]
CHR StartMenuInternet: Google Chrome - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe hxxp://istart.webssearches.com/?type=sc&ts=1411244771&from=tugs&uid=ST500LM012XHN-M500MBB_S2TDJB0C146672146672

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43072 2012-03-19] (ArcSoft, Inc.)
R2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-20] (AVAST Software)
R2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [450904 2014-09-18] (Garmin Ltd or its subsidiaries)
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [715656 2014-09-20] (Cherished Technololgy LIMITED)
S2 ProtectMonitor; C:\monitorsvc.exe [34244 2014-09-02] () [File not signed] <==== ATTENTION
R2 servervo; C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe [71680 2014-09-20] () [File not signed]
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [528896 2014-09-20] (Fuyu LIMITED) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-20] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-20] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-20] ()
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2013-07-19] (Corel Corporation)
S3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0; \??\c:\program files\my dell\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-21 19:40 - 2014-10-21 19:40 - 00000000 ____D () C:\FRST
2014-10-17 17:14 - 2014-10-21 19:30 - 00000280 _____ () C:\windows\setupact.log
2014-10-17 17:14 - 2014-10-17 17:14 - 00000000 _____ () C:\windows\setuperr.log
2014-10-15 18:24 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-15 18:24 - 2014-08-19 05:11 - 00693176 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2014-10-15 18:24 - 2014-08-19 05:10 - 00616352 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2014-10-15 18:24 - 2014-07-07 04:07 - 14632960 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2014-10-15 18:24 - 2014-07-07 04:07 - 00782848 _____ (Microsoft Corporation) C:\windows\system32\wmdrmsdk.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 04120576 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 01574400 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 01202176 _____ (Microsoft Corporation) C:\windows\system32\drmv2clt.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00842240 _____ (Microsoft Corporation) C:\windows\system32\blackbox.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\drmmgrtn.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2014-10-15 18:24 - 2014-07-07 03:52 - 00663552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\PEAuth.sys
2014-10-15 18:24 - 2014-07-07 03:40 - 11411456 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 03208704 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00988160 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmv2clt.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00744960 _____ (Microsoft Corporation) C:\windows\SysWOW64\blackbox.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00617984 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmdrmsdk.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00406016 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmmgrtn.dll
2014-10-15 18:24 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\windows\system32\ci.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\windows\system32\dfshim.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\windows\SysWOW64\dfshim.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscorier.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\windows\system32\mscorier.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscories.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\windows\system32\mscories.dll
2014-10-15 18:23 - 2014-10-10 04:05 - 00507392 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-10-15 18:23 - 2014-10-10 04:05 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-10-15 18:23 - 2014-10-10 04:00 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-10-15 18:23 - 2014-10-07 04:54 - 00378552 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-10-15 18:23 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-10-15 18:23 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-10-15 18:23 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-10-15 18:23 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-10-15 18:23 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-10-15 18:23 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-10-15 18:23 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-10-15 18:23 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-10-15 18:23 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-10-15 18:23 - 2014-09-19 03:56 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-10-15 18:23 - 2014-09-19 03:55 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-10-15 18:23 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-10-15 18:23 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-15 18:23 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-10-15 18:23 - 2014-09-19 03:40 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-10-15 18:23 - 2014-09-19 03:39 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-10-15 18:23 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-10-15 18:23 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-10-15 18:23 - 2014-09-19 03:31 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-10-15 18:23 - 2014-09-19 03:30 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-10-15 18:23 - 2014-09-19 03:27 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-10-15 18:23 - 2014-09-19 03:26 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-10-15 18:23 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-10-15 18:23 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-10-15 18:23 - 2014-09-19 03:25 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-10-15 18:23 - 2014-09-19 03:18 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-10-15 18:23 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-10-15 18:23 - 2014-09-19 03:14 - 00446464 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-10-15 18:23 - 2014-09-19 03:06 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 18:23 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-10-15 18:23 - 2014-09-19 03:01 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-10-15 18:23 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-10-15 18:23 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-10-15 18:23 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-10-15 18:23 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-10-15 18:23 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-10-15 18:23 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-15 18:23 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-10-15 18:23 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-10-15 18:23 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-10-15 18:23 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-10-15 18:23 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-10-15 18:23 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-10-15 18:23 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-10-15 18:23 - 2014-09-19 02:40 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-10-15 18:23 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 18:23 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-15 18:23 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-10-15 18:23 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-10-15 18:23 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-10-15 18:23 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-15 18:23 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-15 18:23 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-10-15 18:23 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-15 18:23 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-10-15 18:23 - 2014-08-19 05:08 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2014-10-15 18:23 - 2014-08-19 05:08 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2014-10-15 18:23 - 2014-08-19 05:08 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2014-10-15 18:23 - 2014-08-19 05:07 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2014-10-15 18:23 - 2014-08-19 05:07 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2014-10-15 18:23 - 2014-08-19 05:07 - 00058880 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2014-10-15 18:23 - 2014-08-19 05:07 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2014-10-15 18:23 - 2014-08-19 05:07 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2014-10-15 18:23 - 2014-08-19 04:41 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2014-10-15 18:23 - 2014-08-19 04:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2014-10-15 18:23 - 2014-08-19 04:06 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2014-10-15 18:23 - 2014-07-07 04:07 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 05551032 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-10-15 18:23 - 2014-07-07 04:06 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 01069056 _____ (Microsoft Corporation) C:\windows\system32\cryptui.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00679424 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00641024 _____ (Microsoft Corporation) C:\windows\system32\msscp.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\msnetobj.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\pcasvc.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\cryptsp.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2014-10-15 18:23 - 2014-07-07 04:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2014-10-15 18:23 - 2014-07-07 04:06 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
2014-10-15 18:23 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
2014-10-15 18:23 - 2014-07-07 04:05 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2014-10-15 18:23 - 2014-07-07 04:05 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
2014-10-15 18:23 - 2014-07-07 04:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 01005056 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptui.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\msscp.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00265216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msnetobj.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00081408 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsp.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
2014-10-15 18:23 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
2014-10-15 18:23 - 2014-07-07 03:39 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2014-10-15 18:23 - 2014-07-07 03:39 - 03970488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-10-15 18:23 - 2014-07-07 03:39 - 03914680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-10-15 18:23 - 2014-07-07 03:39 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2014-10-15 18:23 - 2014-07-07 03:39 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2014-10-15 18:23 - 2014-07-07 03:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2014-10-15 18:23 - 2014-06-28 02:21 - 00619056 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2014-10-15 18:23 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2014-10-15 18:21 - 2014-09-18 04:00 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-10-15 18:21 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-10-15 18:21 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2014-10-15 18:21 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 05780480 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 03179520 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 00322560 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2014-10-15 18:21 - 2014-08-29 04:06 - 01125888 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-10-15 18:21 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-10-15 18:21 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-10-15 18:21 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2014-10-15 18:21 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-10-15 18:21 - 2014-07-17 04:07 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00150528 _____ (Microsoft Corporation) C:\windows\system32\rdpcorekmts.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-10-15 18:21 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2014-10-15 18:21 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-10-15 18:21 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-10-15 18:21 - 2014-07-17 03:21 - 00212480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpwd.sys
2014-10-15 18:21 - 2014-07-17 03:21 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
2014-10-15 18:20 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-15 18:20 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-13 19:18 - 2014-10-19 16:40 - 00000000 ____D () C:\ProgramData\Performance Optimizer
2014-10-07 19:26 - 2014-10-17 17:49 - 00001107 _____ () C:\Users\Stefanie\Desktop\Continue Live Installation.lnk
2014-10-06 20:40 - 2014-10-06 20:40 - 00000000 ____D () C:\Users\Stefanie\AppData\Local\Garmin
2014-10-06 20:39 - 2014-10-06 20:40 - 00000000 ____D () C:\Users\Stefanie\AppData\Roaming\Garmin
2014-10-06 20:39 - 2014-10-06 20:39 - 00000000 ____D () C:\Program Files\DIFX
2014-10-06 20:38 - 2014-10-06 20:40 - 00000000 ____D () C:\ProgramData\Garmin
2014-10-06 20:38 - 2014-10-06 20:39 - 00000000 ____D () C:\Program Files (x86)\Garmin
2014-10-06 20:38 - 2014-10-06 20:38 - 00003556 _____ () C:\windows\System32\Tasks\GarminUpdaterTask
2014-10-06 20:38 - 2014-10-06 20:38 - 00001890 _____ () C:\Users\Public\Desktop\Garmin Express.lnk
2014-10-06 20:38 - 2014-10-06 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2014-10-04 20:29 - 2014-10-04 20:29 - 00000000 ____D () C:\Program Files (x86)\predm
2014-10-03 19:51 - 2014-10-13 19:18 - 00000000 ____D () C:\ProgramData\374311380
2014-10-03 11:10 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2014-10-03 11:10 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2014-09-24 18:43 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2014-09-24 18:43 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2014-09-21 10:37 - 2014-10-09 20:53 - 00000000 ____D () C:\Users\Stefanie\AppData\Local\LPT
2014-09-21 10:37 - 2014-09-21 10:37 - 00000000 ____D () C:\Users\Stefanie\AppData\Local\Smartbar
2014-09-21 10:36 - 2014-10-03 19:52 - 00000000 ____D () C:\Users\Stefanie\AppData\Roaming\Systweak

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-21 19:41 - 2012-08-07 19:57 - 00000000 ____D () C:\Users\Stefanie\AppData\Local\Adobe
2014-10-21 19:37 - 2012-08-27 19:48 - 01877197 _____ () C:\windows\WindowsUpdate.log
2014-10-21 19:32 - 2012-11-21 15:32 - 00001114 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-21 19:32 - 2012-11-21 15:32 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-21 19:30 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-19 17:09 - 2012-07-14 12:53 - 00000000 ____D () C:\ProgramData\tmp
2014-10-19 17:08 - 2014-09-20 22:26 - 00000000 ____D () C:\Users\Stefanie\AppData\Roaming\VOPackage
2014-10-19 16:57 - 2012-08-13 18:05 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-19 16:45 - 2009-07-14 06:45 - 00028352 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-19 16:45 - 2009-07-14 06:45 - 00028352 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-19 16:36 - 2013-07-29 17:18 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-10-18 12:56 - 2012-02-11 14:48 - 00699666 _____ () C:\windows\system32\perfh007.dat
2014-10-18 12:56 - 2012-02-11 14:48 - 00149774 _____ () C:\windows\system32\perfc007.dat
2014-10-18 12:56 - 2009-07-14 07:13 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-18 11:07 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-10-18 11:01 - 2013-11-10 10:29 - 00003440 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2014-10-17 17:28 - 2014-09-20 22:26 - 00000000 ____D () C:\Program Files (x86)\PCTRunner
2014-10-17 17:19 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2014-10-17 17:16 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 17:14 - 2009-07-14 06:45 - 00396752 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-17 17:12 - 2014-05-09 20:42 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-10-17 17:12 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\Dism
2014-10-17 17:12 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\Dism
2014-10-15 19:49 - 2013-08-25 15:58 - 00000000 ____D () C:\windows\system32\MRT
2014-10-15 19:45 - 2012-07-16 20:13 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-10 16:47 - 2013-11-09 14:05 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-09 20:51 - 2012-08-13 17:48 - 00000000 ____D () C:\ProgramData\InstallBrainService
2014-10-06 20:39 - 2013-11-09 15:05 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-24 18:57 - 2014-09-20 22:57 - 03675824 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2014-09-24 18:57 - 2012-08-13 18:05 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-09-24 18:57 - 2012-08-13 18:05 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-09-24 18:57 - 2012-02-11 13:08 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-18 10:53

==================== End Of Log ============================
         

--- --- ---

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2014
Ran by Stefanie at 2014-10-21 19:41:50
Running from D:\Stefanie\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AbiWord 2.9.4 (HKLM-x32\...\AbiWord2) (Version: 2.9.4 - AbiSource Developers)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.9.0.1030 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Photoshop Elements 12 (HKLM-x32\...\Adobe Photoshop Elements 12) (Version: 12.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 12 (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
aOUTo (HKCU\...\fbaa9ace9c15fb8c) (Version: 1.1.0.2 - A-rival)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2021 - AVAST Software)
Best Of Gehirnjogging (HKLM-x32\...\Best Of Gehirnjogging) (Version: 1.0 - SBT)
Canon Utilities Digital Photo Professional (HKLM-x32\...\Digital Photo Professional) (Version: 3.13.20.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 2.13.20.0 - Canon Inc.)
Canon Utilities ImageBrowser EX (HKLM-x32\...\ImageBrowser EX) (Version: 1.4.0.5 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM-x32\...\Picture Style Editor) (Version: 1.13.20.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 3.20 - Piriform)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.16 - Piriform)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.1.3 - Dell Inc.)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1207.101.225 - ALPS ELECTRIC CO., LTD.)
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
DW WLAN Card (HKLM\...\DW WLAN Card) (Version: 5.100.82.88 - Dell Inc.)
Elements 12 Organizer (x32 Version: 12.0 - Ihr Firmenname) Hidden
Elevated Installer (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express (HKLM-x32\...\{447c27b7-3a63-4cb2-a49c-864050f9a50f}) (Version: 3.2.19.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
HP Photosmart 5510 series - Grundlegende Software für das Gerät (HKLM\...\{AB6268C0-EDA4-46C3-8A1C-11D86A5A8E93}) (Version: 24.0.342.0 - Hewlett-Packard Co.)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Photosmart 5520 series Hilfe (HKLM-x32\...\{640A03B3-4E6B-4440-A350-E6A8D6348F12}) (Version: 27.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6341.0 - IDT)
iLivid (HKCU\...\iLivid) (Version: 5.0.0.4408 - Bandoo Media Inc) <==== ATTENTION
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
Java 7 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417045FF}) (Version: 7.0.450 - Oracle)
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kits Configuration Installer (x32 Version: 8.59.25584 - Microsoft) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Mein CEWE FOTOBUCH (HKLM-x32\...\Mein CEWE FOTOBUCH) (Version: 5.1.5 - CEWE Stiftung u Co. KGaA)
Meine CEWE FOTOWELT (HKLM-x32\...\Meine CEWE FOTOWELT) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 15.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 15.0.1 (x86 de)) (Version: 15.0.1 - Mozilla)
Mozilla Firefox 25.0 (x86 de) (HKCU\...\Mozilla Firefox 25.0 (x86 de)) (Version: 25.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 25.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
Panorama Project 2 (HKLM-x32\...\{659C1F41-4687-4B37-93ED-F45A1C98620A}) (Version: 6.0.11.99 - Pixxsel)
Performance Optimizer (HKLM-x32\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{892cc6a3}) (Version:  - Linker Ltd) <==== ATTENTION
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
PSE12 STI Installer (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.45.516.2011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.)
Remote Desktop Access (VuuPC) (HKLM-x32\...\VOPackage) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden
Roxio Burn (x32 Version: 1.8 - Roxio) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden
Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden
Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
Shopop (HKLM-x32\...\{6F874974-A10D-4CCE-844E-E80A30FA7F34}) (Version: 11.113.68.19248 - My Pop Shop Ltd.) <==== ATTENTION
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
System Requirements Lab for Intel (HKLM-x32\...\{53C63F43-B827-42D9-8886-4698D91EA33B}) (Version: 4.5.15.0 - Husdawg, LLC)
webssearches uninstall (HKLM-x32\...\webssearches uninstall) (Version:  - webssearches) <==== ATTENTION
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7600 - Broadcom Corporation)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Software Development Kit (HKLM-x32\...\{363a2c1e-637f-45ce-933b-5a5463efd945}) (Version: 8.59.29750 - Microsoft Corporation)
Windows Software Development Kit EULA (x32 Version: 8.59.25584 - Microsoft Corporations) Hidden
WindowsMangerProtect20.0.0.722 (HKLM-x32\...\WindowsMangerProtect) (Version: 20.0.0.722 - WindowsProtect LIMITED) <==== ATTENTION
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
WPT Redistributables (x32 Version: 8.59.29750 - Microsoft) Hidden
WPTx64 (x32 Version: 8.59.29722 - Microsoft) Hidden
Yontoo 1.10.02 (HKLM\...\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}) (Version: 1.10.02 - Yontoo LLC) <==== ATTENTION

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

08-10-2014 19:05:48 Windows Update
15-10-2014 17:45:08 Windows Update
18-10-2014 10:54:22 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {23036767-42A5-45DD-8812-2B7E930EB943} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-09-18] ()
Task: {52F7D947-1465-4FB4-B02D-ED1275B6F181} - System32\Tasks\{550DD30A-F57B-46E8-B081-1BE160A9DF8C} => E:\setup.exe
Task: {569842EF-F07E-4918-97E0-2AE55524E2B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-21] (Google Inc.)
Task: {6904305B-7C99-4C34-A800-E5AC48DC2199} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-06-22] (Piriform Ltd)
Task: {801114B5-7B34-44AB-BCE8-FCC8C629CA5A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-20] (AVAST Software)
Task: {99447320-FB32-4A1E-932C-5197BB2AA3D0} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {99AEDBFE-6323-48FD-9C22-8BBDD50C03C0} - System32\Tasks\AdobeAAMUpdater-1.0-Stefanie-PC-Stefanie => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)
Task: {BE0930EA-AEFD-4AD0-85B5-A141D2EF95D0} - System32\Tasks\{9F5B5394-8CB3-4FA6-942F-056A76CF8EC0} => C:\Program Files (x86)\CEWE\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe [2013-11-28] ()
Task: {C1C07C81-BB53-484A-A266-0E418E632600} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {F97D048A-A389-451E-B546-886FBE1C386B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-11-21] (Google Inc.)
Task: {FE9A7083-B21E-42FB-8727-49CAF8913C6F} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {FF4E2E9A-B2E9-44E2-8584-9C31C9D73EF7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-08-21 12:33 - 2014-09-20 22:27 - 00106376 _____ () C:\Program Files (x86)\SupTab\WindowsSupportDll64.dll
2014-08-21 12:32 - 2014-09-20 22:27 - 00733576 _____ () C:\Program Files (x86)\SupTab\HpUI.exe
2014-07-16 10:55 - 2014-07-16 10:55 - 00073216 _____ () C:\Program Files (x86)\SupTab\Loader64.exe
2014-07-16 11:16 - 2014-07-16 11:16 - 00064000 _____ () C:\Program Files (x86)\SupTab\Loader32.exe
2012-02-11 14:23 - 2011-03-26 03:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-08-30 14:46 - 2013-10-03 11:42 - 00069120 _____ () C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
2014-09-20 22:27 - 2014-09-20 22:27 - 00071680 _____ () C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe
2014-07-20 19:53 - 2014-07-20 19:53 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-10-19 16:39 - 2014-10-19 16:39 - 02896384 _____ () C:\Program Files\AVAST Software\Avast\defs\14101900\algo.dll
2014-10-21 19:34 - 2014-10-21 19:34 - 02896384 _____ () C:\Program Files\AVAST Software\Avast\defs\14102100\algo.dll
2014-08-21 12:33 - 2014-09-20 22:27 - 00023944 _____ () C:\Program Files (x86)\SupTab\WindowsSupportDll32.dll
2014-07-20 19:53 - 2014-07-20 19:53 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2012-08-30 14:39 - 2013-10-03 11:42 - 00112128 _____ () C:\Program Files (x86)\Canon\ImageBrowser EX\MFMFileSystemWatcher.dll
2014-10-18 10:30 - 2014-10-18 10:30 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9b1cac8d98bd69d3e56a26ff2f96f266\IsdiInterop.ni.dll
2012-02-11 13:08 - 2011-01-13 01:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libglesv2.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libegl.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\pdf.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ppGoogleNaClPluginChrome.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ffmpegsumo.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 14669128 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\PepperFlash\pepflashplayer.dll

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtect => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: BBSvc => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: Dell Registration => C:\Program Files (x86)\System Registration\prodreg.exe /boot
MSCONFIG\startupreg: Dell Webcam Central => "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
MSCONFIG\startupreg: DellStage => "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup
MSCONFIG\startupreg: Desktop Disc Tool => "c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: HP Photosmart 5510 series (NET) => "C:\Program Files\HP\HP Photosmart 5510 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN19M080JZ05NR:NW" -scfn "HP Photosmart 5510 series (NET)" -AutoStart 1
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: QuickSet => C:\Program Files\Dell\QuickSet\QuickSet.exe
MSCONFIG\startupreg: RoxWatchTray => "c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"
MSCONFIG\startupreg: Stage Remote => C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe -Quiet
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-2283762676-3508335138-3058622962-500 - Administrator - Disabled)
Gast (S-1-5-21-2283762676-3508335138-3058622962-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2283762676-3508335138-3058622962-1002 - Limited - Enabled)
Stefanie (S-1-5-21-2283762676-3508335138-3058622962-1001 - Administrator - Enabled) => C:\Users\Stefanie

==================== Faulty Device Manager Devices =============

Name: Dell Wireless 1701 Bluetooth v3.0+HS
Description: Dell Wireless 1701 Bluetooth v3.0+HS
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Broadcom
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/21/2014 07:32:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Explorer.EXE, Version 6.1.7601.17567 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 5d0

Startzeit: 01cfed54c22381a3

Endzeit: 16

Anwendungspfad: C:\windows\Explorer.EXE

Berichts-ID: 2dcfc3f0-5948-11e4-b569-e4d53deed6cd

Error: (10/18/2014 00:56:44 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Produkt: Microsoft .NET Framework 4.5.1 - Update "KB2972107" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in der Protokolldatei C:\windows\TEMP\KB2972107_20141018_125619030-Microsoft .NET Framework 4.5.1-MSP0.txt enthalten.

Error: (10/18/2014 00:56:12 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Produkt: Microsoft .NET Framework 4.5.1 - Update "KB2979578v2" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in der Protokolldatei C:\windows\TEMP\KB2979578_20141018_125530561-Microsoft .NET Framework 4.5.1-MSP0.txt enthalten.

Error: (10/17/2014 05:16:36 PM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_64) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

Error: (10/15/2014 07:54:56 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Produkt: Microsoft .NET Framework 4.5.1 - Update "KB2972107" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in der Protokolldatei C:\windows\TEMP\KB2972107_20141015_195433659-Microsoft .NET Framework 4.5.1-MSP0.txt enthalten.

Error: (10/15/2014 07:54:28 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Produkt: Microsoft .NET Framework 4.5.1 - Update "KB2979578v2" konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in der Protokolldatei C:\windows\TEMP\KB2979578_20141015_195351633-Microsoft .NET Framework 4.5.1-MSP0.txt enthalten.

Error: (10/15/2014 07:45:18 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".


Details:
AddWin32ServiceFiles: Unable to back up image of service Microsoft .NET Framework NGEN v4.0.30319_X64 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.
.

Error: (10/15/2014 06:10:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Mein CEWE FOTOBUCH.exe, Version: 0.0.0.0, Zeitstempel: 0x533cfc31
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521eaf24
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000034118
ID des fehlerhaften Prozesses: 0x13cc
Startzeit der fehlerhaften Anwendung: 0xMein CEWE FOTOBUCH.exe0
Pfad der fehlerhaften Anwendung: Mein CEWE FOTOBUCH.exe1
Pfad des fehlerhaften Moduls: Mein CEWE FOTOBUCH.exe2
Berichtskennung: Mein CEWE FOTOBUCH.exe3

Error: (10/11/2014 04:20:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: PMK.exe, Version: 6.0.11.99, Zeitstempel: 0x4fd01058
Name des fehlerhaften Moduls: uPhotoStitchEngine.dll, Version: 5.0.0.11, Zeitstempel: 0x4eba092e
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00069fff
ID des fehlerhaften Prozesses: 0x16c4
Startzeit der fehlerhaften Anwendung: 0xPMK.exe0
Pfad der fehlerhaften Anwendung: PMK.exe1
Pfad des fehlerhaften Moduls: PMK.exe2
Berichtskennung: PMK.exe3

Error: (10/11/2014 04:09:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Mein CEWE FOTOBUCH.exe, Version: 0.0.0.0, Zeitstempel: 0x533cfc31
Name des fehlerhaften Moduls: Qt5Core.dll, Version: 5.1.1.0, Zeitstempel: 0x52a8888d
Ausnahmecode: 0xc000041d
Fehleroffset: 0x00000000001b1d9b
ID des fehlerhaften Prozesses: 0x8dc
Startzeit der fehlerhaften Anwendung: 0xMein CEWE FOTOBUCH.exe0
Pfad der fehlerhaften Anwendung: Mein CEWE FOTOBUCH.exe1
Pfad des fehlerhaften Moduls: Mein CEWE FOTOBUCH.exe2
Berichtskennung: Mein CEWE FOTOBUCH.exe3


System errors:
=============
Error: (10/21/2014 07:34:00 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/21/2014 07:34:00 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht.

Error: (10/21/2014 07:31:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Protect Monitor" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/21/2014 07:31:46 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Protect Monitor erreicht.

Error: (10/21/2014 07:31:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/21/2014 07:31:37 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht.

Error: (10/19/2014 05:10:53 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {03428D95-1CFE-4BA3-B579-143FCE9C34B0}

Error: (10/19/2014 04:37:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Protect Monitor" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/19/2014 04:37:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Protect Monitor erreicht.

Error: (10/19/2014 04:37:05 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053


Microsoft Office Sessions:
=========================
Error: (10/21/2014 07:32:51 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Explorer.EXE6.1.7601.175675d001cfed54c22381a316C:\windows\Explorer.EXE2dcfc3f0-5948-11e4-b569-e4d53deed6cd

Error: (10/18/2014 00:56:44 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Microsoft .NET Framework 4.5.1KB29721071603C:\windows\TEMP\KB2972107_20141018_125619030-Microsoft .NET Framework 4.5.1-MSP0.txt(NULL)(NULL)

Error: (10/18/2014 00:56:12 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Microsoft .NET Framework 4.5.1KB2979578v21603C:\windows\TEMP\KB2979578_20141018_125530561-Microsoft .NET Framework 4.5.1-MSP0.txt(NULL)(NULL)

Error: (10/17/2014 05:16:36 PM) (Source: .NET Runtime Optimization Service) (EventID: 1103) (User: )
Description: .NET Runtime Optimization Service (clr_optimization_v2.0.50727_64) - Tried to start a service that wasn't the latest version of CLR Optimization service. Will shutdown

Error: (10/15/2014 07:54:56 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Microsoft .NET Framework 4.5.1KB29721071603C:\windows\TEMP\KB2972107_20141015_195433659-Microsoft .NET Framework 4.5.1-MSP0.txt(NULL)(NULL)

Error: (10/15/2014 07:54:28 PM) (Source: MsiInstaller) (EventID: 1023) (User: NT-AUTORITÄT)
Description: Microsoft .NET Framework 4.5.1KB2979578v21603C:\windows\TEMP\KB2979578_20141015_195351633-Microsoft .NET Framework 4.5.1-MSP0.txt(NULL)(NULL)

Error: (10/15/2014 07:45:18 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: 
Details:
AddWin32ServiceFiles: Unable to back up image of service Microsoft .NET Framework NGEN v4.0.30319_X64 since QueryServiceConfig API failed

System Error:
Das System kann die angegebene Datei nicht finden.

Error: (10/15/2014 06:10:43 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Mein CEWE FOTOBUCH.exe0.0.0.0533cfc31ntdll.dll6.1.7601.18247521eaf24c0000005000000000003411813cc01cfe8923781a04aC:\Program Files\CEWE\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exeC:\windows\SYSTEM32\ntdll.dlld031b5b6-5485-11e4-b064-24b6fd230c7b

Error: (10/11/2014 04:20:03 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: PMK.exe6.0.11.994fd01058uPhotoStitchEngine.dll5.0.0.114eba092ec000000500069fff16c401cfe55cd536f796C:\Program Files (x86)\Pixxsel\Panorama Project 2\PMK.exeC:\Program Files (x86)\Pixxsel\Panorama Project 2\uPhotoStitchEngine.dllb05b820a-5151-11e4-8fc0-24b6fd230c7b

Error: (10/11/2014 04:09:14 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Mein CEWE FOTOBUCH.exe0.0.0.0533cfc31Qt5Core.dll5.1.1.052a8888dc000041d00000000001b1d9b8dc01cfe55415ff819dC:\Program Files\CEWE\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exeC:\Program Files\CEWE\Mein CEWE FOTOBUCH\Qt5Core.dll2dc8e200-5150-11e4-8fc0-24b6fd230c7b


CodeIntegrity Errors:
===================================
  Date: 2014-10-17 17:34:22.777
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-21 10:51:26.911
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-21 10:51:26.624
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-21 10:50:27.362
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 47%
Total physical RAM: 4004.27 MB
Available physical RAM: 2086.61 MB
Total Pagefile: 8006.73 MB
Available Pagefile: 5770.32 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:120 GB) (Free:70.46 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:331.01 GB) (Free:294.79 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EEB859DE)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=120 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=331 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Wie gesagt (geschrieben), vielen Dank fürs drüber schauen

cYbBe

Anbei noch der Log von GMER

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-21 19:56:51
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST500LM0 rev.2AR1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Stefanie\AppData\Local\Temp\uxlyrkob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                                                                                                  fffff800033ae000 65 bytes [00, 00, 15, 02, 46, 69, 6C, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 594                                                                                                                                                                                  fffff800033ae042 4 bytes [00, 00, 00, 00]

---- User code sections - GMER 2.1 ----

.text     C:\windows\system32\wininit.exe[604] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                          00000000771bef8d 1 byte [62]
.text     C:\windows\system32\services.exe[660] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                         00000000771bef8d 1 byte [62]
.text     C:\windows\system32\winlogon.exe[752] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                         00000000771bef8d 1 byte [62]
.text     C:\windows\System32\svchost.exe[344] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                          00000000771bef8d 1 byte [62]
.text     C:\windows\system32\svchost.exe[452] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                          00000000771bef8d 1 byte [62]
.text     C:\windows\system32\svchost.exe[480] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                          00000000771bef8d 1 byte [62]
.text     C:\Program Files\IDT\WDM\STacSV64.exe[572] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                    00000000771bef8d 1 byte [62]
.text     C:\windows\system32\WLANExt.exe[1336] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                         00000000771bef8d 1 byte [62]
.text     C:\windows\system32\Dwm.exe[1464] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                             00000000771bef8d 1 byte [62]
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                       0000000075bda2fd 1 byte [62]
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                     0000000075df1401 2 bytes JMP 75bdb21b C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                       0000000075df1419 2 bytes JMP 75bdb346 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                     0000000075df1431 2 bytes JMP 75c58ea9 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                     0000000075df144a 2 bytes CALL 75bb48ad C:\windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                 * 9
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                        0000000075df14dd 2 bytes JMP 75c587a2 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                 0000000075df14f5 2 bytes JMP 75c58978 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                        0000000075df150d 2 bytes JMP 75c58698 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                 0000000075df1525 2 bytes JMP 75c58a62 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                       0000000075df153d 2 bytes JMP 75bcfca8 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                            0000000075df1555 2 bytes JMP 75bd68ef C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                     0000000075df156d 2 bytes JMP 75c58f61 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                       0000000075df1585 2 bytes JMP 75c58ac2 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                          0000000075df159d 2 bytes JMP 75c5865c C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                       0000000075df15b5 2 bytes JMP 75bcfd41 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                     0000000075df15cd 2 bytes JMP 75bdb2dc C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                 0000000075df16b2 2 bytes JMP 75c58e24 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\IePluginServices\PluginService.exe[1628] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                 0000000075df16bd 2 bytes JMP 75c585f1 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\SupTab\HpUI.exe[1712] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                                  0000000075bda2fd 1 byte [62]
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                           0000000075bda2fd 1 byte [62]
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                         0000000075df1401 2 bytes JMP 75bdb21b C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                           0000000075df1419 2 bytes JMP 75bdb346 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                         0000000075df1431 2 bytes JMP 75c58ea9 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                         0000000075df144a 2 bytes CALL 75bb48ad C:\windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                 * 9
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                            0000000075df14dd 2 bytes JMP 75c587a2 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                     0000000075df14f5 2 bytes JMP 75c58978 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                            0000000075df150d 2 bytes JMP 75c58698 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                     0000000075df1525 2 bytes JMP 75c58a62 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                           0000000075df153d 2 bytes JMP 75bcfca8 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                0000000075df1555 2 bytes JMP 75bd68ef C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                         0000000075df156d 2 bytes JMP 75c58f61 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                           0000000075df1585 2 bytes JMP 75c58ac2 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                              0000000075df159d 2 bytes JMP 75c5865c C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                           0000000075df15b5 2 bytes JMP 75bcfd41 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                         0000000075df15cd 2 bytes JMP 75bdb2dc C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                     0000000075df16b2 2 bytes JMP 75c58e24 C:\windows\syswow64\kernel32.dll
.text     C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1728] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                     0000000075df16bd 2 bytes JMP 75c585f1 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                   0000000075bda2fd 1 byte [62]
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                 0000000075df1401 2 bytes JMP 75bdb21b C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                   0000000075df1419 2 bytes JMP 75bdb346 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                 0000000075df1431 2 bytes JMP 75c58ea9 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                 0000000075df144a 2 bytes CALL 75bb48ad C:\windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                 * 9
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                    0000000075df14dd 2 bytes JMP 75c587a2 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                             0000000075df14f5 2 bytes JMP 75c58978 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                    0000000075df150d 2 bytes JMP 75c58698 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                             0000000075df1525 2 bytes JMP 75c58a62 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                   0000000075df153d 2 bytes JMP 75bcfca8 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                        0000000075df1555 2 bytes JMP 75bd68ef C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                 0000000075df156d 2 bytes JMP 75c58f61 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                   0000000075df1585 2 bytes JMP 75c58ac2 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                      0000000075df159d 2 bytes JMP 75c5865c C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                   0000000075df15b5 2 bytes JMP 75bcfd41 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                 0000000075df15cd 2 bytes JMP 75bdb2dc C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                             0000000075df16b2 2 bytes JMP 75c58e24 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe[1936] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                             0000000075df16bd 2 bytes JMP 75c585f1 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2052] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                            0000000075bda2fd 1 byte [62]
.text     C:\Program Files (x86)\SupTab\Loader32.exe[2284] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                              0000000075bda2fd 1 byte [62]
.text     C:\Program Files\IDT\WDM\AESTSr64.exe[2296] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                   00000000771bef8d 1 byte [62]
.text     C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe[2376] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                 00000000771bef8d 1 byte [62]
.text     C:\Program Files\DellTPad\Apoint.exe[2612] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                    00000000771bef8d 1 byte [62]
.text     C:\Program Files\IDT\WDM\sttray64.exe[2648] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                   00000000771bef8d 1 byte [62]
.text     C:\Program Files\Dell\QuickSet\quickset.exe[2708] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                             00000000771bef8d 1 byte [62]
.text     C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe[2756] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                             00000000771bef8d 1 byte [62]
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                       0000000075bda2fd 1 byte [62]
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                     0000000075df1401 2 bytes JMP 75bdb21b C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                       0000000075df1419 2 bytes JMP 75bdb346 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                     0000000075df1431 2 bytes JMP 75c58ea9 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                     0000000075df144a 2 bytes CALL 75bb48ad C:\windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                 * 9
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                        0000000075df14dd 2 bytes JMP 75c587a2 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                 0000000075df14f5 2 bytes JMP 75c58978 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                        0000000075df150d 2 bytes JMP 75c58698 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                 0000000075df1525 2 bytes JMP 75c58a62 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                       0000000075df153d 2 bytes JMP 75bcfca8 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                            0000000075df1555 2 bytes JMP 75bd68ef C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                     0000000075df156d 2 bytes JMP 75c58f61 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                       0000000075df1585 2 bytes JMP 75c58ac2 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                          0000000075df159d 2 bytes JMP 75c5865c C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                       0000000075df15b5 2 bytes JMP 75bcfd41 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                     0000000075df15cd 2 bytes JMP 75bdb2dc C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                 0000000075df16b2 2 bytes JMP 75c58e24 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe[2808] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                 0000000075df16bd 2 bytes JMP 75c585f1 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe[2920] C:\windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                                                                                                              00000000771bef8d 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[2968] C:\windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                                                           0000000075bda2fd 1 byte [62]
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[2980] C:\windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                                                0000000075bb8791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[2980] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                       0000000075bda2fd 1 byte [62]
.text     C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[2988] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                              0000000075bda2fd 1 byte [62]
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                                                                              0000000075bda2fd 1 byte [62]
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                            0000000075df1401 2 bytes JMP 75bdb21b C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                              0000000075df1419 2 bytes JMP 75bdb346 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                            0000000075df1431 2 bytes JMP 75c58ea9 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                            0000000075df144a 2 bytes CALL 75bb48ad C:\windows\syswow64\KERNEL32.dll
.text     ...                                                                                                                                                                                                                                                 * 9
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                               0000000075df14dd 2 bytes JMP 75c587a2 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                        0000000075df14f5 2 bytes JMP 75c58978 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                               0000000075df150d 2 bytes JMP 75c58698 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                        0000000075df1525 2 bytes JMP 75c58a62 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                              0000000075df153d 2 bytes JMP 75bcfca8 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                   0000000075df1555 2 bytes JMP 75bd68ef C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                            0000000075df156d 2 bytes JMP 75c58f61 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                              0000000075df1585 2 bytes JMP 75c58ac2 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                 0000000075df159d 2 bytes JMP 75c5865c C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                              0000000075df15b5 2 bytes JMP 75bcfd41 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                            0000000075df15cd 2 bytes JMP 75bdb2dc C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                        0000000075df16b2 2 bytes JMP 75c58e24 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe[2504] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                        0000000075df16bd 2 bytes JMP 75c585f1 C:\windows\syswow64\KERNEL32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                   0000000075bda2fd 1 byte [62]
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                 0000000075df1401 2 bytes JMP 75bdb21b C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                   0000000075df1419 2 bytes JMP 75bdb346 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                 0000000075df1431 2 bytes JMP 75c58ea9 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                 0000000075df144a 2 bytes CALL 75bb48ad C:\windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                                                                                 * 9
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                    0000000075df14dd 2 bytes JMP 75c587a2 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                             0000000075df14f5 2 bytes JMP 75c58978 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                    0000000075df150d 2 bytes JMP 75c58698 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                             0000000075df1525 2 bytes JMP 75c58a62 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                   0000000075df153d 2 bytes JMP 75bcfca8 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                        0000000075df1555 2 bytes JMP 75bd68ef C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                 0000000075df156d 2 bytes JMP 75c58f61 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                   0000000075df1585 2 bytes JMP 75c58ac2 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                      0000000075df159d 2 bytes JMP 75c5865c C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                   0000000075df15b5 2 bytes JMP 75bcfd41 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                 0000000075df15cd 2 bytes JMP 75bdb2dc C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                             0000000075df16b2 2 bytes JMP 75c58e24 C:\windows\syswow64\kernel32.dll
.text     C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe[3152] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                             0000000075df16bd 2 bytes JMP 75c585f1 C:\windows\syswow64\kernel32.dll
.text     C:\Program Files\DellTPad\ApMsgFwd.exe[3916] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                  00000000771bef8d 1 byte [62]
.text     C:\Program Files\DellTPad\Apntex.exe[4064] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                    00000000771bef8d 1 byte [62]
.text     C:\windows\system32\conhost.exe[2956] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                         00000000771bef8d 1 byte [62]
.text     C:\windows\explorer.exe[3176] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                                 00000000771bef8d 1 byte [62]
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                                          0000000075bda2fd 1 byte [62]
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                        0000000075df1401 2 bytes JMP 75bdb21b C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                          0000000075df1419 2 bytes JMP 75bdb346 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                        0000000075df1431 2 bytes JMP 75c58ea9 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                        0000000075df144a 2 bytes CALL 75bb48ad C:\windows\syswow64\KERNEL32.dll
.text     ...                                                                                                                                                                                                                                                 * 9
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                           0000000075df14dd 2 bytes JMP 75c587a2 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                    0000000075df14f5 2 bytes JMP 75c58978 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                           0000000075df150d 2 bytes JMP 75c58698 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                    0000000075df1525 2 bytes JMP 75c58a62 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                          0000000075df153d 2 bytes JMP 75bcfca8 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                               0000000075df1555 2 bytes JMP 75bd68ef C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                        0000000075df156d 2 bytes JMP 75c58f61 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                          0000000075df1585 2 bytes JMP 75c58ac2 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                             0000000075df159d 2 bytes JMP 75c5865c C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                          0000000075df15b5 2 bytes JMP 75bcfd41 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                        0000000075df15cd 2 bytes JMP 75bdb2dc C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                    0000000075df16b2 2 bytes JMP 75c58e24 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[4768] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                    0000000075df16bd 2 bytes JMP 75c585f1 C:\windows\syswow64\KERNEL32.dll
.text     C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5092] C:\windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112                                                                                                     0000000075bda2fd 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2436] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                          0000000075bda2fd 1 byte [62]
.text     C:\windows\System32\svchost.exe[3876] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                                         00000000771bef8d 1 byte [62]
.text     C:\Program Files\Windows Media Player\wmpnetwk.exe[4544] C:\windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                                                      00000000771bef8d 1 byte [62]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[808] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                           0000000075bda2fd 1 byte [62]
.text     D:\Stefanie\Downloads\Gmer-19357.exe[2116] C:\windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                                                                    0000000075bda2fd 1 byte [62]

---- Threads - GMER 2.1 ----

Thread    C:\windows\System32\svchost.exe [3876:3296]                                                                                                                                                                                                         000007fee3e39688
---- Processes - GMER 2.1 ----

Process   C:\ProgramData\IePluginServices\PluginService.exe (*** suspicious ***) @ C:\ProgramData\IePluginServices\PluginService.exe [1628] (IePlugin Service/Cherished Technololgy LIMITED)(2014-09-20 20:27:25)                                             00000000001c0000
Process   C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [1728] (WindowsProtectManger Service/Fuyu LIMITED)(2014-09-20 20:27:15)                          00000000002b0000
Process   C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (iLivid Download Manager/Bandoo Media Inc.)(2014-05-25 19:00:39)                                                  0000000001340000
Library   C:\Users\Stefanie\AppData\Local\iLivid\QtCore4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:39)              0000000070080000
Library   C:\Users\Stefanie\AppData\Local\iLivid\MSVCP100.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (Microsoft® C Runtime Library/Microsoft Corporation)(2014-05-25 19:00:39)                                       0000000071020000
Library   C:\Users\Stefanie\AppData\Local\iLivid\MSVCR100.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (Microsoft® C Runtime Library/Microsoft Corporation)(2014-05-25 19:00:39)                                       000000006fa10000
Library   C:\Users\Stefanie\AppData\Local\iLivid\QtGui4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:40)               000000006de30000
Library   C:\Users\Stefanie\AppData\Local\iLivid\QtNetwork4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:40)           000000006da20000
Library   C:\Users\Stefanie\AppData\Local\iLivid\QtXml4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:40)               000000006d9c0000
Library   C:\Users\Stefanie\AppData\Local\iLivid\QtWebKit4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:40)            000000006c8b0000
Library   C:\Users\Stefanie\AppData\Local\iLivid\LIBEAY32.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (OpenSSL Shared Library/The OpenSSL Project, hxxp://www.openssl.org/)(2014-05-25 19:00:39)                      000000006c790000
Library   C:\Users\Stefanie\AppData\Local\iLivid\SSLEAY32.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (OpenSSL Shared Library/The OpenSSL Project, hxxp://www.openssl.org/)(2014-05-25 19:00:40)                      000000006c740000
Library   C:\Users\Stefanie\AppData\Local\iLivid\imageformats\qico4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:39)   0000000074a00000
Library   C:\Users\Stefanie\AppData\Local\iLivid\imageformats\qgif4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:39)   0000000073a70000
Library   C:\Users\Stefanie\AppData\Local\iLivid\imageformats\qjpeg4.dll (*** suspicious ***) @ C:\Users\Stefanie\AppData\Local\iLivid\iLivid.exe [2808] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-05-25 19:00:39)  00000000737f0000
Process   C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe (*** suspicious ***) @ C:\Users\Stefanie\AppData\Roaming\VOPackage\VOsrv.exe [3152](2014-09-20 20:27:19)                                                                                      0000000000b10000

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015007f6c3b                                                                                                                                                                         
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38d054a8                                                                                                                                                                         
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e4d53deed6ce                                                                                                                                                                         
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015007f6c3b (not active ControlSet)                                                                                                                                                     
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38d054a8 (not active ControlSet)                                                                                                                                                     
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e4d53deed6ce (not active ControlSet)                                                                                                                                                     

---- EOF - GMER 2.1 ----
         

cybbe

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
• Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
• Bitte kein Crossposting (posten in mehreren Foren).
• Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
• Speichere alle unsere Tools auf dem Desktop ab. Link: So ladet Ihr unsere Tools richtig
• Poste die Logfiles direkt in Deinen Thread in Code-Tags.
• Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean bekommst.

Los geht's:


Schritt 1

Bitte deinstalliere folgende Programme:

iLivid
Performance Optimizer
Remote Desktop Access
Shopop
webssearches uninstall
WindowsMangerProtect
Yontoo 1.10.02
Malwarebytes Anti-Malware Version 1.75
Java 7 Update 45 (64-bit)
Java 7 Update 45
Mozilla Firefox 15.0.1


Versuche es bei Windows 7 zunächst über Systemsteuerung/Programme deinstallieren.

Sollte das nicht gehen, lade Dir bitte Revo Uninstallerhier herunter. Entpacke die zip-Datei auf den Desktop.
(Anleitung zu Revo)

• Starte die Revouninstaller.exe
• Klicke auf Optionen und wähle als Sprache Deutsch.
• Suche im Uninstallerfeld nach den oben angegebenen Programmen und wähle sie einzeln aus.
  Klicke jedes Mal auf Uninstall.
• Wähle anschließend den Modus "Moderat" aus.
  
• Reste löschen:
  Klicke auf dann auf und dann auf .

Wenn Du ein Programm nicht deinstallieren kannst, mach mit dem nächsten weiter.
Auch wenn am Ende noch Programme übrig geblieben sind, führe den nächsten Schritt aus:


Schritt 2
Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 3

Malwarebytes Antimalware

• Download-Link
• Installiere das Programm in den vorgegebenen Pfad.
• Starte Malwarebytes' Anti-Malware (MBAM).
• Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
• Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
• Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
• Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 4
Download von ZOEK (by Smeenk)

• Speichere die zoek.exe auf dem Desktop.
• Bitte deaktiviere während der Verwendung von Zoek Deinen Virenscanner, da dieser Zoek stören könnte.
• Starte die zoek.exe mit einem Doppelklick und warte bis die Programmoberfläche erscheint (ca. 30 Sekunden)
• Kopiere den Text der folgenden Box in das Skriptfenster von Zoek:
  

  systemspecs;
  autoclean;
  FFdefaults;
  iedefaults;
  CHRdefaults;
  emptyclsid;
           

• Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
  

  Zoek.exe is running now.
  Do not start any browser windows, they may get closed automatically.
  Please wait! This window will close when finished.
  A logfile will open afterwards and can also be found on your systemdrive as zoek-results.log

• Wenn das Tool fertig ist, wird sich eine Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter C:\
• Bitte poste mir das zoek-results.log.

Schritt 5



Bitte starte FRST erneut, markiere auch die checkbox und drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Hallo Jürgen,

erst einmal vielen Dank für die schnelle Unterstützung.
Anbei die Logs der verschiedenen Programme. Zum Malwarebytes muss ich noch sagen, dass er im ersten Scan über 1700 Funde hatte. Da hatte ich leider vergessen Rootkits mit anzuhaken. Beim 2ten hat er dann nur noch einen Fund gehabt (siehe Log). Komischerweise finde ich den Log mit der großen Anzahl an Bedrohungen nicht...

# AdwCleaner v4.001 - Bericht erstellt am 21/10/2014 um 21:02:32
# DB v2014-10-20.3
# Aktualisiert 20/10/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Stefanie - STEFANIE-PC
# Gestartet von : D:\Stefanie\Downloads\AdwCleaner_4.001.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Browser Manager
Ordner Gelöscht : C:\Users\Stefanie\AppData\Roaming\Claro
Ordner Gelöscht : C:\Users\Stefanie\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\ProgramData\InstallBrainService
Ordner Gelöscht : C:\ProgramData\Performance Optimizer
Ordner Gelöscht : C:\Users\Stefanie\AppData\Roaming\PerformerSoft
Ordner Gelöscht : C:\Program Files (x86)\predm
Ordner Gelöscht : C:\Users\Stefanie\AppData\LocalLow\Smartbar
Ordner Gelöscht : C:\Users\Stefanie\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Stefanie\AppData\Roaming\Systweak
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\engeblojhfeingnjnfpiceofljnjpldp
[!] Ordner Gelöscht : C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\engeblojhfeingnjnfpiceofljnjpldp
Datei Gelöscht : C:\Users\Stefanie\AppData\Local\CRE\engeblojhfeingnjnfpiceofljnjpldp.crx
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\webssearches.xml
Datei Gelöscht : C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_images.search.conduit.com_0.localstorage-journal
Datei Gelöscht : C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Stefanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Stefanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Stefanie\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\engeblojhfeingnjnfpiceofljnjpldp
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\engeblojhfeingnjnfpiceofljnjpldp
Schlüssel Gelöscht : HKCU\Software\Classes\iLivid.torrent
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [BrowserMngrDefaultScope]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iLivid.torrent
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASMANCS
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\IePluginServices
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WindowsMangerProtect
Schlüssel Gelöscht : HKCU\Software\5c55da8cbc3ab845
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hugin (1)_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hugin (1)_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C3110516-8EFC-49D6-8B72-69354F332062}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{065C1A21-97F8-45FB-A9F0-861B60FACEC8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3204358F-5904-46A6-841F-D6B5BE3EF4E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3AE67737-0E3E-44AA-AA5E-46A68BF017FF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3EE5B726-044A-48D2-AA7B-049BD9A0F62A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60FBBE03-57FF-49D8-B38E-053D3F489825}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6A5182F1-C0B8-42B8-96CC-7F329CD46913}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6C153418-8E4D-4FAF-AF27-5201E38463A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A26A2F05-AC4D-4A1E-9531-9125F7309B78}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CC5D6240-7DF0-435D-9B9B-F8586A99DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F343045E-E20A-46E1-82D8-9962C43EFC9E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FBB360DC-CB6C-4D6A-808A-2C773151BFFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFD7DDAC-EC28-42A5-8D39-917B9078604B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{258C9770-1713-4021-8D7E-1F184A2BD754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B29-F830-49DE-A31B-5BB9D7F6B407}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DCC70A83-E184-40A3-906B-779AF5E941C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9CB96984-43C3-4D44-90EF-01466EFCF7BB}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{06E58E5E-F8CB-4049-991E-A41C03BD419E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{258C9770-1713-4021-8D7E-1F184A2BD754}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{43D9E6F0-1776-4897-AE14-ECEDECBAFEC0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5A074B29-F830-49DE-A31B-5BB9D7F6B407}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{5AA2BA46-9913-4DC7-9620-69AB0FA17AE7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{77FEF28E-EB96-44FF-B511-3185DEA48697}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{B580CF65-E151-49C3-B73F-70B13FCA8E86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{C451C08A-EC37-45DF-AAAD-18B51AB5E837}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DCC70A83-E184-40A3-906B-779AF5E941C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKCU\Software\BrowserMngr
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\ilivid
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\Microsoft\Babylon
Schlüssel Gelöscht : HKCU\Software\Microsoft\ClaroDirectory
Schlüssel Gelöscht : HKCU\Software\MyBestOffersToday
Schlüssel Gelöscht : HKCU\Software\Optimizer Pro
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}
Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}
Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\BrowserMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Tarma Installer
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\browse~2\251005~1.80\{c16c1~1\browse~1.dll
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\pcperf~1\23811~1.154\{61d8b~1\pcpmngr.dll
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4B2468513CA2D6943A1A233CD3F88CE7
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\649A52D257CA5DB4EAAE8BA9EB23E467
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\3192AA38321C641458DBDAF83979D193
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17344


-\\ Google Chrome v37.0.2062.103


*************************

AdwCleaner[R0].txt - [16511 octets] - [21/10/2014 21:00:00]
AdwCleaner[S0].txt - [15867 octets] - [21/10/2014 21:02:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15928 octets] ##########
         

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.10.2014
Suchlauf-Zeit: 21:15:08
Logdatei: 
Administrator: Ja

Version: 2.00.3.1025
Malware Datenbank: v2014.10.21.09
Rootkit Datenbank: v2014.10.20.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Stefanie

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 312105
Verstrichene Zeit: 11 Min, 4 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 1
PUP.Optional.Conduit, C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Preferences, Gut: (), Schlecht: (      "suggest_url": "hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}",), Ersetzt,[4b0c30e72e4efb3b8df797c40bfad030]

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

Zoek.exe v5.0.0.0 Updated 19-10-2014
Tool run by Stefanie on 21.10.2014 at 21:29:43,31.
Microsoft Windows 7 Home Premium  6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: D:\Stefanie\Downloads\zoek (1).exe [Scan all users] [Script inserted] 

==== System Restore Info ======================

21.10.2014 21:31:38 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2283762676-3508335138-3058622962-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully
HKEY_CLASSES_ROOT\CLSID\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{318A227B-5E9F-45BD-8999-7F8F10CA4CF5} deleted successfully

==== Deleting Services ======================


==== Deleting Files \ Folders ======================

C:\PROGRA~2\GUM1498.tmp deleted
C:\PROGRA~2\Uninstall Information\ib_uninst_217 deleted
C:\user.js deleted
C:\wget.exe deleted
C:\Users\Stefanie\AppData\Roaming\ZoomBrowser EX deleted
C:\PROGRA~3\Package Cache deleted
C:\Users\Stefanie\AppData\Local\CRE deleted
C:\windows\SysNative\config\systemprofile\Searches deleted
C:\windows\SysWow64\searchplugins deleted
C:\windows\SysWow64\Extensions deleted

==== System Specs ======================

Windows: Windows 7 Home Premium Edition (64-bit) Service Pack 1 (Build 7601)
Memory (RAM): 4005 MB
CPU Info: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
CPU Speed: 2339,1 MHz
Sound Card: Lautsprecher / Kopfhörer (IDT H | 
Kommunikation Kopfhörer (IDT Hi | 
Display Adapters: Intel(R) HD Graphics Family | Intel(R) HD Graphics Family | RDPDD Chained DD | RDP Encoder Mirror Driver | RDP Reflector Display Driver
Monitors: 1x; PnP-Monitor (Standard) | 
Screen Resolution: 1366 X 768 - 32 bit
Network: Network Present
Network Adapters: Microsoft Virtual WiFi Miniport Adapter | Dell Wireless 1701 802.11b/g/n | Realtek PCIe FE Family Controller
CD / DVD Drives: 1x (E: | ) E: PLDS    DVD+-RW DS-8A8SH
Ports: COM Ports NOT Present. LPT Port NOT Present. 
Mouse: 2 Button Wheel Mouse Present
Hard Disks: C:  120,0GB | D:  331,0GB
Hard Disks - Free: C:  70,0GB | D:  295,1GB
Manufacturer *: Dell Inc.
BIOS Info: AT/AT COMPATIBLE | 10/14/11 | DELL   - 1072009
Time Zone: Mitteleuropäische Zeit
Motherboard *: Dell Inc. 01HXXJ
Country: Deutschland 
Language: DEU 

==== System Specs (Software) ======================

Anti-Virus: avast! Antivirus On-access scanning disabled (Outdated)
Anti-Spyware: Windows Defender disabled (Outdated)
Anti-Spyware: avast! Antivirus disabled (Outdated)
Default Browser: Google Chrome	37.0.2062.103
Internet Explorer Version: 11.0.9600.17358 
Google Chrome version: 37.0.2062.103
Adobe Reader version: 11.0.9.29
Flash Player version: 15.0.0.152

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [20.07.2014 19:53]

==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
gomekmidlodglbbmalcneegieacbdmki - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx[20.07.2014 19:53]

Google Voice Search Hotword (Beta) - Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn
FileConverter 1.3 - C:\windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\engeblojhfeingnjnfpiceofljnjpldp
Chrome In-App Payments service - C:\windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda

==== Chromium Startpages ======================

C:\windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences
"homepage": "hxxp://www.google.com",
"urls_to_restore_on_startup": [ "hxxp://www.google.com" ]


==== Chromium Fix ======================

C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_lyrics-und-ubersetzungen.com_0.localstorage-journal deleted successfully
C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_static.unister-adservices.com_0.localstorage-journal deleted successfully
C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.babylon.com_0.localstorage-journal deleted successfully
C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_info.claro-search.com_0.localstorage-journal deleted successfully
C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.claro-search.com_0.localstorage-journal deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Search Page"="hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}"
"Search Bar"="https://de.yahoo.com?fr=hp-avast&type=prc265"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="about:newtab"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://go.microsoft.com/fwlink/?LinkId=69157"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]
"Tabs"="res://ieframe.dll/tabswelcome.htm"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{012E1000-F331-11DB-8314-0800200C9A66} Google  Url="hxxp://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{37692885-2503-44A6-BC37-195C6514BC0A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&r="

==== Reset Google Chrome ======================

C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\web data was reset successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_CURRENT_USER\Software\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Browser Infrastructure Helper deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellStage deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Photosmart 5510 series (NET) deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Stage Remote deleted successfully
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched deleted successfully

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Stefanie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Stefanie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

No FireFox Profiles found

==== Empty Chrome Cache ======================

C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=80 folders=42 119411643 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\Users\Stefanie\AppData\Local\Temp will be emptied at reboot
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\windows\Temp successfully emptied
C:\Users\Stefanie\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 21.10.2014 at 21:51:59,11 ======================
         

...

...
FRST.txt

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-10-2014
Ran by Stefanie (administrator) on STEFANIE-PC on 21-10-2014 21:55:32
Running from D:\Stefanie\Downloads
Loaded Profile: Stefanie (Available profiles: Stefanie)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ArcSoft, Inc.) C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
() C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPNetworkCommunicatorCom.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\hidfind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApntEx.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [608112 2011-03-29] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-05-27] (IDT, Inc.)
HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3668336 2011-03-24] (Dell Inc.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-08-04] (AVAST Software)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2283762676-3508335138-3058622962-1001\...\Run: [HP Photosmart 5520 series (NET)] => C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe [2573416 2012-10-17] (Hewlett-Packard Co.)
HKU\S-1-5-21-2283762676-3508335138-3058622962-1001\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [688984 2014-09-18] (Garmin Ltd or its subsidiaries)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ImageBrowser EX Agent.lnk
ShortcutTarget: ImageBrowser EX Agent.lnk -> C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe ()
Startup: C:\Users\Stefanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Photosmart 5520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Photosmart 5520 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://de.yhs4.search.yahoo.com/yhs/search?type=prc265&hspart=avast&hsimp=yhs-001&p={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://de.yahoo.com?fr=hp-avast&type=prc265
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKCU - DefaultScope {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = hxxp://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {37692885-2503-44A6-BC37-195C6514BC0A} URL = hxxp://www.bing.com/search?q={searchTerms}&r=
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} hxxp://content.systemrequirementslab.com/bin/srldetect_intel_4.5.15.0.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension
FF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2012-07-16]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-07-29]
FF StartMenuInternet: FIREFOX.EXE - firefox.exe

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.de/
CHR StartupUrls: Default -> "hxxp://www.google.de/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Präsentationen) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-10-21]
CHR Extension: (Google Docs) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-06-07]
CHR Extension: (Google Drive) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-07]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-09-05]
CHR Extension: (YouTube) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-07]
CHR Extension: (Google-Suche) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-07]
CHR Extension: (Google Tabellen) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-10-21]
CHR Extension: (Google Wallet) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-09]
CHR Extension: (Google Mail) - C:\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-07]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-20]
CHR StartMenuInternet: Google Chrome - Chrome.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 ADExchange; C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe [43072 2012-03-19] (ArcSoft, Inc.)
R2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-20] (AVAST Software)
S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [450904 2014-09-18] (Garmin Ltd or its subsidiaries)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-20] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-07-20] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-20] ()
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-21] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
R0 PxHlpa64; C:\Windows\System32\Drivers\PxHlpa64.sys [56336 2013-07-19] (Corel Corporation)
S3 PCDSRVC{D3412D80-CF3B4A27-06020200}_0; \??\c:\program files\my dell\pcdsrvc_x64.pkms [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-21 21:49 - 2014-10-21 21:29 - 00024064 _____ () C:\windows\zoek-delete.exe
2014-10-21 21:31 - 2014-10-21 21:51 - 00010200 _____ () C:\zoek-results.log
2014-10-21 21:29 - 2014-10-21 21:47 - 00000000 ____D () C:\zoek_backup
2014-10-21 21:10 - 2014-10-21 21:26 - 00001408 _____ () C:\Users\Stefanie\Desktop\malware.txt
2014-10-21 21:07 - 2014-10-21 21:07 - 00016141 _____ () C:\Users\Stefanie\Desktop\AdwCleaner[S0].txt
2014-10-21 20:59 - 2014-10-21 21:03 - 00000000 ____D () C:\AdwCleaner
2014-10-21 20:40 - 2014-10-21 21:50 - 00000168 _____ () C:\windows\setupact.log
2014-10-21 20:40 - 2014-10-21 20:40 - 00000000 _____ () C:\windows\setuperr.log
2014-10-21 20:39 - 2014-10-21 21:50 - 00502490 _____ () C:\windows\PFRO.log
2014-10-21 20:21 - 2014-10-21 21:51 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-21 20:21 - 2014-10-21 20:21 - 00001108 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-10-21 20:21 - 2014-10-21 20:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-10-21 20:21 - 2014-10-21 20:21 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2014-10-21 20:21 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-10-21 20:21 - 2014-10-01 11:11 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-10-21 20:17 - 2014-10-21 20:17 - 00000000 ____D () C:\Users\Stefanie\AppData\Roaming\No Company Name
2014-10-21 20:02 - 2014-10-21 20:02 - 00000000 __SHD () C:\Users\Stefanie\AppData\Local\EmieUserList
2014-10-21 20:02 - 2014-10-21 20:02 - 00000000 __SHD () C:\Users\Stefanie\AppData\Local\EmieSiteList
2014-10-21 19:56 - 2014-10-21 19:56 - 00059277 _____ () C:\Users\Stefanie\Desktop\gmer.log
2014-10-21 19:48 - 2014-10-21 19:48 - 00085557 _____ () C:\Users\Stefanie\Desktop\Plagegeister, aber welche!.txt
2014-10-21 19:40 - 2014-10-21 21:55 - 00000000 ____D () C:\FRST
2014-10-15 18:24 - 2014-09-29 02:58 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-10-15 18:24 - 2014-08-19 05:11 - 00693176 _____ (Microsoft Corporation) C:\windows\system32\winload.efi
2014-10-15 18:24 - 2014-08-19 05:10 - 00616352 _____ (Microsoft Corporation) C:\windows\system32\winresume.efi
2014-10-15 18:24 - 2014-07-07 04:07 - 14632960 _____ (Microsoft Corporation) C:\windows\system32\wmp.dll
2014-10-15 18:24 - 2014-07-07 04:07 - 00782848 _____ (Microsoft Corporation) C:\windows\system32\wmdrmsdk.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 04120576 _____ (Microsoft Corporation) C:\windows\system32\mf.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 01574400 _____ (Microsoft Corporation) C:\windows\system32\quartz.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 01202176 _____ (Microsoft Corporation) C:\windows\system32\drmv2clt.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00842240 _____ (Microsoft Corporation) C:\windows\system32\blackbox.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00497664 _____ (Microsoft Corporation) C:\windows\system32\drmmgrtn.dll
2014-10-15 18:24 - 2014-07-07 04:06 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2014-10-15 18:24 - 2014-07-07 03:52 - 00663552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\PEAuth.sys
2014-10-15 18:24 - 2014-07-07 03:40 - 11411456 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmp.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 03208704 _____ (Microsoft Corporation) C:\windows\SysWOW64\mf.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00988160 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmv2clt.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00744960 _____ (Microsoft Corporation) C:\windows\SysWOW64\blackbox.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00617984 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmdrmsdk.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2014-10-15 18:24 - 2014-07-07 03:40 - 00406016 _____ (Microsoft Corporation) C:\windows\SysWOW64\drmmgrtn.dll
2014-10-15 18:24 - 2014-06-28 02:21 - 00457400 _____ (Microsoft Corporation) C:\windows\system32\ci.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 01943696 _____ (Microsoft Corporation) C:\windows\system32\dfshim.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 01131664 _____ (Microsoft Corporation) C:\windows\SysWOW64\dfshim.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00156824 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscorier.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00156312 _____ (Microsoft Corporation) C:\windows\system32\mscorier.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00081560 _____ (Microsoft Corporation) C:\windows\SysWOW64\mscories.dll
2014-10-15 18:24 - 2014-06-19 00:23 - 00073880 _____ (Microsoft Corporation) C:\windows\system32\mscories.dll
2014-10-15 18:23 - 2014-10-10 04:05 - 00507392 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-10-15 18:23 - 2014-10-10 04:05 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-10-15 18:23 - 2014-10-10 04:00 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-10-15 18:23 - 2014-10-07 04:54 - 00378552 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-10-15 18:23 - 2014-10-07 04:04 - 00331448 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-10-15 18:23 - 2014-09-26 00:50 - 13619200 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-10-15 18:23 - 2014-09-26 00:46 - 00365056 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-10-15 18:23 - 2014-09-26 00:46 - 00243200 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-10-15 18:23 - 2014-09-26 00:46 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-10-15 18:23 - 2014-09-26 00:43 - 11807232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-10-15 18:23 - 2014-09-26 00:32 - 02017280 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-10-15 18:23 - 2014-09-26 00:31 - 02108416 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-10-15 18:23 - 2014-09-19 04:25 - 23631360 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-10-15 18:23 - 2014-09-19 03:56 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-10-15 18:23 - 2014-09-19 03:55 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-10-15 18:23 - 2014-09-19 03:44 - 17484800 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-10-15 18:23 - 2014-09-19 03:41 - 02796032 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-10-15 18:23 - 2014-09-19 03:40 - 00547328 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-10-15 18:23 - 2014-09-19 03:40 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-10-15 18:23 - 2014-09-19 03:39 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-10-15 18:23 - 2014-09-19 03:38 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-10-15 18:23 - 2014-09-19 03:36 - 05829632 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-10-15 18:23 - 2014-09-19 03:31 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-10-15 18:23 - 2014-09-19 03:30 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-10-15 18:23 - 2014-09-19 03:27 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-10-15 18:23 - 2014-09-19 03:26 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-10-15 18:23 - 2014-09-19 03:25 - 04201472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-10-15 18:23 - 2014-09-19 03:25 - 00758272 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-10-15 18:23 - 2014-09-19 03:25 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-10-15 18:23 - 2014-09-19 03:18 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-10-15 18:23 - 2014-09-19 03:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-10-15 18:23 - 2014-09-19 03:14 - 00446464 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-10-15 18:23 - 2014-09-19 03:06 - 00072704 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-10-15 18:23 - 2014-09-19 03:02 - 00454656 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-10-15 18:23 - 2014-09-19 03:01 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-10-15 18:23 - 2014-09-19 03:01 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-10-15 18:23 - 2014-09-19 03:01 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-10-15 18:23 - 2014-09-19 03:00 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-10-15 18:23 - 2014-09-19 02:59 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-10-15 18:23 - 2014-09-19 02:58 - 00289280 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-10-15 18:23 - 2014-09-19 02:55 - 02187264 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-10-15 18:23 - 2014-09-19 02:54 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-10-15 18:23 - 2014-09-19 02:53 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-10-15 18:23 - 2014-09-19 02:51 - 00440320 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-10-15 18:23 - 2014-09-19 02:50 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-10-15 18:23 - 2014-09-19 02:49 - 00597504 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-10-15 18:23 - 2014-09-19 02:42 - 00731136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-10-15 18:23 - 2014-09-19 02:42 - 00710656 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-10-15 18:23 - 2014-09-19 02:40 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-10-15 18:23 - 2014-09-19 02:36 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 18:23 - 2014-09-19 02:33 - 02309632 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-10-15 18:23 - 2014-09-19 02:32 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-10-15 18:23 - 2014-09-19 02:20 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-10-15 18:23 - 2014-09-19 02:18 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-10-15 18:23 - 2014-09-19 02:14 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-10-15 18:23 - 2014-09-19 01:59 - 01810944 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-10-15 18:23 - 2014-09-19 01:59 - 00775168 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-10-15 18:23 - 2014-09-19 01:53 - 01190400 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-10-15 18:23 - 2014-09-19 01:52 - 00678400 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-10-15 18:23 - 2014-08-19 05:08 - 00503808 _____ (Microsoft Corporation) C:\windows\system32\srcore.dll
2014-10-15 18:23 - 2014-08-19 05:08 - 00063488 _____ (Microsoft Corporation) C:\windows\system32\setbcdlocale.dll
2014-10-15 18:23 - 2014-08-19 05:08 - 00050176 _____ (Microsoft Corporation) C:\windows\system32\srclient.dll
2014-10-15 18:23 - 2014-08-19 05:07 - 00296960 _____ (Microsoft Corporation) C:\windows\system32\rstrui.exe
2014-10-15 18:23 - 2014-08-19 05:07 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\appidpolicyconverter.exe
2014-10-15 18:23 - 2014-08-19 05:07 - 00058880 _____ (Microsoft Corporation) C:\windows\system32\appidapi.dll
2014-10-15 18:23 - 2014-08-19 05:07 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\appidsvc.dll
2014-10-15 18:23 - 2014-08-19 05:07 - 00017920 _____ (Microsoft Corporation) C:\windows\system32\appidcertstorecheck.exe
2014-10-15 18:23 - 2014-08-19 04:41 - 00050688 _____ (Microsoft Corporation) C:\windows\SysWOW64\appidapi.dll
2014-10-15 18:23 - 2014-08-19 04:41 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\srclient.dll
2014-10-15 18:23 - 2014-08-19 04:06 - 00061440 _____ (Microsoft Corporation) C:\windows\system32\Drivers\appid.sys
2014-10-15 18:23 - 2014-07-07 04:07 - 00229376 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 05551032 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-10-15 18:23 - 2014-07-07 04:06 - 01480192 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 01069056 _____ (Microsoft Corporation) C:\windows\system32\cryptui.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00679424 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00641024 _____ (Microsoft Corporation) C:\windows\system32\msscp.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\evr.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00432128 _____ (Microsoft Corporation) C:\windows\system32\mfplat.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00325632 _____ (Microsoft Corporation) C:\windows\system32\msnetobj.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00206848 _____ (Microsoft Corporation) C:\windows\system32\mfps.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00188416 _____ (Microsoft Corporation) C:\windows\system32\pcasvc.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00187904 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00082432 _____ (Microsoft Corporation) C:\windows\system32\cryptsp.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00055808 _____ (Microsoft Corporation) C:\windows\system32\rrinstaller.exe
2014-10-15 18:23 - 2014-07-07 04:06 - 00024576 _____ (Microsoft Corporation) C:\windows\system32\mfpmp.exe
2014-10-15 18:23 - 2014-07-07 04:06 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\spwmp.dll
2014-10-15 18:23 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\msdxm.ocx
2014-10-15 18:23 - 2014-07-07 04:06 - 00005120 _____ (Microsoft Corporation) C:\windows\system32\dxmasf.dll
2014-10-15 18:23 - 2014-07-07 04:05 - 12625920 _____ (Microsoft Corporation) C:\windows\system32\wmploc.DLL
2014-10-15 18:23 - 2014-07-07 04:05 - 00126464 _____ (Microsoft Corporation) C:\windows\system32\audiodg.exe
2014-10-15 18:23 - 2014-07-07 04:02 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\mferror.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 01329664 _____ (Microsoft Corporation) C:\windows\SysWOW64\quartz.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 01174528 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 01005056 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptui.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00504320 _____ (Microsoft Corporation) C:\windows\SysWOW64\msscp.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00489984 _____ (Microsoft Corporation) C:\windows\SysWOW64\evr.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00354816 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfplat.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00265216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msnetobj.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00179200 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00143872 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00103424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfps.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00081408 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsp.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00008192 _____ (Microsoft Corporation) C:\windows\SysWOW64\spwmp.dll
2014-10-15 18:23 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\msdxm.ocx
2014-10-15 18:23 - 2014-07-07 03:40 - 00004096 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxmasf.dll
2014-10-15 18:23 - 2014-07-07 03:39 - 12625408 _____ (Microsoft Corporation) C:\windows\SysWOW64\wmploc.DLL
2014-10-15 18:23 - 2014-07-07 03:39 - 03970488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-10-15 18:23 - 2014-07-07 03:39 - 03914680 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-10-15 18:23 - 2014-07-07 03:39 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\rrinstaller.exe
2014-10-15 18:23 - 2014-07-07 03:39 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\mfpmp.exe
2014-10-15 18:23 - 2014-07-07 03:37 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\mferror.dll
2014-10-15 18:23 - 2014-06-28 02:21 - 00619056 _____ (Microsoft Corporation) C:\windows\system32\winload.exe
2014-10-15 18:23 - 2014-06-28 02:21 - 00532176 _____ (Microsoft Corporation) C:\windows\system32\winresume.exe
2014-10-15 18:21 - 2014-09-18 04:00 - 03241472 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-10-15 18:21 - 2014-09-18 03:32 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-10-15 18:21 - 2014-09-04 07:23 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\rastls.dll
2014-10-15 18:21 - 2014-09-04 07:04 - 00372736 _____ (Microsoft Corporation) C:\windows\SysWOW64\rastls.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 05780480 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 03179520 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 00322560 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2014-10-15 18:21 - 2014-08-29 04:07 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2014-10-15 18:21 - 2014-08-29 04:06 - 01125888 _____ (Microsoft Corporation) C:\windows\system32\mstsc.exe
2014-10-15 18:21 - 2014-08-29 03:44 - 04922368 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2014-10-15 18:21 - 2014-08-29 03:44 - 01050112 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstsc.exe
2014-10-15 18:21 - 2014-08-29 03:44 - 00269312 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2014-10-15 18:21 - 2014-08-29 03:44 - 00037376 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-10-15 18:21 - 2014-07-17 04:07 - 00235520 _____ (Microsoft Corporation) C:\windows\system32\winsta.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00150528 _____ (Microsoft Corporation) C:\windows\system32\rdpcorekmts.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-10-15 18:21 - 2014-07-17 04:07 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-10-15 18:21 - 2014-07-17 03:40 - 00157696 _____ (Microsoft Corporation) C:\windows\SysWOW64\winsta.dll
2014-10-15 18:21 - 2014-07-17 03:39 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-10-15 18:21 - 2014-07-17 03:39 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-10-15 18:21 - 2014-07-17 03:21 - 00212480 _____ (Microsoft Corporation) C:\windows\system32\Drivers\rdpwd.sys
2014-10-15 18:21 - 2014-07-17 03:21 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
2014-10-15 18:20 - 2014-09-13 03:58 - 00077312 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-10-15 18:20 - 2014-09-13 03:40 - 00067072 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-10-06 20:40 - 2014-10-06 20:40 - 00000000 ____D () C:\Users\Stefanie\AppData\Local\Garmin
2014-10-06 20:39 - 2014-10-06 20:40 - 00000000 ____D () C:\Users\Stefanie\AppData\Roaming\Garmin
2014-10-06 20:39 - 2014-10-06 20:39 - 00000000 ____D () C:\Program Files\DIFX
2014-10-06 20:38 - 2014-10-06 20:40 - 00000000 ____D () C:\ProgramData\Garmin
2014-10-06 20:38 - 2014-10-06 20:39 - 00000000 ____D () C:\Program Files (x86)\Garmin
2014-10-06 20:38 - 2014-10-06 20:38 - 00003556 _____ () C:\windows\System32\Tasks\GarminUpdaterTask
2014-10-06 20:38 - 2014-10-06 20:38 - 00001890 _____ () C:\Users\Public\Desktop\Garmin Express.lnk
2014-10-06 20:38 - 2014-10-06 20:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Garmin
2014-10-03 11:10 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\windows\system32\qdvd.dll
2014-10-03 11:10 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\windows\SysWOW64\qdvd.dll
2014-09-24 18:43 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2014-09-24 18:43 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-21 21:55 - 2012-08-27 19:48 - 01920972 _____ () C:\windows\WindowsUpdate.log
2014-10-21 21:51 - 2012-11-21 15:32 - 00001106 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-21 21:51 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-10-21 21:39 - 2012-11-21 15:32 - 00001110 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-21 21:13 - 2009-07-14 06:45 - 00028352 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-21 21:13 - 2009-07-14 06:45 - 00028352 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-21 21:02 - 2012-11-21 15:35 - 00001284 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-21 21:02 - 2012-11-21 15:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-10-21 21:02 - 2012-07-14 11:24 - 00000963 _____ () C:\Users\Stefanie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-10-21 20:59 - 2013-11-09 14:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-10-21 20:59 - 2012-07-16 20:51 - 00000000 ____D () C:\Users\Stefanie\AppData\Roaming\Mozilla
2014-10-21 20:57 - 2012-08-13 18:05 - 00000884 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-10-21 20:34 - 2012-11-21 15:32 - 00004106 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-21 20:34 - 2012-11-21 15:32 - 00003854 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-21 20:21 - 2013-11-11 08:52 - 00000000 ____D () C:\Users\Stefanie\AppData\Roaming\Malwarebytes
2014-10-21 20:21 - 2013-11-11 08:52 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-21 20:19 - 2012-08-07 19:57 - 00000000 ____D () C:\Users\Stefanie\AppData\Local\Adobe
2014-10-21 20:18 - 2014-03-15 17:55 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-10-19 17:09 - 2012-07-14 12:53 - 00000000 ____D () C:\ProgramData\tmp
2014-10-19 16:36 - 2013-07-29 17:18 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update
2014-10-18 12:56 - 2012-02-11 14:48 - 00699666 _____ () C:\windows\system32\perfh007.dat
2014-10-18 12:56 - 2012-02-11 14:48 - 00149774 _____ () C:\windows\system32\perfc007.dat
2014-10-18 12:56 - 2009-07-14 07:13 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI
2014-10-18 11:07 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-10-18 11:01 - 2013-11-10 10:29 - 00003440 _____ () C:\windows\System32\Tasks\PCDEventLauncherTask
2014-10-17 17:19 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2014-10-17 17:16 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-17 17:14 - 2009-07-14 06:45 - 00396752 _____ () C:\windows\system32\FNTCACHE.DAT
2014-10-17 17:12 - 2014-05-09 20:42 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-10-17 17:12 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\SysWOW64\Dism
2014-10-17 17:12 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\Dism
2014-10-15 19:49 - 2013-08-25 15:58 - 00000000 ____D () C:\windows\system32\MRT
2014-10-15 19:45 - 2012-07-16 20:13 - 103265616 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-10-10 16:47 - 2013-11-09 14:05 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-10-01 11:11 - 2013-11-11 08:52 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-09-24 18:57 - 2014-09-20 22:57 - 03675824 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerInstaller.exe
2014-09-24 18:57 - 2012-08-13 18:05 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-09-24 18:57 - 2012-08-13 18:05 - 00003822 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-09-24 18:57 - 2012-02-11 13:08 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-18 10:53

==================== End Of Log ============================
         

--- --- ---

--- --- ---


Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2014
Ran by Stefanie at 2014-10-21 21:56:56
Running from D:\Stefanie\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

AbiWord 2.9.4 (HKLM-x32\...\AbiWord2) (Version: 2.9.4 - AbiSource Developers)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.9.0.1030 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.9.0.1030 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Photoshop Elements 12 (HKLM-x32\...\Adobe Photoshop Elements 12) (Version: 12.1.0.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 12 (x32 Version: 12.1.0.0 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden
aOUTo (HKCU\...\fbaa9ace9c15fb8c) (Version: 1.1.0.2 - A-rival)
avast! Free Antivirus (HKLM-x32\...\avast) (Version: 9.0.2021 - AVAST Software)
Best Of Gehirnjogging (HKLM-x32\...\Best Of Gehirnjogging) (Version: 1.0 - SBT)
Canon Utilities Digital Photo Professional (HKLM-x32\...\Digital Photo Professional) (Version: 3.13.20.0 - Canon Inc.)
Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 2.13.20.0 - Canon Inc.)
Canon Utilities ImageBrowser EX (HKLM-x32\...\ImageBrowser EX) (Version: 1.4.0.5 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM-x32\...\Picture Style Editor) (Version: 1.13.20.0 - Canon Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 3.20 - Piriform)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.16 - Piriform)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell Product Registration (HKLM-x32\...\{2A0F2CC5-3065-492C-8380-B03AA7106B1A}) (Version: 1.1.3 - Dell Inc.)
Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.1207.101.225 - ALPS ELECTRIC CO., LTD.)
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.00.44 - Creative Technology Ltd)
DirectX 9 Runtime (x32 Version: 1.00.0000 - Sonic Solutions) Hidden
DW WLAN Card (HKLM\...\DW WLAN Card) (Version: 5.100.82.88 - Dell Inc.)
Elements 12 Organizer (x32 Version: 12.0 - Ihr Firmenname) Hidden
Elevated Installer (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express (HKLM-x32\...\{447c27b7-3a63-4cb2-a49c-864050f9a50f}) (Version: 3.2.19.0 - Garmin Ltd or its subsidiaries)
Garmin Express (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden
Garmin Express Tray (x32 Version: 3.2.19.0 - Garmin Ltd or its subsidiaries) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.103 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
HP Photosmart 5510 series - Grundlegende Software für das Gerät (HKLM\...\{AB6268C0-EDA4-46C3-8A1C-11D86A5A8E93}) (Version: 24.0.342.0 - Hewlett-Packard Co.)
HP Photosmart 5520 series - Grundlegende Software für das Gerät (HKLM\...\{4F396B08-301D-4E53-A372-95A7E93ABD04}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Photosmart 5520 series Hilfe (HKLM-x32\...\{640A03B3-4E6B-4440-A350-E6A8D6348F12}) (Version: 27.0.0 - Hewlett Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6341.0 - IDT)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2342 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.2.1004 - Intel Corporation)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kits Configuration Installer (x32 Version: 8.59.25584 - Microsoft) Hidden
Malwarebytes Anti-Malware Version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mein CEWE FOTOBUCH (HKLM-x32\...\Mein CEWE FOTOBUCH) (Version: 5.1.5 - CEWE Stiftung u Co. KGaA)
Meine CEWE FOTOWELT (HKLM-x32\...\Meine CEWE FOTOWELT) (Version: 5.1.3 - CEWE Stiftung u Co. KGaA)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{6AFCA4E1-9B78-3640-8F72-A7BF33448200}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
Panorama Project 2 (HKLM-x32\...\{659C1F41-4687-4B37-93ED-F45A1C98620A}) (Version: 6.0.11.99 - Pixxsel)
PhotoShowExpress (x32 Version: 2.0.063 - Sonic Solutions) Hidden
PSE12 STI Installer (x32 Version: 12.0 - Adobe Systems Incorporated) Hidden
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 10.09.25 - Dell Inc.)
RBVirtualFolder64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.45.516.2011 - Realtek)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30126 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roxio Activation Module (x32 Version: 1.0 - Roxio) Hidden
Roxio BackOnTrack (x32 Version: 1.3.3 - Roxio) Hidden
Roxio Burn (x32 Version: 1.8 - Roxio) Hidden
Roxio Creator Starter (HKLM-x32\...\{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}) (Version: 12.1.77.0 - Roxio)
Roxio Creator Starter (x32 Version: 1.0.439 - Roxio) Hidden
Roxio Creator Starter (x32 Version: 5.0.0 - Roxio) Hidden
Roxio Express Labeler 3 (x32 Version: 3.2.2 - Roxio) Hidden
Roxio File Backup (Version: 1.3.2 - Roxio) Hidden
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0 - Sonic Solutions) Hidden
System Requirements Lab for Intel (HKLM-x32\...\{53C63F43-B827-42D9-8886-4698D91EA33B}) (Version: 4.5.15.0 - Husdawg, LLC)
WIDCOMM Bluetooth Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7600 - Broadcom Corporation)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Software Development Kit (HKLM-x32\...\{363a2c1e-637f-45ce-933b-5a5463efd945}) (Version: 8.59.29750 - Microsoft Corporation)
Windows Software Development Kit EULA (x32 Version: 8.59.25584 - Microsoft Corporations) Hidden
Windows-Treiberpaket - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.)
Windows-Treiberpaket - Silicon Labs Software (DSI_SiUSBXp_3_1) USB  (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software)
WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)
WPT Redistributables (x32 Version: 8.59.29750 - Microsoft) Hidden
WPTx64 (x32 Version: 8.59.29722 - Microsoft) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

08-10-2014 19:05:48 Windows Update
15-10-2014 17:45:08 Windows Update
18-10-2014 10:54:22 Windows Update
21-10-2014 18:23:20 Windows Update
21-10-2014 18:55:00 Removed Java 7 Update 45 (64-bit)
21-10-2014 18:58:05 Removed Java 7 Update 45
21-10-2014 19:31:14 zoek.exe restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {23036767-42A5-45DD-8812-2B7E930EB943} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe [2014-09-18] ()
Task: {52F7D947-1465-4FB4-B02D-ED1275B6F181} - System32\Tasks\{550DD30A-F57B-46E8-B081-1BE160A9DF8C} => E:\setup.exe
Task: {569842EF-F07E-4918-97E0-2AE55524E2B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {6904305B-7C99-4C34-A800-E5AC48DC2199} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-06-22] (Piriform Ltd)
Task: {801114B5-7B34-44AB-BCE8-FCC8C629CA5A} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-07-20] (AVAST Software)
Task: {99447320-FB32-4A1E-932C-5197BB2AA3D0} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {99AEDBFE-6323-48FD-9C22-8BBDD50C03C0} - System32\Tasks\AdobeAAMUpdater-1.0-Stefanie-PC-Stefanie => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2013-06-03] (Adobe Systems Incorporated)
Task: {BE0930EA-AEFD-4AD0-85B5-A141D2EF95D0} - System32\Tasks\{9F5B5394-8CB3-4FA6-942F-056A76CF8EC0} => C:\Program Files (x86)\CEWE\Mein CEWE FOTOBUCH\Mein CEWE FOTOBUCH.exe [2013-11-28] ()
Task: {C1C07C81-BB53-484A-A266-0E418E632600} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {F97D048A-A389-451E-B546-886FBE1C386B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)
Task: {FE9A7083-B21E-42FB-8727-49CAF8913C6F} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {FF4E2E9A-B2E9-44E2-8584-9C31C9D73EF7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-02-11 14:23 - 2011-03-26 03:28 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-08-30 14:46 - 2013-10-03 11:42 - 00069120 _____ () C:\Program Files (x86)\Canon\ImageBrowser EX\MFManager.exe
2014-07-20 19:53 - 2014-07-20 19:53 - 00301152 _____ () C:\Program Files\AVAST Software\Avast\aswProperty.dll
2014-10-21 21:02 - 2014-10-21 21:02 - 02896384 _____ () C:\Program Files\AVAST Software\Avast\defs\14102101\algo.dll
2012-08-30 14:39 - 2013-10-03 11:42 - 00112128 _____ () C:\Program Files (x86)\Canon\ImageBrowser EX\MFMFileSystemWatcher.dll
2014-07-20 19:53 - 2014-07-20 19:53 - 19329904 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-10-18 10:30 - 2014-10-18 10:30 - 00169472 _____ () C:\windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\9b1cac8d98bd69d3e56a26ff2f96f266\IsdiInterop.ni.dll
2012-02-11 13:08 - 2011-01-13 01:56 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 01098056 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libglesv2.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 00174408 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\libegl.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 08577864 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\pdf.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 00331592 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ppGoogleNaClPluginChrome.dll
2014-09-05 07:34 - 2014-08-30 04:49 - 01660232 _____ () C:\Program Files (x86)\Google\Chrome\Application\37.0.2062.103\ffmpegsumo.dll

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MyOSProtect => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\Services: BBSvc => 2
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Dell Registration => C:\Program Files (x86)\System Registration\prodreg.exe /boot
MSCONFIG\startupreg: Dell Webcam Central => "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2
MSCONFIG\startupreg: Desktop Disc Tool => "c:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe"
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: QuickSet => C:\Program Files\Dell\QuickSet\QuickSet.exe
MSCONFIG\startupreg: RoxWatchTray => "c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe"

========================= Accounts: ==========================

Administrator (S-1-5-21-2283762676-3508335138-3058622962-500 - Administrator - Disabled)
Gast (S-1-5-21-2283762676-3508335138-3058622962-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2283762676-3508335138-3058622962-1002 - Limited - Enabled)
Stefanie (S-1-5-21-2283762676-3508335138-3058622962-1001 - Administrator - Enabled) => C:\Users\Stefanie

==================== Faulty Device Manager Devices =============

Name: Dell Wireless 1701 Bluetooth v3.0+HS
Description: Dell Wireless 1701 Bluetooth v3.0+HS
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Broadcom
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden.


Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (10/21/2014 08:41:16 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows (3116) Windows: Fehler -1811 beim Öffnen von Protokolldatei C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0007D.log.


System errors:
=============
Error: (10/21/2014 09:51:26 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/21/2014 09:51:26 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht.

Error: (10/21/2014 09:46:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/21/2014 09:46:11 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/21/2014 09:46:10 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/21/2014 09:46:10 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/21/2014 09:46:09 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (10/21/2014 09:06:11 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (10/21/2014 09:05:14 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Garmin Core Update Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (10/21/2014 09:05:14 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Garmin Core Update Service erreicht.


Microsoft Office Sessions:
=========================
Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 7010) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 3058) (User: )
Description: Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 3028) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (10/21/2014 08:41:23 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)
Search.TripoliIndexer

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 3029) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
Search.JetPropStore

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 9002) (User: )
Description: Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 7042) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
The catalog is corrupt

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 7040) (User: )
Description: 
Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)
4700

Error: (10/21/2014 08:41:18 PM) (Source: Windows Search Service) (EventID: 9000) (User: )
Description: 
Details:
	0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800))

Error: (10/21/2014 08:41:16 PM) (Source: ESENT) (EventID: 455) (User: )
Description: Windows3116Windows: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS0007D.log-1811


CodeIntegrity Errors:
===================================
  Date: 2014-10-21 20:34:08.026
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 20:34:07.818
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 20:34:07.596
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 20:26:51.443
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 20:26:51.282
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-21 20:26:51.091
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-10-17 17:34:22.777
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-21 10:51:26.911
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-21 10:51:26.624
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2014-09-21 10:50:27.362
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\PCTRunner\pcwtc64f.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i3-2350M CPU @ 2.30GHz
Percentage of memory in use: 54%
Total physical RAM: 4004.27 MB
Available physical RAM: 1822.91 MB
Total Pagefile: 8006.73 MB
Available Pagefile: 5846.77 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:120 GB) (Free:70.08 GB) NTFS
Drive d: (DATEN) (Fixed) (Total:331.01 GB) (Free:295.05 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EEB859DE)
Partition 1: (Not Active) - (Size=100 MB) - (Type=DE)
Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=120 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=331 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Wie immer Danke

Werd' dann erst mal zu Bett gehen und morgen weiter machen...
Also nicht wundern, wenn ich heute nicht mehr antworte.

cybbe

PS: Nächstes Übel: Der Rechner braucht ca. 5 min. zum hochfahren. Die Logs waren teilweise schon da, aber die explorer.exe scheinbar noch nicht fertig, um alles (Desktop und co.) anzeigen zu lassen

Zitat von cybbe

Nächstes Übel: Der Rechner braucht ca. 5 min. zum hochfahren. Die Logs waren teilweise schon da, aber die explorer.exe scheinbar noch nicht fertig, um alles (Desktop und co.) anzeigen zu lassen

Hi,
seit wann ist das so?


Schritt 1

ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Hallo Jürgen,

das mit dem langsamen Hochfahren ist schon seit geraumer Zeit so. Hat definitiv nichts mit den Aktionen von gestern zu tun. Es ist halt nur nervig, wenn man nen schwarzen Bildschirm sieht, die Taskleiste schon vorhanden ist und dann nichts mehr passiert

Aber das ist dann das 2. Thema um was ich mich kümmere...

Werde dann, wenn ich z.Hause bin, den ESET ein mal durchlaufen lassen und poste die Ergebnisse...

Danke

cybbe

ok...

Hallo Jürgen,

lang genug hats gedauert. Hier der Log von ESET

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=0f0dd5875671a24886b37f349f9c3c1b
# engine=20729
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-10-22 04:14:38
# local_time=2014-10-22 06:14:38 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 77687 178414968 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 72306 165624328 0 0
# scanned=238867
# found=4
# cleaned=0
# scan_time=6145
sh=2B9A1340BEC2FE2694C333ACD77F0E12EF9550D1 ft=1 fh=fcbeb3ad261a92d1 vn="Variante von Win32/Conduit.SearchProtect.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\engeblojhfeingnjnfpiceofljnjpldp\10.31.4.510_0\APISupport\APISupport.dll.vir"
sh=675526C1B3CB27C6635233B62EDB8ECEEBFE1556 ft=1 fh=8382eeac10eb278f vn="Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\engeblojhfeingnjnfpiceofljnjpldp\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe.vir"
sh=C0114483C9E2C1271B0D594AB6A6BF1E4F383D63 ft=1 fh=e2607344a0894545 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\Stefanie\AppData\Local\Google\Chrome\User Data\Default\Extensions\engeblojhfeingnjnfpiceofljnjpldp\10.31.4.510_0\plugins\ChromeApiPlugin.dll.vir"
sh=DC935CCB0E757C9C719A73A1D67A70CF645516A6 ft=0 fh=0000000000000000 vn="Variante von Win32/Toolbar.Babylon.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\c45da.msi"
         

As usual

Danke

cybbe

OK,

Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Huhu Jürgen,

anbei der Log vom TDSSKiller

19:50:44.0550 0x0cdc  TDSS rootkit removing tool 3.0.0.40 Jul 10 2014 12:37:58
19:50:49.0144 0x0cdc  ============================================================
19:50:49.0144 0x0cdc  Current date / time: 2014/10/22 19:50:49.0144
19:50:49.0144 0x0cdc  SystemInfo:
19:50:49.0144 0x0cdc  
19:50:49.0144 0x0cdc  OS Version: 6.1.7601 ServicePack: 1.0
19:50:49.0144 0x0cdc  Product type: Workstation
19:50:49.0144 0x0cdc  ComputerName: STEFANIE-PC
19:50:49.0144 0x0cdc  UserName: Stefanie
19:50:49.0144 0x0cdc  Windows directory: C:\windows
19:50:49.0144 0x0cdc  System windows directory: C:\windows
19:50:49.0144 0x0cdc  Running under WOW64
19:50:49.0145 0x0cdc  Processor architecture: Intel x64
19:50:49.0145 0x0cdc  Number of processors: 4
19:50:49.0145 0x0cdc  Page size: 0x1000
19:50:49.0145 0x0cdc  Boot type: Normal boot
19:50:49.0145 0x0cdc  ============================================================
19:50:53.0771 0x0cdc  KLMD registered as C:\windows\system32\drivers\77174152.sys
19:50:54.0091 0x0cdc  System UUID: {9617E039-7576-8645-6AA1-32C454CB9053}
19:50:54.0835 0x0cdc  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
19:50:54.0860 0x0cdc  ============================================================
19:50:54.0860 0x0cdc  \Device\Harddisk0\DR0:
19:50:54.0860 0x0cdc  MBR partitions:
19:50:54.0860 0x0cdc  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1D4C000
19:50:54.0860 0x0cdc  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1D7E800, BlocksNum 0xF000000
19:50:54.0860 0x0cdc  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x10D7E800, BlocksNum 0x29607000
19:50:54.0860 0x0cdc  ============================================================
19:50:54.0901 0x0cdc  C: <-> \Device\Harddisk0\DR0\Partition2
19:50:54.0934 0x0cdc  D: <-> \Device\Harddisk0\DR0\Partition3
19:50:54.0934 0x0cdc  ============================================================
19:50:54.0935 0x0cdc  Initialize success
19:50:54.0935 0x0cdc  ============================================================
19:51:27.0495 0x0780  ============================================================
19:51:27.0495 0x0780  Scan started
19:51:27.0495 0x0780  Mode: Manual; SigCheck; TDLFS; 
19:51:27.0495 0x0780  ============================================================
19:51:27.0495 0x0780  KSN ping started
19:51:29.0873 0x0780  KSN ping finished: true
19:51:30.0351 0x0780  ================ Scan system memory ========================
19:51:30.0351 0x0780  System memory - ok
19:51:30.0352 0x0780  ================ Scan services =============================
19:51:30.0543 0x0780  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\windows\system32\drivers\1394ohci.sys
19:51:30.0642 0x0780  1394ohci - ok
19:51:30.0699 0x0780  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\windows\system32\drivers\ACPI.sys
19:51:30.0742 0x0780  ACPI - ok
19:51:30.0762 0x0780  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\windows\system32\drivers\acpipmi.sys
19:51:30.0806 0x0780  AcpiPmi - ok
19:51:30.0907 0x0780  [ 5784321A1F00A4AE01732B9077CB47A7, 3E191237E4407CA46A29E1B0263ACC37C452CD09FB1B4E0C60D0796C508E2F45 ] ADExchange      C:\Program Files (x86)\Common Files\ArcSoft\esinter\Bin\eservutil.exe
19:51:30.0949 0x0780  ADExchange - ok
19:51:31.0089 0x0780  [ 4BA3BFF03B1A10E49B590BE3C4D79C10, 54D0159ACD6FB93EE08CBB2C7BA13DC3ECD131EE26E07E53040FB3976CC4FBAE ] AdobeActiveFileMonitor12.0 C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe
19:51:31.0127 0x0780  AdobeActiveFileMonitor12.0 - ok
19:51:31.0206 0x0780  [ C5679E5186B2FC95BC76A8A9870D5456, 70AC61850B811A0A902532F098AE1D5DF4622455E56C78B89D4ABDBE4A061A48 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
19:51:31.0232 0x0780  AdobeARMservice - ok
19:51:31.0379 0x0780  [ 4ECFCAAE5CB380F58934F0DCF5F64E7F, D82B37E57D93484D7A3CB65470BCD54A578A695F0203A8DD441B1348C1EEA751 ] AdobeFlashPlayerUpdateSvc C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
19:51:31.0404 0x0780  AdobeFlashPlayerUpdateSvc - ok
19:51:31.0454 0x0780  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\windows\system32\drivers\adp94xx.sys
19:51:31.0518 0x0780  adp94xx - ok
19:51:31.0578 0x0780  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\windows\system32\drivers\adpahci.sys
19:51:31.0600 0x0780  adpahci - ok
19:51:31.0647 0x0780  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\windows\system32\drivers\adpu320.sys
19:51:31.0675 0x0780  adpu320 - ok
19:51:31.0708 0x0780  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\windows\System32\aelupsvc.dll
19:51:31.0797 0x0780  AeLookupSvc - ok
19:51:31.0877 0x0780  [ A6FB9DB8F1A86861D955FD6975977AE0, 788C6EE50719227D7A9B7F08C8D5E1289FCD0E8AC23A1021A5093D2E8368F696 ] AESTFilters     C:\Program Files\IDT\WDM\AESTSr64.exe
19:51:31.0935 0x0780  AESTFilters - ok
19:51:31.0997 0x0780  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\windows\system32\drivers\afd.sys
19:51:32.0038 0x0780  AFD - ok
19:51:32.0082 0x0780  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\windows\system32\drivers\agp440.sys
19:51:32.0113 0x0780  agp440 - ok
19:51:32.0150 0x0780  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\windows\System32\alg.exe
19:51:32.0192 0x0780  ALG - ok
19:51:32.0238 0x0780  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\windows\system32\drivers\aliide.sys
19:51:32.0265 0x0780  aliide - ok
19:51:32.0292 0x0780  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\windows\system32\drivers\amdide.sys
19:51:32.0320 0x0780  amdide - ok
19:51:32.0337 0x0780  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\windows\system32\drivers\amdk8.sys
19:51:32.0382 0x0780  AmdK8 - ok
19:51:32.0396 0x0780  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\windows\system32\drivers\amdppm.sys
19:51:32.0436 0x0780  AmdPPM - ok
19:51:32.0451 0x0780  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\windows\system32\drivers\amdsata.sys
19:51:32.0465 0x0780  amdsata - ok
19:51:32.0491 0x0780  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\windows\system32\drivers\amdsbs.sys
19:51:32.0507 0x0780  amdsbs - ok
19:51:32.0522 0x0780  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\windows\system32\drivers\amdxata.sys
19:51:32.0533 0x0780  amdxata - ok
19:51:32.0595 0x0780  [ 6690E42CED5D067233ABAD42DA141213, 7FECA42624513E6C3216E91F708E97101CCFC252F925A3707EA8560D8059CBE3 ] ApfiltrService  C:\windows\system32\DRIVERS\Apfiltr.sys
19:51:32.0613 0x0780  ApfiltrService - ok
19:51:32.0663 0x0780  [ 80B9412C4DE09147581FC935FB4C97AB, 0C9661F7B5EF7F9D61981790B7AB64E3375BD117962166619D0CC546A2D014D3 ] AppID           C:\windows\system32\drivers\appid.sys
19:51:32.0696 0x0780  AppID - ok
19:51:32.0714 0x0780  [ F71CA01C24FC3798A717B5A6F682F9AD, 8CF1C209E7BBBAD02D6D087293C0B681CDA3170AF119CA2916C2708D8801E749 ] AppIDSvc        C:\windows\System32\appidsvc.dll
19:51:32.0744 0x0780  AppIDSvc - ok
19:51:32.0783 0x0780  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\windows\System32\appinfo.dll
19:51:32.0828 0x0780  Appinfo - ok
19:51:32.0875 0x0780  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\windows\system32\drivers\arc.sys
19:51:32.0911 0x0780  arc - ok
19:51:32.0937 0x0780  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\windows\system32\drivers\arcsas.sys
19:51:32.0950 0x0780  arcsas - ok
19:51:33.0072 0x0780  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
19:51:33.0107 0x0780  aspnet_state - ok
19:51:33.0172 0x0780  [ D95E64416A4A3ED6986E0F474DA934BD, DBB4A0DED0DABE1F8FF0DB8C0E9EC4EC906A85A45DC0AEC013A8744F9BF5D40E ] aswHwid         C:\windows\system32\drivers\aswHwid.sys
19:51:33.0198 0x0780  aswHwid - ok
19:51:33.0249 0x0780  [ FF1E537A3632CBB9A0BF72B9FD0878D5, B26E6A1F6E6FA5280A12861EFAD44D8F49353F47B21843EBA73E149CF613DCBC ] aswMonFlt       C:\windows\system32\drivers\aswMonFlt.sys
19:51:33.0282 0x0780  aswMonFlt - ok
19:51:33.0339 0x0780  [ A5757DE5F9C83AB40667A53D5126EA40, 58B72B1B126CF641188703CE82E26BEB0C41AD7587CFFCCCE9E3C64CC7AACC90 ] aswRdr          C:\windows\system32\drivers\aswRdr2.sys
19:51:33.0371 0x0780  aswRdr - ok
19:51:33.0403 0x0780  [ 645D97385F3F284FB5604F9B970F4D24, 15A9D7F0F4C1062210E4E744A9069B8645177D19F35B8740D74022639DC05F2E ] aswRvrt         C:\windows\system32\drivers\aswRvrt.sys
19:51:33.0433 0x0780  aswRvrt - ok
19:51:33.0563 0x0780  [ B8FDEDE963B82CFD23B3A53A3084666D, 3537E5B684FB6F0AA589A5FA7CD111E1744DF384AB1A266D4114100F104ED11B ] aswSnx          C:\windows\system32\drivers\aswSnx.sys
19:51:33.0601 0x0780  aswSnx - ok
19:51:33.0696 0x0780  [ 0DEDC041DF594AEC2C3BD00417CFAF60, 0D3A8924503986546EE256D185225C0B080FDB6B0C8B0BED7516B07A7334371B ] aswSP           C:\windows\system32\drivers\aswSP.sys
19:51:33.0722 0x0780  aswSP - ok
19:51:33.0780 0x0780  [ 48DED912CDE54FC0923B9858512366E1, 9B216B934408A7CB3CE2B41240B7EF01EAA3BC066211B784064FF8AC97A29B4E ] aswStm          C:\windows\system32\drivers\aswStm.sys
19:51:33.0801 0x0780  aswStm - ok
19:51:33.0865 0x0780  [ 471A311745848B80339436688A8286E6, E51C57236CEC19AC38E85D115DB97875517D837811188AD2E53FA49055B53890 ] aswVmm          C:\windows\system32\drivers\aswVmm.sys
19:51:33.0893 0x0780  aswVmm - ok
19:51:33.0920 0x0780  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\windows\system32\DRIVERS\asyncmac.sys
19:51:33.0965 0x0780  AsyncMac - ok
19:51:33.0998 0x0780  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\windows\system32\drivers\atapi.sys
19:51:34.0018 0x0780  atapi - ok
19:51:34.0099 0x0780  [ 2C1B6A64294F2182DC4999F923873974, 6D611636D849631BB1F852DC03A98BBFEC4D797A2707CA63427E187F0725A796 ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
19:51:34.0143 0x0780  AudioEndpointBuilder - ok
19:51:34.0163 0x0780  [ 2C1B6A64294F2182DC4999F923873974, 6D611636D849631BB1F852DC03A98BBFEC4D797A2707CA63427E187F0725A796 ] AudioSrv        C:\windows\System32\Audiosrv.dll
19:51:34.0196 0x0780  AudioSrv - ok
19:51:34.0294 0x0780  [ 73F5C13B431915BAE35254B4E95DFB71, 393A045859382C44133C004598B1512048046BCC129FED2247A77FDBFCDB6DFF ] avast! Antivirus C:\Program Files\AVAST Software\Avast\AvastSvc.exe
19:51:34.0317 0x0780  avast! Antivirus - ok
19:51:34.0375 0x0780  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\windows\System32\AxInstSV.dll
19:51:34.0420 0x0780  AxInstSV - ok
19:51:34.0486 0x0780  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\windows\system32\drivers\bxvbda.sys
19:51:34.0521 0x0780  b06bdrv - ok
19:51:34.0570 0x0780  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\windows\system32\DRIVERS\b57nd60a.sys
19:51:34.0618 0x0780  b57nd60a - ok
19:51:34.0834 0x0780  [ 783F1C7ED6B39454A8D1028D4F30768D, 75049DDF709896FAAA8EA52A689EC846EBD5BFB4F8FE53EF59B2C471AA2A644E ] BCM43XX         C:\windows\system32\DRIVERS\bcmwl664.sys
19:51:34.0963 0x0780  BCM43XX - ok
19:51:35.0018 0x0780  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\windows\System32\bdesvc.dll
19:51:35.0078 0x0780  BDESVC - ok
19:51:35.0115 0x0780  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\windows\system32\drivers\Beep.sys
19:51:35.0194 0x0780  Beep - ok
19:51:35.0251 0x0780  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\windows\System32\bfe.dll
19:51:35.0295 0x0780  BFE - ok
19:51:35.0385 0x0780  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\windows\System32\qmgr.dll
19:51:35.0457 0x0780  BITS - ok
19:51:35.0497 0x0780  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\windows\system32\DRIVERS\blbdrive.sys
19:51:35.0536 0x0780  blbdrive - ok
19:51:35.0574 0x0780  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\windows\system32\DRIVERS\bowser.sys
19:51:35.0611 0x0780  bowser - ok
19:51:35.0639 0x0780  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\windows\system32\drivers\BrFiltLo.sys
19:51:35.0673 0x0780  BrFiltLo - ok
19:51:35.0686 0x0780  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\windows\system32\drivers\BrFiltUp.sys
19:51:35.0714 0x0780  BrFiltUp - ok
19:51:35.0770 0x0780  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\windows\System32\browser.dll
19:51:35.0809 0x0780  Browser - ok
19:51:35.0831 0x0780  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\windows\System32\Drivers\Brserid.sys
19:51:35.0869 0x0780  Brserid - ok
19:51:35.0874 0x0780  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\windows\System32\Drivers\BrSerWdm.sys
19:51:35.0898 0x0780  BrSerWdm - ok
19:51:35.0913 0x0780  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\windows\System32\Drivers\BrUsbMdm.sys
19:51:35.0958 0x0780  BrUsbMdm - ok
19:51:35.0961 0x0780  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\windows\System32\Drivers\BrUsbSer.sys
19:51:35.0982 0x0780  BrUsbSer - ok
19:51:36.0013 0x0780  [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum         C:\windows\system32\drivers\BthEnum.sys
19:51:36.0051 0x0780  BthEnum - ok
19:51:36.0086 0x0780  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\windows\system32\drivers\bthmodem.sys
19:51:36.0137 0x0780  BTHMODEM - ok
19:51:36.0166 0x0780  [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan          C:\windows\system32\DRIVERS\bthpan.sys
19:51:36.0213 0x0780  BthPan - ok
19:51:36.0286 0x0780  [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT         C:\windows\System32\Drivers\BTHport.sys
19:51:36.0317 0x0780  BTHPORT - ok
19:51:36.0372 0x0780  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\windows\system32\bthserv.dll
19:51:36.0452 0x0780  bthserv - ok
19:51:36.0480 0x0780  [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB          C:\windows\System32\Drivers\BTHUSB.sys
19:51:36.0519 0x0780  BTHUSB - ok
19:51:36.0593 0x0780  [ A0DFB69ADE3444C78B17636FCF28E898, 21B1E76F056C2AFD5DEAFD620D2F90F4F617F8E76A88CEA2196E69D2CFBEE88B ] BTWAMPFL        C:\windows\system32\DRIVERS\btwampfl.sys
19:51:36.0626 0x0780  BTWAMPFL - ok
19:51:36.0659 0x0780  [ F6135859A582A7294BA7A3336E08BAA1, DE30457F91C25950C2713CE3A2AE1F1EFFBB068DD3B0BCC87700E7CBAF73C818 ] btwaudio        C:\windows\system32\drivers\btwaudio.sys
19:51:36.0673 0x0780  btwaudio - ok
19:51:36.0712 0x0780  [ 3DEF2370E414B4E299673558BA171A51, 5A0923D9F941ABD34EC9BEE0EB62A62F135CBF128061239CC6EA0E6752791636 ] btwavdt         C:\windows\system32\DRIVERS\btwavdt.sys
19:51:36.0725 0x0780  btwavdt - ok
19:51:36.0851 0x0780  [ B7DEA77EE893806859072274EE8EC8FC, E58AB4AE9A6FB4112814305D28BA7A060EAB92F98328737A7E719B3AFFE24383 ] btwdins         C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
19:51:36.0924 0x0780  btwdins - ok
19:51:36.0959 0x0780  [ 9AD0FA253ED531D39FB2D74FE12A5FA9, 74AC5ECB4F770274BBA8EBC584A0F08FDDDA21C4BB2A2DDD4BB871DC47B1447C ] btwl2cap        C:\windows\system32\DRIVERS\btwl2cap.sys
19:51:36.0970 0x0780  btwl2cap - ok
19:51:36.0995 0x0780  [ 9937E0E4DFC0030560A6DFE9D3A94B39, 0B9CF1932D4534BD7B1F5D7B7BD5FBF9C8D156838D24ABBDE475E79EEF1150F1 ] btwrchid        C:\windows\system32\DRIVERS\btwrchid.sys
19:51:37.0021 0x0780  btwrchid - ok
19:51:37.0052 0x0780  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\windows\system32\DRIVERS\cdfs.sys
19:51:37.0108 0x0780  cdfs - ok
19:51:37.0148 0x0780  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\windows\system32\DRIVERS\cdrom.sys
19:51:37.0200 0x0780  cdrom - ok
19:51:37.0248 0x0780  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\windows\System32\certprop.dll
19:51:37.0327 0x0780  CertPropSvc - ok
19:51:37.0355 0x0780  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\windows\system32\drivers\circlass.sys
19:51:37.0399 0x0780  circlass - ok
19:51:37.0440 0x0780  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\windows\system32\CLFS.sys
19:51:37.0461 0x0780  CLFS - ok
19:51:37.0529 0x0780  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:51:37.0555 0x0780  clr_optimization_v2.0.50727_32 - ok
19:51:37.0616 0x0780  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
19:51:37.0653 0x0780  clr_optimization_v2.0.50727_64 - ok
19:51:37.0729 0x0780  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:51:37.0761 0x0780  clr_optimization_v4.0.30319_32 - ok
19:51:37.0790 0x0780  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\windows\system32\DRIVERS\CmBatt.sys
19:51:37.0838 0x0780  CmBatt - ok
19:51:37.0860 0x0780  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\windows\system32\drivers\cmdide.sys
19:51:37.0871 0x0780  cmdide - ok
19:51:37.0933 0x0780  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\windows\system32\Drivers\cng.sys
19:51:37.0964 0x0780  CNG - ok
19:51:37.0987 0x0780  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\windows\system32\drivers\compbatt.sys
19:51:38.0005 0x0780  Compbatt - ok
19:51:38.0043 0x0780  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\windows\system32\DRIVERS\CompositeBus.sys
19:51:38.0078 0x0780  CompositeBus - ok
19:51:38.0103 0x0780  COMSysApp - ok
19:51:38.0134 0x0780  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\windows\system32\drivers\crcdisk.sys
19:51:38.0167 0x0780  crcdisk - ok
19:51:38.0240 0x0780  [ 19D511CC455C19DE1ADF60E6C39C85B6, 2A05DD5EF3D0BEC2C9F4EA186E0E2D0F7BE0BF6A473D51194B09D33773AC7FAA ] CryptSvc        C:\windows\system32\cryptsvc.dll
19:51:38.0276 0x0780  CryptSvc - ok
19:51:38.0353 0x0780  [ BC3D4F90978CD7C8EABD1BAF3BF7873A, 5978139650FC51BE0CAB12061702C7BC7BEDF6E7C3A047FF0A6328AA674E4226 ] CtClsFlt        C:\windows\system32\DRIVERS\CtClsFlt.sys
19:51:38.0370 0x0780  CtClsFlt - ok
19:51:38.0444 0x0780  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\windows\system32\rpcss.dll
19:51:38.0508 0x0780  DcomLaunch - ok
19:51:38.0579 0x0780  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\windows\System32\defragsvc.dll
19:51:38.0635 0x0780  defragsvc - ok
19:51:38.0668 0x0780  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\windows\system32\Drivers\dfsc.sys
19:51:38.0736 0x0780  DfsC - ok
19:51:38.0791 0x0780  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\windows\system32\dhcpcore.dll
19:51:38.0831 0x0780  Dhcp - ok
19:51:38.0854 0x0780  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\windows\system32\drivers\discache.sys
19:51:38.0936 0x0780  discache - ok
19:51:38.0967 0x0780  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\windows\system32\drivers\disk.sys
19:51:38.0980 0x0780  Disk - ok
19:51:39.0030 0x0780  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\windows\System32\dnsrslvr.dll
19:51:39.0080 0x0780  Dnscache - ok
19:51:39.0108 0x0780  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\windows\System32\dot3svc.dll
19:51:39.0164 0x0780  dot3svc - ok
19:51:39.0183 0x0780  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\windows\system32\dps.dll
19:51:39.0238 0x0780  DPS - ok
19:51:39.0290 0x0780  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\windows\system32\drivers\drmkaud.sys
19:51:39.0325 0x0780  drmkaud - ok
19:51:39.0408 0x0780  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\windows\System32\drivers\dxgkrnl.sys
19:51:39.0444 0x0780  DXGKrnl - ok
19:51:39.0477 0x0780  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\windows\System32\eapsvc.dll
19:51:39.0542 0x0780  EapHost - ok
19:51:39.0694 0x0780  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\windows\system32\drivers\evbda.sys
19:51:39.0864 0x0780  ebdrv - ok
19:51:39.0897 0x0780  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS             C:\windows\System32\lsass.exe
19:51:39.0922 0x0780  EFS - ok
19:51:40.0010 0x0780  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\windows\ehome\ehRecvr.exe
19:51:40.0049 0x0780  ehRecvr - ok
19:51:40.0072 0x0780  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\windows\ehome\ehsched.exe
19:51:40.0113 0x0780  ehSched - ok
19:51:40.0185 0x0780  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\windows\system32\drivers\elxstor.sys
19:51:40.0211 0x0780  elxstor - ok
19:51:40.0215 0x0780  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\windows\system32\drivers\errdev.sys
19:51:40.0241 0x0780  ErrDev - ok
19:51:40.0311 0x0780  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\windows\system32\es.dll
19:51:40.0408 0x0780  EventSystem - ok
19:51:40.0441 0x0780  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\windows\system32\drivers\exfat.sys
19:51:40.0501 0x0780  exfat - ok
19:51:40.0538 0x0780  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\windows\system32\drivers\fastfat.sys
19:51:40.0604 0x0780  fastfat - ok
19:51:40.0652 0x0780  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\windows\system32\fxssvc.exe
19:51:40.0700 0x0780  Fax - ok
19:51:40.0704 0x0780  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\windows\system32\drivers\fdc.sys
19:51:40.0719 0x0780  fdc - ok
19:51:40.0766 0x0780  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\windows\system32\fdPHost.dll
19:51:40.0857 0x0780  fdPHost - ok
19:51:40.0877 0x0780  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\windows\system32\fdrespub.dll
19:51:40.0952 0x0780  FDResPub - ok
19:51:40.0979 0x0780  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\windows\system32\drivers\fileinfo.sys
19:51:40.0991 0x0780  FileInfo - ok
19:51:41.0009 0x0780  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\windows\system32\drivers\filetrace.sys
19:51:41.0074 0x0780  Filetrace - ok
19:51:41.0088 0x0780  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\windows\system32\drivers\flpydisk.sys
19:51:41.0102 0x0780  flpydisk - ok
19:51:41.0130 0x0780  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\windows\system32\drivers\fltmgr.sys
19:51:41.0149 0x0780  FltMgr - ok
19:51:41.0263 0x0780  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\windows\system32\FntCache.dll
19:51:41.0308 0x0780  FontCache - ok
19:51:41.0369 0x0780  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
19:51:41.0398 0x0780  FontCache3.0.0.0 - ok
19:51:41.0430 0x0780  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\windows\system32\drivers\FsDepends.sys
19:51:41.0463 0x0780  FsDepends - ok
19:51:41.0503 0x0780  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\windows\system32\drivers\Fs_Rec.sys
19:51:41.0533 0x0780  Fs_Rec - ok
19:51:41.0591 0x0780  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\windows\system32\DRIVERS\fvevol.sys
19:51:41.0612 0x0780  fvevol - ok
19:51:41.0635 0x0780  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\windows\system32\drivers\gagp30kx.sys
19:51:41.0648 0x0780  gagp30kx - ok
19:51:41.0756 0x0780  [ D19247FC720233111B68409891D907D2, EECEA7CDE335BC046F845A0995DACCDCC663B9973113949C405A2D115DE40895 ] Garmin Core Update Service C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe
19:51:41.0787 0x0780  Garmin Core Update Service - ok
19:51:41.0836 0x0780  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\windows\System32\gpsvc.dll
19:51:41.0903 0x0780  gpsvc - ok
19:51:41.0992 0x0780  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:51:42.0017 0x0780  gupdate - ok
19:51:42.0036 0x0780  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:51:42.0047 0x0780  gupdatem - ok
19:51:42.0095 0x0780  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\windows\system32\drivers\hcw85cir.sys
19:51:42.0158 0x0780  hcw85cir - ok
19:51:42.0205 0x0780  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
19:51:42.0262 0x0780  HdAudAddService - ok
19:51:42.0289 0x0780  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\windows\system32\DRIVERS\HDAudBus.sys
19:51:42.0308 0x0780  HDAudBus - ok
19:51:42.0312 0x0780  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\windows\system32\drivers\HidBatt.sys
19:51:42.0345 0x0780  HidBatt - ok
19:51:42.0352 0x0780  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\windows\system32\drivers\hidbth.sys
19:51:42.0374 0x0780  HidBth - ok
19:51:42.0378 0x0780  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\windows\system32\drivers\hidir.sys
19:51:42.0396 0x0780  HidIr - ok
19:51:42.0431 0x0780  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\windows\system32\hidserv.dll
19:51:42.0475 0x0780  hidserv - ok
19:51:42.0527 0x0780  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\windows\system32\DRIVERS\hidusb.sys
19:51:42.0567 0x0780  HidUsb - ok
19:51:42.0612 0x0780  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\windows\system32\kmsvc.dll
19:51:42.0665 0x0780  hkmsvc - ok
19:51:42.0711 0x0780  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\windows\system32\ListSvc.dll
19:51:42.0735 0x0780  HomeGroupListener - ok
19:51:42.0775 0x0780  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\windows\system32\provsvc.dll
19:51:42.0825 0x0780  HomeGroupProvider - ok
19:51:42.0865 0x0780  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\windows\system32\drivers\HpSAMD.sys
19:51:42.0881 0x0780  HpSAMD - ok
19:51:42.0915 0x0780  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\windows\system32\drivers\HTTP.sys
19:51:42.0996 0x0780  HTTP - ok
19:51:43.0039 0x0780  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\windows\system32\drivers\hwpolicy.sys
19:51:43.0065 0x0780  hwpolicy - ok
19:51:43.0089 0x0780  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\windows\system32\DRIVERS\i8042prt.sys
19:51:43.0126 0x0780  i8042prt - ok
19:51:43.0195 0x0780  [ D469B77687E12FE43E344806740B624D, DFDD486FD040813BF4E5DDB504CF9E0BFBF6D4E540DDDA4829F9B675ACF63E89 ] iaStor          C:\windows\system32\DRIVERS\iaStor.sys
19:51:43.0226 0x0780  iaStor - ok
19:51:43.0277 0x0780  [ 983FC69644DDF0486C8DFEA262948D1A, 329EC95117C31E61F6D22D79CFF339D70A70522710E7DC0CED06EC95E6D4B34F ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
19:51:43.0302 0x0780  IAStorDataMgrSvc - ok
19:51:43.0360 0x0780  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\windows\system32\drivers\iaStorV.sys
19:51:43.0384 0x0780  iaStorV - ok
19:51:43.0483 0x0780  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
19:51:43.0519 0x0780  idsvc - ok
19:51:43.0536 0x0780  IEEtwCollectorService - ok
19:51:43.0957 0x0780  [ 795C99DC4F574C97C03D0BB39CF099EE, 67310B52F7A1B83A66872B961F347B1BD104C8A83A01F60507705B2ACEA76B71 ] igfx            C:\windows\system32\DRIVERS\igdkmd64.sys
19:51:44.0446 0x0780  igfx - ok
19:51:44.0501 0x0780  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\windows\system32\drivers\iirsp.sys
19:51:44.0530 0x0780  iirsp - ok
19:51:44.0580 0x0780  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\windows\System32\ikeext.dll
19:51:44.0643 0x0780  IKEEXT - ok
19:51:44.0732 0x0780  [ FC727061C0F47C8059E88E05D5C8E381, C7A3782F5D86C7FDE57AA1F2EE81638C5FC3072ACC6E572BA2EC7B3CFF389800 ] IntcDAud        C:\windows\system32\DRIVERS\IntcDAud.sys
19:51:44.0759 0x0780  IntcDAud - ok
19:51:44.0791 0x0780  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\windows\system32\drivers\intelide.sys
19:51:44.0805 0x0780  intelide - ok
19:51:44.0839 0x0780  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\windows\system32\DRIVERS\intelppm.sys
19:51:44.0879 0x0780  intelppm - ok
19:51:44.0946 0x0780  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\windows\system32\ipbusenum.dll
19:51:45.0006 0x0780  IPBusEnum - ok
19:51:45.0036 0x0780  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\windows\system32\DRIVERS\ipfltdrv.sys
19:51:45.0095 0x0780  IpFilterDriver - ok
19:51:45.0140 0x0780  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\windows\System32\iphlpsvc.dll
19:51:45.0212 0x0780  iphlpsvc - ok
19:51:45.0224 0x0780  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\windows\system32\drivers\IPMIDrv.sys
19:51:45.0250 0x0780  IPMIDRV - ok
19:51:45.0273 0x0780  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\windows\system32\drivers\ipnat.sys
19:51:45.0336 0x0780  IPNAT - ok
19:51:45.0367 0x0780  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\windows\system32\drivers\irenum.sys
19:51:45.0410 0x0780  IRENUM - ok
19:51:45.0427 0x0780  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\windows\system32\drivers\isapnp.sys
19:51:45.0438 0x0780  isapnp - ok
19:51:45.0465 0x0780  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\windows\system32\drivers\msiscsi.sys
19:51:45.0485 0x0780  iScsiPrt - ok
19:51:45.0521 0x0780  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\windows\system32\DRIVERS\kbdclass.sys
19:51:45.0550 0x0780  kbdclass - ok
19:51:45.0569 0x0780  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\windows\system32\DRIVERS\kbdhid.sys
19:51:45.0584 0x0780  kbdhid - ok
19:51:45.0610 0x0780  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso          C:\windows\system32\lsass.exe
19:51:45.0644 0x0780  KeyIso - ok
19:51:45.0680 0x0780  [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD          C:\windows\system32\Drivers\ksecdd.sys
19:51:45.0708 0x0780  KSecDD - ok
19:51:45.0717 0x0780  [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg         C:\windows\system32\Drivers\ksecpkg.sys
19:51:45.0732 0x0780  KSecPkg - ok
19:51:45.0760 0x0780  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\windows\system32\drivers\ksthunk.sys
19:51:45.0840 0x0780  ksthunk - ok
19:51:45.0879 0x0780  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\windows\system32\msdtckrm.dll
19:51:45.0974 0x0780  KtmRm - ok
19:51:46.0026 0x0780  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\windows\system32\srvsvc.dll
19:51:46.0091 0x0780  LanmanServer - ok
19:51:46.0121 0x0780  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\windows\System32\wkssvc.dll
19:51:46.0191 0x0780  LanmanWorkstation - ok
19:51:46.0235 0x0780  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\windows\system32\DRIVERS\lltdio.sys
19:51:46.0297 0x0780  lltdio - ok
19:51:46.0331 0x0780  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\windows\System32\lltdsvc.dll
19:51:46.0410 0x0780  lltdsvc - ok
19:51:46.0424 0x0780  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\windows\System32\lmhsvc.dll
19:51:46.0477 0x0780  lmhosts - ok
19:51:46.0545 0x0780  [ 98B16E756243BEA9410E32025B19C06F, C4F8663FF4C2F1123CC92D88004090AD06ED12FCD07706AE168333A33B269A53 ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
19:51:46.0566 0x0780  LMS - ok
19:51:46.0607 0x0780  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\windows\system32\drivers\lsi_fc.sys
19:51:46.0623 0x0780  LSI_FC - ok
19:51:46.0661 0x0780  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\windows\system32\drivers\lsi_sas.sys
19:51:46.0678 0x0780  LSI_SAS - ok
19:51:46.0684 0x0780  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\windows\system32\drivers\lsi_sas2.sys
19:51:46.0699 0x0780  LSI_SAS2 - ok
19:51:46.0713 0x0780  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\windows\system32\drivers\lsi_scsi.sys
19:51:46.0729 0x0780  LSI_SCSI - ok
19:51:46.0772 0x0780  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\windows\system32\drivers\luafv.sys
19:51:46.0833 0x0780  luafv - ok
19:51:46.0870 0x0780  [ 5C3669B71657F22E67A1D4BD49D2CBE7, 7CAE59AA6CA9CBBD70BBD707A155FB169BF3F71096275BF7C0F415B6A092C671 ] MBAMProtector   C:\windows\system32\drivers\mbam.sys
19:51:46.0893 0x0780  MBAMProtector - ok
19:51:46.0990 0x0780  [ 6D8A2EE4244630B290A837E79C0F37A1, 6783BBC0BDC93E4D6D43531A1AD0DF5CD26C3BBFA6384927C5CF65AD97FB04AD ] MBAMScheduler   C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
19:51:47.0054 0x0780  MBAMScheduler - ok
19:51:47.0092 0x0780  [ 09D4503CBB6ADB3A54E7C7A75090B728, 6139EA3338FD64205481EDEC813A44F8D395FDA7B67AA431DA61F3631C3EDAE6 ] MBAMService     C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
19:51:47.0128 0x0780  MBAMService - ok
19:51:47.0218 0x0780  [ 26C43960C99EE861A5D0EDC4DCF3B1C3, 6238FB8E785652040CCE3E7044EA52066CE1BF173A1467474D64A3AB214B6BCD ] MBAMSwissArmy   C:\windows\system32\drivers\MBAMSwissArmy.sys
19:51:47.0241 0x0780  MBAMSwissArmy - ok
19:51:47.0251 0x0780  [ 95EF63A7827D4E3A229CBBCB42619E93, FA38DD035B2C4FC82B60868F49D45A39FBBC96096AAD5A2C8BD752A250255BA7 ] MBAMWebAccessControl C:\windows\system32\drivers\mwac.sys
19:51:47.0264 0x0780  MBAMWebAccessControl - ok
19:51:47.0288 0x0780  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\windows\system32\Mcx2Svc.dll
19:51:47.0327 0x0780  Mcx2Svc - ok
19:51:47.0358 0x0780  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\windows\system32\drivers\megasas.sys
19:51:47.0387 0x0780  megasas - ok
19:51:47.0432 0x0780  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\windows\system32\drivers\MegaSR.sys
19:51:47.0463 0x0780  MegaSR - ok
19:51:47.0502 0x0780  [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64          C:\windows\system32\DRIVERS\HECIx64.sys
19:51:47.0516 0x0780  MEIx64 - ok
19:51:47.0542 0x0780  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\windows\system32\mmcss.dll
19:51:47.0585 0x0780  MMCSS - ok
19:51:47.0589 0x0780  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\windows\system32\drivers\modem.sys
19:51:47.0647 0x0780  Modem - ok
19:51:47.0679 0x0780  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\windows\system32\DRIVERS\monitor.sys
19:51:47.0713 0x0780  monitor - ok
19:51:47.0742 0x0780  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\windows\system32\DRIVERS\mouclass.sys
19:51:47.0772 0x0780  mouclass - ok
19:51:47.0804 0x0780  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\windows\system32\DRIVERS\mouhid.sys
19:51:47.0837 0x0780  mouhid - ok
19:51:47.0864 0x0780  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\windows\system32\drivers\mountmgr.sys
19:51:47.0896 0x0780  mountmgr - ok
19:51:47.0930 0x0780  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\windows\system32\drivers\mpio.sys
19:51:47.0960 0x0780  mpio - ok
19:51:47.0989 0x0780  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\windows\system32\drivers\mpsdrv.sys
19:51:48.0041 0x0780  mpsdrv - ok
19:51:48.0097 0x0780  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\windows\system32\mpssvc.dll
19:51:48.0185 0x0780  MpsSvc - ok
19:51:48.0216 0x0780  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\windows\system32\drivers\mrxdav.sys
19:51:48.0239 0x0780  MRxDAV - ok
19:51:48.0258 0x0780  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\windows\system32\DRIVERS\mrxsmb.sys
19:51:48.0296 0x0780  mrxsmb - ok
19:51:48.0324 0x0780  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\windows\system32\DRIVERS\mrxsmb10.sys
19:51:48.0366 0x0780  mrxsmb10 - ok
19:51:48.0387 0x0780  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\windows\system32\DRIVERS\mrxsmb20.sys
19:51:48.0431 0x0780  mrxsmb20 - ok
19:51:48.0461 0x0780  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\windows\system32\drivers\msahci.sys
19:51:48.0489 0x0780  msahci - ok
19:51:48.0515 0x0780  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\windows\system32\drivers\msdsm.sys
19:51:48.0529 0x0780  msdsm - ok
19:51:48.0552 0x0780  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\windows\System32\msdtc.exe
19:51:48.0600 0x0780  MSDTC - ok
19:51:48.0627 0x0780  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\windows\system32\drivers\Msfs.sys
19:51:48.0663 0x0780  Msfs - ok
19:51:48.0688 0x0780  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\windows\System32\drivers\mshidkmdf.sys
19:51:48.0757 0x0780  mshidkmdf - ok
19:51:48.0775 0x0780  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\windows\system32\drivers\msisadrv.sys
19:51:48.0787 0x0780  msisadrv - ok
19:51:48.0812 0x0780  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\windows\system32\iscsiexe.dll
19:51:48.0878 0x0780  MSiSCSI - ok
19:51:48.0882 0x0780  msiserver - ok
19:51:48.0905 0x0780  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\windows\system32\drivers\MSKSSRV.sys
19:51:48.0960 0x0780  MSKSSRV - ok
19:51:48.0963 0x0780  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\windows\system32\drivers\MSPCLOCK.sys
19:51:49.0014 0x0780  MSPCLOCK - ok
19:51:49.0030 0x0780  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\windows\system32\drivers\MSPQM.sys
19:51:49.0074 0x0780  MSPQM - ok
19:51:49.0115 0x0780  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\windows\system32\drivers\MsRPC.sys
19:51:49.0137 0x0780  MsRPC - ok
19:51:49.0155 0x0780  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\windows\system32\DRIVERS\mssmbios.sys
19:51:49.0166 0x0780  mssmbios - ok
19:51:49.0180 0x0780  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\windows\system32\drivers\MSTEE.sys
19:51:49.0251 0x0780  MSTEE - ok
19:51:49.0264 0x0780  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\windows\system32\drivers\MTConfig.sys
19:51:49.0296 0x0780  MTConfig - ok
19:51:49.0313 0x0780  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\windows\system32\Drivers\mup.sys
19:51:49.0325 0x0780  Mup - ok
19:51:49.0363 0x0780  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\windows\system32\qagentRT.dll
19:51:49.0430 0x0780  napagent - ok
19:51:49.0489 0x0780  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\windows\system32\DRIVERS\nwifi.sys
19:51:49.0542 0x0780  NativeWifiP - ok
19:51:49.0631 0x0780  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\windows\system32\drivers\ndis.sys
19:51:49.0670 0x0780  NDIS - ok
19:51:49.0706 0x0780  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\windows\system32\DRIVERS\ndiscap.sys
19:51:49.0752 0x0780  NdisCap - ok
19:51:49.0781 0x0780  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\windows\system32\DRIVERS\ndistapi.sys
19:51:49.0836 0x0780  NdisTapi - ok
19:51:49.0865 0x0780  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\windows\system32\DRIVERS\ndisuio.sys
19:51:49.0925 0x0780  Ndisuio - ok
19:51:49.0945 0x0780  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\windows\system32\DRIVERS\ndiswan.sys
19:51:49.0985 0x0780  NdisWan - ok
19:51:50.0014 0x0780  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\windows\system32\drivers\NDProxy.sys
19:51:50.0064 0x0780  NDProxy - ok
19:51:50.0088 0x0780  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\windows\system32\DRIVERS\netbios.sys
19:51:50.0125 0x0780  NetBIOS - ok
19:51:50.0151 0x0780  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\windows\system32\DRIVERS\netbt.sys
19:51:50.0204 0x0780  NetBT - ok
19:51:50.0224 0x0780  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon        C:\windows\system32\lsass.exe
19:51:50.0239 0x0780  Netlogon - ok
19:51:50.0291 0x0780  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\windows\System32\netman.dll
19:51:50.0353 0x0780  Netman - ok
19:51:50.0424 0x0780  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:51:50.0453 0x0780  NetMsmqActivator - ok
19:51:50.0467 0x0780  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:51:50.0483 0x0780  NetPipeActivator - ok
19:51:50.0514 0x0780  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\windows\System32\netprofm.dll
19:51:50.0562 0x0780  netprofm - ok
19:51:50.0570 0x0780  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:51:50.0585 0x0780  NetTcpActivator - ok
19:51:50.0591 0x0780  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
19:51:50.0607 0x0780  NetTcpPortSharing - ok
19:51:50.0648 0x0780  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\windows\system32\drivers\nfrd960.sys
19:51:50.0672 0x0780  nfrd960 - ok
19:51:50.0703 0x0780  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\windows\System32\nlasvc.dll
19:51:50.0725 0x0780  NlaSvc - ok
19:51:50.0740 0x0780  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\windows\system32\drivers\Npfs.sys
19:51:50.0775 0x0780  Npfs - ok
19:51:50.0800 0x0780  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\windows\system32\nsisvc.dll
19:51:50.0837 0x0780  nsi - ok
19:51:50.0844 0x0780  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\windows\system32\drivers\nsiproxy.sys
19:51:50.0900 0x0780  nsiproxy - ok
19:51:50.0977 0x0780  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\windows\system32\drivers\Ntfs.sys
19:51:51.0037 0x0780  Ntfs - ok
19:51:51.0057 0x0780  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\windows\system32\drivers\Null.sys
19:51:51.0124 0x0780  Null - ok
19:51:51.0148 0x0780  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\windows\system32\drivers\nvraid.sys
19:51:51.0163 0x0780  nvraid - ok
19:51:51.0170 0x0780  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\windows\system32\drivers\nvstor.sys
19:51:51.0186 0x0780  nvstor - ok
19:51:51.0220 0x0780  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\windows\system32\drivers\nv_agp.sys
19:51:51.0252 0x0780  nv_agp - ok
19:51:51.0267 0x0780  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\windows\system32\drivers\ohci1394.sys
19:51:51.0283 0x0780  ohci1394 - ok
19:51:51.0338 0x0780  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\windows\system32\pnrpsvc.dll
19:51:51.0381 0x0780  p2pimsvc - ok
19:51:51.0408 0x0780  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\windows\system32\p2psvc.dll
19:51:51.0445 0x0780  p2psvc - ok
19:51:51.0459 0x0780  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\windows\system32\drivers\parport.sys
19:51:51.0476 0x0780  Parport - ok
19:51:51.0503 0x0780  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\windows\system32\drivers\partmgr.sys
19:51:51.0516 0x0780  partmgr - ok
19:51:51.0553 0x0780  [ 256390425414F90FCBC12F525A84EB11, A4992020BF6A239AD8A77125426E2C39980C9ABC971C4DBCB24B358F946AD7F9 ] PcaSvc          C:\windows\System32\pcasvc.dll
19:51:51.0591 0x0780  PcaSvc - ok
19:51:51.0689 0x0780  [ 4B5F5774FF1C577B9515FDD2B5C535C5, 1D053020079124AC526D84AFFB17BF4A1563ECD872C83B4B6299C9AA6A732557 ] PCDSRVC{D3412D80-CF3B4A27-06020200}_0 c:\program files\my dell\pcdsrvc_x64.pkms
19:51:51.0720 0x0780  PCDSRVC{D3412D80-CF3B4A27-06020200}_0 - ok
19:51:51.0741 0x0780  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\windows\system32\drivers\pci.sys
19:51:51.0756 0x0780  pci - ok
19:51:51.0790 0x0780  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\windows\system32\drivers\pciide.sys
19:51:51.0817 0x0780  pciide - ok
19:51:51.0838 0x0780  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\windows\system32\drivers\pcmcia.sys
19:51:51.0855 0x0780  pcmcia - ok
19:51:51.0876 0x0780  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\windows\system32\drivers\pcw.sys
19:51:51.0888 0x0780  pcw - ok
19:51:51.0935 0x0780  [ 946010CDFA91469351B22E2620CEBCD8, F099C92706D42ADC289B72724F7932E5D4F62A427AEC967DDB0A1D728AE59A63 ] PEAUTH          C:\windows\system32\drivers\peauth.sys
19:51:51.0976 0x0780  PEAUTH - ok
19:51:52.0051 0x0780  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\windows\SysWow64\perfhost.exe
19:51:52.0094 0x0780  PerfHost - ok
19:51:52.0173 0x0780  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\windows\system32\pla.dll
19:51:52.0249 0x0780  pla - ok
19:51:52.0304 0x0780  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\windows\system32\umpnpmgr.dll
19:51:52.0344 0x0780  PlugPlay - ok
19:51:52.0367 0x0780  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\windows\system32\pnrpauto.dll
19:51:52.0393 0x0780  PNRPAutoReg - ok
19:51:52.0424 0x0780  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\windows\system32\pnrpsvc.dll
19:51:52.0465 0x0780  PNRPsvc - ok
19:51:52.0536 0x0780  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\windows\System32\ipsecsvc.dll
19:51:52.0625 0x0780  PolicyAgent - ok
19:51:52.0643 0x0780  [ A2CCA4FB273E6050F17A0A416CFF2FCD, C42BA18DF0C8E3F7358669A784E51E4DC7A4112096345EA699EDC95F561E0255 ] Power           C:\windows\system32\umpo.dll
19:51:52.0678 0x0780  Power - ok
19:51:52.0718 0x0780  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\windows\system32\DRIVERS\raspptp.sys
19:51:52.0799 0x0780  PptpMiniport - ok
19:51:52.0813 0x0780  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\windows\system32\drivers\processr.sys
19:51:52.0841 0x0780  Processor - ok
19:51:52.0886 0x0780  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\windows\system32\profsvc.dll
19:51:52.0918 0x0780  ProfSvc - ok
19:51:52.0931 0x0780  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\windows\system32\lsass.exe
19:51:52.0946 0x0780  ProtectedStorage - ok
19:51:52.0974 0x0780  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\windows\system32\DRIVERS\pacer.sys
19:51:53.0041 0x0780  Psched - ok
19:51:53.0079 0x0780  [ 07D57B890DD5693A6AB660CBAE8F91B4, 934895A41C116056E22FE3298418332A9F4280F96E96EEE06C977A4925395674 ] PxHlpa64        C:\windows\system32\Drivers\PxHlpa64.sys
19:51:53.0097 0x0780  PxHlpa64 - ok
19:51:53.0186 0x0780  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\windows\system32\drivers\ql2300.sys
19:51:53.0241 0x0780  ql2300 - ok
19:51:53.0250 0x0780  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\windows\system32\drivers\ql40xx.sys
19:51:53.0265 0x0780  ql40xx - ok
19:51:53.0293 0x0780  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\windows\system32\qwave.dll
19:51:53.0319 0x0780  QWAVE - ok
19:51:53.0330 0x0780  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\windows\system32\drivers\qwavedrv.sys
19:51:53.0386 0x0780  QWAVEdrv - ok
19:51:53.0406 0x0780  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\windows\system32\DRIVERS\rasacd.sys
19:51:53.0466 0x0780  RasAcd - ok
19:51:53.0498 0x0780  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\windows\system32\DRIVERS\AgileVpn.sys
19:51:53.0552 0x0780  RasAgileVpn - ok
19:51:53.0578 0x0780  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\windows\System32\rasauto.dll
19:51:53.0675 0x0780  RasAuto - ok
19:51:53.0702 0x0780  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\windows\system32\DRIVERS\rasl2tp.sys
19:51:53.0786 0x0780  Rasl2tp - ok
19:51:53.0813 0x0780  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\windows\System32\rasmans.dll
19:51:53.0867 0x0780  RasMan - ok
19:51:53.0885 0x0780  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\windows\system32\DRIVERS\raspppoe.sys
19:51:53.0932 0x0780  RasPppoe - ok
19:51:53.0961 0x0780  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\windows\system32\DRIVERS\rassstp.sys
19:51:54.0030 0x0780  RasSstp - ok
19:51:54.0050 0x0780  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\windows\system32\DRIVERS\rdbss.sys
19:51:54.0110 0x0780  rdbss - ok
19:51:54.0141 0x0780  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\windows\system32\drivers\rdpbus.sys
19:51:54.0195 0x0780  rdpbus - ok
19:51:54.0215 0x0780  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\windows\system32\DRIVERS\RDPCDD.sys
19:51:54.0295 0x0780  RDPCDD - ok
19:51:54.0325 0x0780  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\windows\system32\drivers\rdpencdd.sys
19:51:54.0369 0x0780  RDPENCDD - ok
19:51:54.0391 0x0780  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\windows\system32\drivers\rdprefmp.sys
19:51:54.0454 0x0780  RDPREFMP - ok
19:51:54.0519 0x0780  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\windows\system32\drivers\rdpvideominiport.sys
19:51:54.0555 0x0780  RdpVideoMiniport - ok
19:51:54.0584 0x0780  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\windows\system32\drivers\RDPWD.sys
19:51:54.0630 0x0780  RDPWD - ok
19:51:54.0673 0x0780  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\windows\system32\drivers\rdyboost.sys
19:51:54.0690 0x0780  rdyboost - ok
19:51:54.0720 0x0780  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\windows\System32\mprdim.dll
19:51:54.0804 0x0780  RemoteAccess - ok
19:51:54.0851 0x0780  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\windows\system32\regsvc.dll
19:51:54.0919 0x0780  RemoteRegistry - ok
19:51:54.0962 0x0780  [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM          C:\windows\system32\DRIVERS\rfcomm.sys
19:51:54.0999 0x0780  RFCOMM - ok
19:51:55.0146 0x0780  [ 3C957189B31C34D3AD21967B12B6AED7, 878FE6EA03F60592D6D557B905A5119E2CC836C2A6A86ED2867C3C9B0F0FDBA2 ] RoxMediaDB12OEM c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe
19:51:55.0189 0x0780  RoxMediaDB12OEM - ok
19:51:55.0248 0x0780  [ 2B73088CC2CA757A172B425C9398E5BC, 3D296B4D6F66F7729CC48FE54456E6E6D8207DBA7E31D66653566C128E53163B ] RoxWatch12      c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe
19:51:55.0279 0x0780  RoxWatch12 - ok
19:51:55.0315 0x0780  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\windows\System32\RpcEpMap.dll
19:51:55.0374 0x0780  RpcEptMapper - ok
19:51:55.0403 0x0780  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\windows\system32\locator.exe
19:51:55.0418 0x0780  RpcLocator - ok
19:51:55.0441 0x0780  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\windows\system32\rpcss.dll
19:51:55.0490 0x0780  RpcSs - ok
19:51:55.0522 0x0780  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\windows\system32\DRIVERS\rspndr.sys
19:51:55.0577 0x0780  rspndr - ok
19:51:55.0630 0x0780  [ BE29B0A3AC1E8BD02FFAB8CEE86BADFA, D6F76ECD30EDE1E5B1F01919B1492715947ACCA411D70BB2771427775736C055 ] RSUSBSTOR       C:\windows\system32\Drivers\RtsUStor.sys
19:51:55.0669 0x0780  RSUSBSTOR - ok
19:51:55.0716 0x0780  [ EE082E06A82FF630351D1E0EBBD3D8D0, 537F1A4108BDA72E8DD271466E7B7FCF39D4D55E4129AB35A409AB7AF2E7D219 ] RTL8167         C:\windows\system32\DRIVERS\Rt64win7.sys
19:51:55.0747 0x0780  RTL8167 - ok
19:51:55.0761 0x0780  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs           C:\windows\system32\lsass.exe
19:51:55.0776 0x0780  SamSs - ok
19:51:55.0796 0x0780  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\windows\system32\drivers\sbp2port.sys
19:51:55.0810 0x0780  sbp2port - ok
19:51:55.0862 0x0780  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\windows\System32\SCardSvr.dll
19:51:55.0953 0x0780  SCardSvr - ok
19:51:55.0968 0x0780  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\windows\system32\DRIVERS\scfilter.sys
19:51:56.0003 0x0780  scfilter - ok
19:51:56.0067 0x0780  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\windows\system32\schedsvc.dll
19:51:56.0145 0x0780  Schedule - ok
19:51:56.0187 0x0780  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\windows\System32\certprop.dll
19:51:56.0233 0x0780  SCPolicySvc - ok
19:51:56.0275 0x0780  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\windows\System32\SDRSVC.dll
19:51:56.0341 0x0780  SDRSVC - ok
19:51:56.0377 0x0780  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\windows\system32\drivers\secdrv.sys
19:51:56.0435 0x0780  secdrv - ok
19:51:56.0451 0x0780  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\windows\system32\seclogon.dll
19:51:56.0520 0x0780  seclogon - ok
19:51:56.0537 0x0780  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\windows\System32\sens.dll
19:51:56.0612 0x0780  SENS - ok
19:51:56.0640 0x0780  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\windows\system32\sensrsvc.dll
19:51:56.0680 0x0780  SensrSvc - ok
19:51:56.0693 0x0780  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\windows\system32\drivers\serenum.sys
19:51:56.0739 0x0780  Serenum - ok
19:51:56.0783 0x0780  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\windows\system32\drivers\serial.sys
19:51:56.0828 0x0780  Serial - ok
19:51:56.0846 0x0780  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\windows\system32\drivers\sermouse.sys
19:51:56.0901 0x0780  sermouse - ok
19:51:56.0944 0x0780  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\windows\system32\sessenv.dll
19:51:57.0003 0x0780  SessionEnv - ok
19:51:57.0006 0x0780  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\windows\system32\drivers\sffdisk.sys
19:51:57.0032 0x0780  sffdisk - ok
19:51:57.0036 0x0780  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\windows\system32\drivers\sffp_mmc.sys
19:51:57.0061 0x0780  sffp_mmc - ok
19:51:57.0075 0x0780  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\windows\system32\drivers\sffp_sd.sys
19:51:57.0092 0x0780  sffp_sd - ok
19:51:57.0095 0x0780  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\windows\system32\drivers\sfloppy.sys
19:51:57.0110 0x0780  sfloppy - ok
19:51:57.0162 0x0780  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\windows\System32\ipnathlp.dll
19:51:57.0210 0x0780  SharedAccess - ok
19:51:57.0244 0x0780  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\windows\System32\shsvcs.dll
19:51:57.0301 0x0780  ShellHWDetection - ok
19:51:57.0335 0x0780  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\windows\system32\drivers\SiSRaid2.sys
19:51:57.0353 0x0780  SiSRaid2 - ok
19:51:57.0367 0x0780  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\windows\system32\drivers\sisraid4.sys
19:51:57.0384 0x0780  SiSRaid4 - ok
19:51:57.0418 0x0780  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\windows\system32\DRIVERS\smb.sys
19:51:57.0456 0x0780  Smb - ok
19:51:57.0485 0x0780  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\windows\System32\snmptrap.exe
19:51:57.0514 0x0780  SNMPTRAP - ok
19:51:57.0531 0x0780  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\windows\system32\drivers\spldr.sys
19:51:57.0542 0x0780  spldr - ok
19:51:57.0605 0x0780  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\windows\System32\spoolsv.exe
19:51:57.0655 0x0780  Spooler - ok
19:51:57.0814 0x0780  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\windows\system32\sppsvc.exe
19:51:57.0937 0x0780  sppsvc - ok
19:51:57.0962 0x0780  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\windows\system32\sppuinotify.dll
19:51:58.0001 0x0780  sppuinotify - ok
19:51:58.0054 0x0780  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\windows\system32\DRIVERS\srv.sys
19:51:58.0098 0x0780  srv - ok
19:51:58.0125 0x0780  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\windows\system32\DRIVERS\srv2.sys
19:51:58.0167 0x0780  srv2 - ok
19:51:58.0195 0x0780  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\windows\system32\DRIVERS\srvnet.sys
19:51:58.0225 0x0780  srvnet - ok
19:51:58.0243 0x0780  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\windows\System32\ssdpsrv.dll
19:51:58.0293 0x0780  SSDPSRV - ok
19:51:58.0308 0x0780  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\windows\system32\sstpsvc.dll
19:51:58.0347 0x0780  SstpSvc - ok
19:51:58.0417 0x0780  [ A6B2EC3A2B6AD7C3F7B2F3495CADE4C0, AD540FB4F300731DE403FB95F110A0F3DBA25917A91EAB23966286DD88C98D17 ] STacSV          C:\Program Files\IDT\WDM\STacSV64.exe
19:51:58.0460 0x0780  STacSV - ok
19:51:58.0484 0x0780  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\windows\system32\drivers\stexstor.sys
19:51:58.0496 0x0780  stexstor - ok
19:51:58.0538 0x0780  [ EBA98394A7D58F7552C52192BD8FA7E6, 4238870E50132E87772300058B37E36973695CC1A5E62117EEF4B424C6A137E4 ] STHDA           C:\windows\system32\DRIVERS\stwrt64.sys
19:51:58.0566 0x0780  STHDA - ok
19:51:58.0619 0x0780  [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam        C:\windows\system32\DRIVERS\serscan.sys
19:51:58.0653 0x0780  StillCam - ok
19:51:58.0700 0x0780  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\windows\System32\wiaservc.dll
19:51:58.0775 0x0780  stisvc - ok
19:51:58.0825 0x0780  [ 7731F46EC0D687A931CBA063E8F90EF0, 5CF996A209756B901316C4406C7D3E52ECC9C15A1BDB0D4D9C77846AB29FD040 ] stllssvr        c:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
19:51:58.0854 0x0780  stllssvr - ok
19:51:58.0883 0x0780  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\windows\system32\DRIVERS\swenum.sys
19:51:58.0894 0x0780  swenum - ok
19:51:58.0931 0x0780  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\windows\System32\swprv.dll
19:51:58.0984 0x0780  swprv - ok
19:51:59.0075 0x0780  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\windows\system32\sysmain.dll
19:51:59.0149 0x0780  SysMain - ok
19:51:59.0179 0x0780  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\windows\System32\TabSvc.dll
19:51:59.0203 0x0780  TabletInputService - ok
19:51:59.0238 0x0780  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\windows\System32\tapisrv.dll
19:51:59.0299 0x0780  TapiSrv - ok
19:51:59.0312 0x0780  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\windows\System32\tbssvc.dll
19:51:59.0350 0x0780  TBS - ok
19:51:59.0470 0x0780  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\windows\system32\drivers\tcpip.sys
19:51:59.0536 0x0780  Tcpip - ok
19:51:59.0620 0x0780  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\windows\system32\DRIVERS\tcpip.sys
19:51:59.0679 0x0780  TCPIP6 - ok
19:51:59.0718 0x0780  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\windows\system32\drivers\tcpipreg.sys
19:51:59.0752 0x0780  tcpipreg - ok
19:51:59.0786 0x0780  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\windows\system32\drivers\tdpipe.sys
19:51:59.0811 0x0780  TDPIPE - ok
19:51:59.0840 0x0780  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\windows\system32\drivers\tdtcp.sys
19:51:59.0874 0x0780  TDTCP - ok
19:51:59.0896 0x0780  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\windows\system32\DRIVERS\tdx.sys
19:51:59.0933 0x0780  tdx - ok
19:51:59.0945 0x0780  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\windows\system32\DRIVERS\termdd.sys
19:51:59.0956 0x0780  TermDD - ok
19:52:00.0033 0x0780  [ 4FC4C50985E5B840F4D72E57286887B8, 0BCBB4A938803AE3A3532B6D8FFC85594AA9AEF5D8F9792684841BEA8780AE9E ] TermService     C:\windows\System32\termsrv.dll
19:52:00.0073 0x0780  TermService - ok
19:52:00.0098 0x0780  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\windows\system32\themeservice.dll
19:52:00.0138 0x0780  Themes - ok
19:52:00.0167 0x0780  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\windows\system32\mmcss.dll
19:52:00.0204 0x0780  THREADORDER - ok
19:52:00.0222 0x0780  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\windows\System32\trkwks.dll
19:52:00.0271 0x0780  TrkWks - ok
19:52:00.0341 0x0780  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
19:52:00.0389 0x0780  TrustedInstaller - ok
19:52:00.0423 0x0780  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\windows\system32\DRIVERS\tssecsrv.sys
19:52:00.0446 0x0780  tssecsrv - ok
19:52:00.0480 0x0780  [ 17C6B51CBCCDED95B3CC14E22791F85E, EE417C19E9B2C258D62A74F1F2421AFFBAC67ACD62481CAA08F5B6A3439C1D7C ] TsUsbFlt        C:\windows\system32\drivers\tsusbflt.sys
19:52:00.0503 0x0780  TsUsbFlt - ok
19:52:00.0535 0x0780  [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD         C:\windows\system32\drivers\TsUsbGD.sys
19:52:00.0584 0x0780  TsUsbGD - ok
19:52:00.0662 0x0780  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\windows\system32\DRIVERS\tunnel.sys
19:52:00.0706 0x0780  tunnel - ok
19:52:00.0719 0x0780  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\windows\system32\drivers\uagp35.sys
19:52:00.0732 0x0780  uagp35 - ok
19:52:00.0756 0x0780  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\windows\system32\DRIVERS\udfs.sys
19:52:00.0800 0x0780  udfs - ok
19:52:00.0842 0x0780  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\windows\system32\UI0Detect.exe
19:52:00.0899 0x0780  UI0Detect - ok
19:52:00.0936 0x0780  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\windows\system32\drivers\uliagpkx.sys
19:52:00.0957 0x0780  uliagpkx - ok
19:52:00.0993 0x0780  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\windows\system32\DRIVERS\umbus.sys
19:52:01.0015 0x0780  umbus - ok
19:52:01.0047 0x0780  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\windows\system32\drivers\umpass.sys
19:52:01.0071 0x0780  UmPass - ok
19:52:01.0227 0x0780  [ 7A78ED1088890114DFDE2C4AB038D6B6, B52357594A90A8BCF5F96FA630F52BB1274A2FE814AF0270D21C892871D076FC ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
19:52:01.0303 0x0780  UNS - ok
19:52:01.0362 0x0780  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\windows\System32\upnphost.dll
19:52:01.0419 0x0780  upnphost - ok
19:52:01.0452 0x0780  [ 91D3C92A44FC682DD791147604E79152, AA0B6799BF9C26C2C1793C91295288A4989AA43EC5E070B650DA7F0A142817CE ] usbccgp         C:\windows\system32\DRIVERS\usbccgp.sys
19:52:01.0490 0x0780  usbccgp - ok
19:52:01.0535 0x0780  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\windows\system32\drivers\usbcir.sys
19:52:01.0584 0x0780  usbcir - ok
19:52:01.0625 0x0780  [ F7FFDF2A1D19A76A87759126B244C816, C91F09D77E22D976952A46F7B93F611B719EDAF694D538242FA8FAF1BA9BB2F0 ] usbehci         C:\windows\system32\drivers\usbehci.sys
19:52:01.0651 0x0780  usbehci - ok
19:52:01.0693 0x0780  [ 245FE7FC634D6A993E682E0A9EBA4ABB, F7A536D215EE3A63358EC8B5946D7BB3B56357BF91347B07013E00DAC98775B6 ] usbhub          C:\windows\system32\DRIVERS\usbhub.sys
19:52:01.0748 0x0780  usbhub - ok
19:52:01.0780 0x0780  [ C1A8966E0D09BFB501045105B30D86F2, 5BB95FBA441B898E258A3BFE174FC1042A04C19E25C59DE1FD90594290B11DA9 ] usbohci         C:\windows\system32\drivers\usbohci.sys
19:52:01.0829 0x0780  usbohci - ok
19:52:01.0867 0x0780  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\windows\system32\drivers\usbprint.sys
19:52:01.0920 0x0780  usbprint - ok
19:52:01.0937 0x0780  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\windows\system32\DRIVERS\USBSTOR.SYS
19:52:01.0969 0x0780  USBSTOR - ok
19:52:01.0990 0x0780  [ 2E682DCE4319A90E02A327F8A427544A, 3528C5A4669BAD53041085C3E72C64388D308E42AD9D1FAC85B6F2FFD81610FB ] usbuhci         C:\windows\system32\drivers\usbuhci.sys
19:52:02.0005 0x0780  usbuhci - ok
19:52:02.0055 0x0780  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\windows\System32\Drivers\usbvideo.sys
19:52:02.0090 0x0780  usbvideo - ok
19:52:02.0109 0x0780  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\windows\System32\uxsms.dll
19:52:02.0157 0x0780  UxSms - ok
19:52:02.0172 0x0780  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc        C:\windows\system32\lsass.exe
19:52:02.0187 0x0780  VaultSvc - ok
19:52:02.0226 0x0780  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\windows\system32\drivers\vdrvroot.sys
19:52:02.0238 0x0780  vdrvroot - ok
19:52:02.0294 0x0780  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\windows\System32\vds.exe
19:52:02.0355 0x0780  vds - ok
19:52:02.0387 0x0780  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\windows\system32\DRIVERS\vgapnp.sys
19:52:02.0421 0x0780  vga - ok
19:52:02.0436 0x0780  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\windows\System32\drivers\vga.sys
19:52:02.0481 0x0780  VgaSave - ok
19:52:02.0502 0x0780  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\windows\system32\drivers\vhdmp.sys
19:52:02.0520 0x0780  vhdmp - ok
19:52:02.0546 0x0780  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\windows\system32\drivers\viaide.sys
19:52:02.0558 0x0780  viaide - ok
19:52:02.0573 0x0780  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\windows\system32\drivers\volmgr.sys
19:52:02.0588 0x0780  volmgr - ok
19:52:02.0616 0x0780  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\windows\system32\drivers\volmgrx.sys
19:52:02.0637 0x0780  volmgrx - ok
19:52:02.0661 0x0780  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\windows\system32\drivers\volsnap.sys
19:52:02.0680 0x0780  volsnap - ok
19:52:02.0709 0x0780  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\windows\system32\drivers\vsmraid.sys
19:52:02.0743 0x0780  vsmraid - ok
19:52:02.0826 0x0780  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\windows\system32\vssvc.exe
19:52:02.0909 0x0780  VSS - ok
19:52:02.0930 0x0780  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\windows\system32\DRIVERS\vwifibus.sys
19:52:02.0977 0x0780  vwifibus - ok
19:52:02.0998 0x0780  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\windows\system32\DRIVERS\vwififlt.sys
19:52:03.0055 0x0780  vwififlt - ok
19:52:03.0098 0x0780  [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp         C:\windows\system32\DRIVERS\vwifimp.sys
19:52:03.0139 0x0780  vwifimp - ok
19:52:03.0198 0x0780  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\windows\system32\w32time.dll
19:52:03.0254 0x0780  W32Time - ok
19:52:03.0273 0x0780  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\windows\system32\drivers\wacompen.sys
19:52:03.0288 0x0780  WacomPen - ok
19:52:03.0331 0x0780  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\windows\system32\DRIVERS\wanarp.sys
19:52:03.0390 0x0780  WANARP - ok
19:52:03.0395 0x0780  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\windows\system32\DRIVERS\wanarp.sys
19:52:03.0430 0x0780  Wanarpv6 - ok
19:52:03.0508 0x0780  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\windows\system32\wbengine.exe
19:52:03.0582 0x0780  wbengine - ok
19:52:03.0625 0x0780  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\windows\System32\wbiosrvc.dll
19:52:03.0663 0x0780  WbioSrvc - ok
19:52:03.0704 0x0780  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\windows\System32\wcncsvc.dll
19:52:03.0763 0x0780  wcncsvc - ok
19:52:03.0782 0x0780  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
19:52:03.0815 0x0780  WcsPlugInService - ok
19:52:03.0843 0x0780  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\windows\system32\drivers\wd.sys
19:52:03.0857 0x0780  Wd - ok
19:52:03.0903 0x0780  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\windows\system32\drivers\Wdf01000.sys
19:52:03.0938 0x0780  Wdf01000 - ok
19:52:03.0969 0x0780  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\windows\system32\wdi.dll
19:52:04.0012 0x0780  WdiServiceHost - ok
19:52:04.0018 0x0780  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\windows\system32\wdi.dll
19:52:04.0041 0x0780  WdiSystemHost - ok
19:52:04.0083 0x0780  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\windows\System32\webclnt.dll
19:52:04.0122 0x0780  WebClient - ok
19:52:04.0170 0x0780  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\windows\system32\wecsvc.dll
19:52:04.0223 0x0780  Wecsvc - ok
19:52:04.0246 0x0780  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\windows\System32\wercplsupport.dll
19:52:04.0297 0x0780  wercplsupport - ok
19:52:04.0323 0x0780  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\windows\System32\WerSvc.dll
19:52:04.0374 0x0780  WerSvc - ok
19:52:04.0403 0x0780  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\windows\system32\DRIVERS\wfplwf.sys
19:52:04.0438 0x0780  WfpLwf - ok
19:52:04.0497 0x0780  [ B14EF15BD757FA488F9C970EEE9C0D35, F27DF2D47E7076786AE7C396583D7A1C56B93E766711066C900964FC7313E794 ] WimFltr         C:\windows\system32\DRIVERS\wimfltr.sys
19:52:04.0523 0x0780  WimFltr - ok
19:52:04.0536 0x0780  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\windows\system32\drivers\wimmount.sys
19:52:04.0548 0x0780  WIMMount - ok
19:52:04.0566 0x0780  WinDefend - ok
19:52:04.0587 0x0780  WinHttpAutoProxySvc - ok
19:52:04.0680 0x0780  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\windows\system32\wbem\WMIsvc.dll
19:52:04.0765 0x0780  Winmgmt - ok
19:52:04.0841 0x0780  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\windows\system32\WsmSvc.dll
19:52:04.0939 0x0780  WinRM - ok
19:52:05.0001 0x0780  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\windows\system32\DRIVERS\WinUsb.sys
19:52:05.0033 0x0780  WinUsb - ok
19:52:05.0087 0x0780  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\windows\System32\wlansvc.dll
19:52:05.0130 0x0780  Wlansvc - ok
19:52:05.0166 0x0780  [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
19:52:05.0181 0x0780  wlcrasvc - ok
19:52:05.0278 0x0780  [ 7E47C328FC4768CB8BEAFBCFAFA70362, C98BD6A0C2F70E069D5FD3BAB31BD028DFEAC0490D180BBC28A14BE375897D8C ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
19:52:05.0346 0x0780  wlidsvc - ok
19:52:05.0381 0x0780  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\windows\system32\DRIVERS\wmiacpi.sys
19:52:05.0414 0x0780  WmiAcpi - ok
19:52:05.0444 0x0780  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\windows\system32\wbem\WmiApSrv.exe
19:52:05.0464 0x0780  wmiApSrv - ok
19:52:05.0500 0x0780  WMPNetworkSvc - ok
19:52:05.0527 0x0780  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\windows\System32\wpcsvc.dll
19:52:05.0560 0x0780  WPCSvc - ok
19:52:05.0590 0x0780  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\windows\system32\wpdbusenum.dll
19:52:05.0626 0x0780  WPDBusEnum - ok
19:52:05.0649 0x0780  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\windows\system32\drivers\ws2ifsl.sys
19:52:05.0703 0x0780  ws2ifsl - ok
19:52:05.0713 0x0780  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\windows\System32\wscsvc.dll
19:52:05.0756 0x0780  wscsvc - ok
19:52:05.0802 0x0780  [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice  C:\windows\system32\DRIVERS\WSDPrint.sys
19:52:05.0839 0x0780  WSDPrintDevice - ok
19:52:05.0842 0x0780  WSearch - ok
19:52:05.0965 0x0780  [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv        C:\windows\system32\wuaueng.dll
19:52:06.0041 0x0780  wuauserv - ok
19:52:06.0071 0x0780  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\windows\system32\drivers\WudfPf.sys
19:52:06.0106 0x0780  WudfPf - ok
19:52:06.0142 0x0780  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\windows\system32\DRIVERS\WUDFRd.sys
19:52:06.0174 0x0780  WUDFRd - ok
19:52:06.0194 0x0780  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\windows\System32\WUDFSvc.dll
19:52:06.0230 0x0780  wudfsvc - ok
19:52:06.0275 0x0780  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\windows\System32\wwansvc.dll
19:52:06.0338 0x0780  WwanSvc - ok
19:52:06.0348 0x0780  ================ Scan global ===============================
19:52:06.0368 0x0780  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\windows\system32\basesrv.dll
19:52:06.0394 0x0780  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\windows\system32\winsrv.dll
19:52:06.0408 0x0780  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\windows\system32\winsrv.dll
19:52:06.0441 0x0780  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\windows\system32\sxssrv.dll
19:52:06.0498 0x0780  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\windows\system32\services.exe
19:52:06.0524 0x0780  [ Global ] - ok
19:52:06.0525 0x0780  ================ Scan MBR ==================================
19:52:06.0542 0x0780  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
19:52:06.0862 0x0780  \Device\Harddisk0\DR0 - ok
19:52:06.0863 0x0780  ================ Scan VBR ==================================
19:52:06.0868 0x0780  [ B4A651EA79A9998884DA67ECFFB5E2E7 ] \Device\Harddisk0\DR0\Partition1
19:52:06.0871 0x0780  \Device\Harddisk0\DR0\Partition1 - ok
19:52:06.0878 0x0780  [ 148EFC0CB4D593C338B4ACC0E7DD1119 ] \Device\Harddisk0\DR0\Partition2
19:52:06.0920 0x0780  \Device\Harddisk0\DR0\Partition2 - ok
19:52:06.0933 0x0780  [ BFAECB857E6474ACFB65F82D493562EB ] \Device\Harddisk0\DR0\Partition3
19:52:06.0965 0x0780  \Device\Harddisk0\DR0\Partition3 - ok
19:52:06.0966 0x0780  ================ Scan generic autorun ======================
19:52:07.0013 0x0780  [ 87D32202404483FA9860BC3774F04031, C031C3A80DF30684B36F849EE4EC9AB88AE97A71DF4C1614C3977BF7EBAE1251 ] C:\Windows\system32\igfxtray.exe
19:52:07.0040 0x0780  IgfxTray - ok
19:52:07.0063 0x0780  [ E48592D99D6024DDCC76F2FB0347A9C7, 7DF7E15771FCBCF0D6C8D35B0124B3D02FB0C2EB0922B966C7ABCA6A310A96C2 ] C:\Windows\system32\hkcmd.exe
19:52:07.0082 0x0780  HotKeysCmds - ok
19:52:07.0102 0x0780  [ 88A186BC307825427338252EB4A82D87, FAB48F1EBCC1DD181D3E4D6FCF74198B9D8CCF060130AFBF02C50EC250C2DC77 ] C:\Windows\system32\igfxpers.exe
19:52:07.0122 0x0780  Persistence - ok
19:52:07.0184 0x0780  [ 527BA8F96712AB5535A84B3AE15E66E3, 87A7B7C17429804BBFAD920B5B41D4C023B4AAEC1622C7B5353A5F51AA014640 ] C:\Program Files\DellTPad\Apoint.exe
19:52:07.0207 0x0780  Apoint - ok
19:52:07.0286 0x0780  [ D5A3EB5ED95E36B643E55F9F489FC8FC, 9DAE0075888E540659E6FC3FAB433108BF296CDF52DA11ECA4440E06E5187ED1 ] C:\Program Files\IDT\WDM\sttray64.exe
19:52:07.0341 0x0780  SysTrayApp - ok
19:52:07.0519 0x0780  [ B74C5AD12D3B307893D1019A370B77B1, E5F58402520A659A8EDE96EB0762011994A5EAB5FCF56FA28ED1C9F9336CE6B2 ] C:\Program Files\Dell\QuickSet\QuickSet.exe
19:52:07.0618 0x0780  QuickSet - ok
19:52:07.0758 0x0780  [ 79C9B6A7836DC358216036A1EBA31B62, 9E3987ED10C5CFCD06A2DCBC4E0838004F97A1527527749EF3CC7C5EC5AC2597 ] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe
19:52:07.0799 0x0780  AdobeAAMUpdater-1.0 - ok
19:52:07.0852 0x0780  [ 41D1214B86A06FD29423A797EBDA17E4, ABC79107DDD5890C54B844CD5C69747121083DA69A77C02068D2B9C349FB1614 ] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
19:52:07.0889 0x0780  IAStorIcon - ok
19:52:08.0096 0x0780  [ 26B558B2D31C7425B455B00E562EAD93, B64D128A2F1FC42BA4376F8EB08D70F4B705745CB983D0631DB45851BF34BBDF ] C:\Program Files\AVAST Software\Avast\AvastUI.exe
19:52:08.0211 0x0780  AvastUI.exe - ok
19:52:08.0286 0x0780  [ CE5C9977DA751DDC30952AC4DCBCA788, 295172C4681E9AC27121122CDD2BA6F2A62435917A083CC8490D584CA0164BE6 ] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
19:52:08.0313 0x0780  HP Software Update - ok
19:52:08.0420 0x0780  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
19:52:08.0479 0x0780  Sidebar - ok
19:52:08.0510 0x0780  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
19:52:08.0547 0x0780  mctadmin - ok
19:52:08.0580 0x0780  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
19:52:08.0622 0x0780  Sidebar - ok
19:52:08.0628 0x0780  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
19:52:08.0649 0x0780  mctadmin - ok
19:52:08.0812 0x0780  [ 22F7B9670AD770C7ED7F4738204C8E5C, 7B793AC094CB1B073419B5DAE09DFBB8EBED03D29301F490AA76EA0667613438 ] C:\Program Files\HP\HP Photosmart 5520 series\Bin\ScanToPCActivationApp.exe
19:52:08.0885 0x0780  HP Photosmart 5520 series (NET) - ok
19:52:08.0989 0x0780  [ 67532439BB1556CC64A551FDC4CD881E, 31841C350C6247F31D0FF61B6F70B4D713FBAB59AD7927F497014D1AF2B7FE98 ] C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe
19:52:09.0014 0x0780  GarminExpressTrayApp - ok
19:52:09.0016 0x0780  Waiting for KSN requests completion. In queue: 417
19:52:10.0016 0x0780  Waiting for KSN requests completion. In queue: 417
19:52:11.0016 0x0780  Waiting for KSN requests completion. In queue: 417
19:52:12.0017 0x0780  Waiting for KSN requests completion. In queue: 417
19:52:13.0100 0x0780  AV detected via SS2: avast! Antivirus, C:\Program Files\AVAST Software\Avast\VisthAux.exe ( 9.0.2021.515 ), 0x41000 ( enabled : updated )
19:52:13.0131 0x0780  Win FW state via NFP2: enabled
19:52:15.0572 0x0780  ============================================================
19:52:15.0572 0x0780  Scan finished
19:52:15.0572 0x0780  ============================================================
19:52:15.0593 0x09e4  Detected object count: 0
19:52:15.0593 0x09e4  Actual detected object count: 0
         

Bis denne

cybbe

Hi,

Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

• Öffne die TFC.exe.
  Vista und Win 7 User mit Rechtsklick "als Administrator starten".
• Schließe alle anderen Programme.
• Drücke auf den Button Start.
• Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Ist der PC immernoch so langsam? "Plagegeistermäßig" sind wir nämlich durch...

Ja,

leider ist er immer noch sehr langsam. Hab schon ein neues AV Programm probiert. Kurz mit Erfolg aber gerade eben war das Bild wieder schwarz und nach ca. 3 Minuten gings dann weiter. Ich werd mich jetzt mal die Ereignisse zur Brust nehmen und hoffe das ich da was finde. Xbootmgr hat leider gar nix gebracht

Nochmals vielen Dank für das Loswerden der Plagegeister

cybbe

Bitte das mal probieren:
Gewusst wie: Durchführen eines sauberen Neustarts in Windows

Also, das deaktivieren aller Nicht-Windows Dienste hat einen enormen Schub gegeben.
Würdest Du diese nun deaktiviert lassen oder nach und nach testen?

Danke

Zitat von cybbe

Würdest Du diese nun deaktiviert lassen oder nach und nach testen?
Danke

Das ist der Trick dabei... so kannste evtl. den möglichen Verursacher ausfindig machen.

Bitte das Java neuinstallieren (ist unten verlinkt) und Chrome mal updaten lassen.


Cleanup:

Alle Logs gepostet? Ja! Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

>>clean<<
Wir haben es geschafft!
Die Logs sehen für mich im Moment sauber aus.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.
Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen.

Wie kann ich mich in Zukunft besser schützen?

Tipps, Dos & Don'ts

Updates & Software

• Beim Betriebsystem Windows die automatischen Updates aktivieren.
  
  Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:
• Browser
• Java
• Flash-Player & PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.

Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.



Firewall, Antivirus & Co.

• Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.
  
• Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank. (Updatefunktion aktivieren!)
  Meine Empfehlungen:
  Kaspersky Antivirus
  Emsisoft Anti-Malware
  avast Free Antivirus
• Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.
  
  Optional:
• NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
  
  

Cracks, Downloads & Co.


Neben unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.
Der Besuch dubioser Websites kann bereits Risiken bergen. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.
Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher und beliebter Weg um Malware zu verbreiten.
Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kann man nie sicher sein, ob auch wirklich drin ist, was drauf steht. (Trojanisches Pferd^^)

• Auch virustotal.com ist Dein Freund! Lade dubiose oder unbekannte Dateien hoch, bevor Du diese startest oder installierst.

Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden zu verleiten, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).

• Surfe daher mit Vorsicht und klicke mit Verstand.
• Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von Dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo Deine Daten eingeben.
• Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst Du von einem Deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und Du solltest nicht denselben Fehler machen.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.

• Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
• Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
• Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwarecleaner .
  

Abschließend noch ein paar grundsätzliche Bemerkungen:

• Erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
• Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.