| |
| |||||||
Log-Analyse und Auswertung: Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten BereichenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
14.01.2015, 00:31
| #1 |
 |  Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen Hallo liebe Helfer/Helferinnen, Seit einigen Wochen ist mein Laptop zunehmend langsamer geworden. Dies ist besonders auffällig bei Benutzung von Internetbrowsern(überwiegend Firefox bis ausschließlich), MMORPGS(Aion und vor allem Tera Rising) und auch bei diversen Anwendungen & Apps. Das Spiel Tera Rising stürzt zu dem regelmäßig in kurzen Abständen ab. Dies soll scheinbar ein häufiges Problem in der Community zu sein. Ich habe mehrfach Antivir Avira nach Viren etc suchen lassen, dabei waren aber keine Funde. Das System wurde vollständig durchsucht, die Heuristik war in allen Bereichen auf hoch eingestellt. Nachdem ich mir dann unsicher wurde, was die Anwendung von Avira angeht, habe ich mir einen neuen Virenscanner installiert - Panda Free Antivirus. Dieser hat dann auch bei dem ersten Scans unerwünschte Programme entdeckt (PUP's), die ich daraufhin gelöscht habe. Der Scan wurde mit einem zusätzlichen Programm namens Panda Cloudcleaner durchgeführt. Um die Frage auszuschließen: Windows Defender ist deaktiviert und Avira wurde zuvor im Offlinemodus deinstalliert. Nach der Entfernung dieser schien es anfänglich so, als wäre das Gerät wieder schneller, jedoch hat sich die Euphorie genauso schnell wieder in Luft aufgelöst. Nun zu den Logfiles: Ich hatte bei dem ersten Scan von GMER vergessen, den Haken bei IAT/EAT zu entfernen und daher den ersten Scan direkt geschlossen. Nachdem ich versucht hatte einen zweiten Scan durchlaufen zu lassen, hatte das Programm Probleme bei der Ausführung und wurde direkt geschlossen. Nach einem Neustart funktionierte es weiterhin nicht. Als ich dann nach Kompatibilitätsproblemen suchen lassen habe, hat es schlussendlich wieder funktioniert. defogger_disable.txt Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:35 on 13/01/2015 (Josephine Mireille)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2015 02
Ran by Josephine Mireille (administrator) on MIREILLE on 13-01-2015 23:05:32
Running from C:\Users\Josephine Mireille\Downloads
Loaded Profile: Josephine Mireille (Available profiles: Josephine Mireille & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(VTech) C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechServiceInstaller.exe
(VTech) C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechUSBSocketService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13427784 2013-03-18] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-08] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3010800 2014-06-01] (Synaptics Incorporated)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-28] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [AgentMonitor] => C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe [401280 2014-06-20] ()
HKLM-x32\...\Run: [DXM6Patch_981116] => C:\WINDOWS\p_981116.exe [497376 1998-11-30] (Microsoft Corporation)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [134784 2014-04-02] ( (Atheros Communications))
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\...\MountPoints2: {8447746c-297d-11e4-bea7-485ab66d3c08} - "E:\Startme.exe"
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs: ,C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [165760 2014-12-13] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.digimonmasters.com/index.aspx
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
DPF: HKLM-x32 {9A3D12F9-8802-4316-B877-022025566DA1} hxxp://www.digimonmasters.com/inc/ActiveX/launcher/20130813/Digitalic%20Launcher.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Josephine Mireille\AppData\Roaming\Mozilla\Firefox\Profiles\5h2pxznh.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-768070318-4204382875-4262773496-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Josephine Mireille\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\webssearches.xml
FF Extension: Adblock Plus - C:\Users\Josephine Mireille\AppData\Roaming\Mozilla\Firefox\Profiles\5h2pxznh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-22]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [319104 2014-04-02] (Windows (R) Win 7 DDK provider)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-11-21] (BitRaider, LLC)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-17] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2014-06-01] (Intel Corporation)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-24] (Electronic Arts)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 VTechUSBSocketService; C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechServiceInstaller.exe [82824 2013-03-29] (VTech)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3892224 2014-03-06] (Qualcomm Atheros Communications, Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-06-27] ()
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2014-11-21] (BitRaider)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-04-02] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-06-27] ()
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-06-01] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-13 23:04 - 2015-01-13 23:05 - 00020254 _____ () C:\Users\Josephine Mireille\Downloads\Addition.txt
2015-01-13 23:03 - 2015-01-13 23:05 - 00015096 _____ () C:\Users\Josephine Mireille\Downloads\FRST.txt
2015-01-13 23:03 - 2015-01-13 23:05 - 00000000 ____D () C:\FRST
2015-01-13 23:02 - 2015-01-13 23:02 - 00000498 _____ () C:\Users\Josephine Mireille\Downloads\defogger_disable.log
2015-01-13 23:02 - 2015-01-13 23:02 - 00000000 _____ () C:\Users\Josephine Mireille\defogger_reenable
2015-01-13 22:59 - 2015-01-13 22:59 - 02124288 _____ (Farbar) C:\Users\Josephine Mireille\Downloads\FRST64.exe
2015-01-13 22:55 - 2015-01-13 22:55 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\10 WBC
2015-01-13 22:53 - 2015-01-13 22:54 - 00380416 _____ () C:\Users\Josephine Mireille\Downloads\Gmer-19357.exe
2015-01-13 22:45 - 2015-01-13 22:45 - 00050477 _____ () C:\Users\Josephine Mireille\Downloads\Defogger.exe
2015-01-12 15:19 - 2015-01-12 15:19 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\TeraSAVES
2015-01-12 09:51 - 2015-01-12 09:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-12 09:51 - 2014-12-13 01:11 - 02824504 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 02210040 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 01715224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 01291464 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2015-01-12 09:50 - 2015-01-12 10:30 - 00000000 ____D () C:\WINDOWS\SysWOW64\NV
2015-01-12 09:50 - 2015-01-12 10:30 - 00000000 ____D () C:\WINDOWS\system32\NV
2015-01-12 09:50 - 2015-01-12 09:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2015-01-12 09:49 - 2015-01-12 09:50 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2015-01-12 09:48 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 18594432 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 17264312 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 16040184 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 14128496 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2015-01-12 09:48 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 02897824 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6434709.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6434709.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00496272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00399688 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00391488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00346944 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00031376 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvpciflt.sys
2015-01-12 09:48 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2015-01-12 09:48 - 2014-11-22 11:46 - 00035472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2015-01-12 09:48 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2015-01-12 09:42 - 2015-01-12 09:50 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-12 09:42 - 2014-12-13 09:03 - 06859408 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 03513488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 02558608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 01097360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00935240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2015-01-12 09:42 - 2014-12-13 09:03 - 00386368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00075080 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00062608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2015-01-12 09:42 - 2014-12-13 00:11 - 04151176 _____ () C:\WINDOWS\system32\nvcoproc.bin
2015-01-12 09:40 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-01-12 03:17 - 2015-01-12 03:17 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Panda Security
2015-01-12 03:16 - 2015-01-12 03:16 - 00000180 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-01-12 01:28 - 2015-01-12 01:28 - 00001298 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2015-01-12 01:28 - 2015-01-12 01:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2015-01-12 00:23 - 2015-01-12 00:23 - 00227096 _____ () C:\Users\Administrator\Downloads\avira_registry_cleaner_de.exe
2015-01-12 00:16 - 2014-12-31 12:14 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-01-12 00:15 - 2015-01-12 01:28 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-01-12 00:15 - 2015-01-12 00:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Panda Security
2015-01-12 00:15 - 2015-01-12 00:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-01-12 00:13 - 2015-01-12 00:16 - 00000000 ____D () C:\ProgramData\Panda Security
2015-01-02 22:10 - 2015-01-13 22:58 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\Sims 4
2014-12-25 10:35 - 2014-12-25 10:35 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-24 22:43 - 2014-12-24 22:43 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\Electronic Arts
2014-12-24 22:41 - 2014-12-24 22:41 - 00001362 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-12-24 22:41 - 2014-12-24 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-12-24 22:41 - 2014-09-16 18:45 - 00447752 _____ (On2.com) C:\WINDOWS\SysWOW64\vp6vfw.dll
2014-12-19 20:27 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-19 20:27 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-18 11:48 - 2014-12-18 11:48 - 00004608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w95inf32.dll
2014-12-18 11:48 - 2014-12-18 11:48 - 00002272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w95inf16.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 01088272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\danim.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 00155408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LMRT.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unam4ie.exe
2014-12-18 11:48 - 1998-09-02 09:28 - 00038160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LMRTREND.dll
2014-12-18 11:48 - 1998-09-02 09:02 - 00194320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qcut.dll
2014-12-18 11:48 - 1998-08-27 05:51 - 00182032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft3.dll
2014-12-18 11:48 - 1998-08-20 12:02 - 00140800 _____ (The Duck Corporation) C:\WINDOWS\SysWOW64\tm20dec.ax
2014-12-18 11:48 - 1998-08-20 11:38 - 00217984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\strmdll.dll
2014-12-18 11:48 - 1998-08-17 10:21 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mciqtz.drv
2014-12-18 11:48 - 1998-08-17 10:21 - 00010240 _____ () C:\WINDOWS\SysWOW64\vidx16.dll
2014-12-18 11:48 - 1998-08-17 10:21 - 00005672 _____ () C:\WINDOWS\SysWOW64\quartz.vxd
2014-12-18 11:24 - 2014-12-26 17:54 - 00000000 ____D () C:\Program Files (x86)\Catan
2014-12-18 11:24 - 1998-10-21 18:43 - 00328704 _____ (InstallShield Software Corporation ) C:\WINDOWS\IsUn0407.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-13 23:02 - 2014-05-31 23:06 - 00000000 ____D () C:\Users\Josephine Mireille
2015-01-13 23:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-13 22:58 - 2014-05-31 23:16 - 01077688 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-13 22:31 - 2014-03-18 11:04 - 01689572 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-13 22:31 - 2014-03-18 10:25 - 00728968 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-13 22:31 - 2014-03-18 10:25 - 00152122 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-13 22:27 - 2014-06-01 09:37 - 00000000 __RDO () C:\Users\Josephine Mireille\OneDrive
2015-01-13 22:23 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-13 22:23 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-13 22:20 - 2014-06-02 13:48 - 00000000 ____D () C:\ProgramData\Origin
2015-01-13 22:19 - 2014-06-02 13:48 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-01-13 20:59 - 2014-06-03 22:48 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\Gameforge Live
2015-01-12 19:17 - 2014-11-11 11:44 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-01-12 10:07 - 2014-05-31 16:15 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-768070318-4204382875-4262773496-1001
2015-01-12 09:51 - 2014-06-01 07:22 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\NVIDIA Corporation
2015-01-12 09:51 - 2014-05-31 16:35 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-01-12 09:51 - 2014-05-31 16:35 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-01-12 09:50 - 2013-08-22 15:46 - 00008474 _____ () C:\WINDOWS\setupact.log
2015-01-12 09:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-12 09:41 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Help
2015-01-12 09:40 - 2013-08-22 15:44 - 00384464 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-12 00:34 - 2014-05-31 23:36 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-768070318-4204382875-4262773496-500
2015-01-12 00:21 - 2014-11-04 09:11 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-12 00:10 - 2014-05-31 23:06 - 00000000 ____D () C:\Users\Administrator
2015-01-12 00:10 - 2014-03-18 02:51 - 00213880 _____ () C:\WINDOWS\PFRO.log
2015-01-12 00:08 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-11 15:05 - 2014-05-31 16:59 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\CrashDumps
2015-01-11 00:33 - 2014-08-14 12:23 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\TS3Client
2014-12-28 20:10 - 2014-06-01 19:23 - 00007605 _____ () C:\Users\Josephine Mireille\AppData\Local\Resmon.ResmonCfg
2014-12-24 20:06 - 2014-06-02 13:50 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Origin
2014-12-24 20:06 - 2014-06-02 13:50 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-12-22 16:05 - 2014-05-31 11:11 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\Bluetooth Folder
2014-12-21 17:28 - 2014-06-01 08:58 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Atheros
2014-12-20 13:08 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-19 15:34 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-18 11:47 - 2013-08-22 12:22 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2014-12-18 11:47 - 2013-08-22 12:22 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2014-12-18 11:47 - 2013-08-22 12:17 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2014-12-18 11:47 - 2013-08-22 12:17 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2014-12-18 11:47 - 2013-08-22 12:17 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2014-12-18 11:47 - 2013-08-22 05:05 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2014-12-18 11:47 - 2013-08-22 05:03 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2014-12-18 11:47 - 2013-08-22 04:59 - 00214016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2014-12-18 11:47 - 2013-08-22 04:56 - 00377856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2014-12-18 11:47 - 2013-08-22 04:56 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2014-12-18 11:47 - 2013-08-22 04:51 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2014-12-17 21:22 - 2014-05-31 16:09 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\Packages
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Administrator\AppData\Local\Temp\{8AE74035-125D-44A3-8BA6-7E8172E91058}.exe
C:\Users\Josephine Mireille\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-09 13:16
==================== End Of Log ============================
Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-01-2015 02
Ran by Josephine Mireille at 2015-01-13 23:05:50
Running from C:\Users\Josephine Mireille\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Panda Free Antivirus (Enabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Free Antivirus (Enabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version: - Gameforge)
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.01.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.3.18.1010 - Electronic Arts Inc.)
DigimonMasters Online (HKLM-x32\...\DigimonMasters) (Version: - Move games)
DigimonMasters Online Launcher (HKLM-x32\...\DigimonMasters Launcher) (Version: - Move games)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.3.52 - DivX, LLC)
Gameforge Live 2.0.5 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.5 - Gameforge)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3496 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Windows Application Compatibility Database (HKLM\...\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb) (Version: - )
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.09 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.11.2806 - Electronic Arts, Inc.)
Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.104 - Panda Security)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Free Antivirus (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0002 - Panda Security)
Panda Free Antivirus (Version: 7.23.00.0000 - Panda Security) Hidden
PDF Architect 2 Edit Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.320 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.31 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6865 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.9200.28130 - Realtek Semiconductor Corp.)
ServiceInstaller (HKLM-x32\...\ServiceInstaller) (Version: - )
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.59 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.3.4.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Unity Web Player (HKU\S-1-5-21-768070318-4204382875-4262773496-1001\...\UnityWebPlayer) (Version: 4.6.0f3 - Unity Technologies ApS)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
VTech Download Manager (HKLM-x32\...\VTechDownloadManager) (Version: - VTech)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-768070318-4204382875-4262773496-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
28-12-2014 19:12:00 Removed Java 8 Update 5
07-01-2015 13:07:14 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {4F0F85C3-4DFA-44AF-A3FD-E3F618B0D5EB} - System32\Tasks\{0BFEC8A9-7CA1-4DF0-8B13-D074D1A03D80} => pcalua.exe -a C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_223_Plugin.exe -c -maintain plugin
Task: {E2600F8A-C7E0-43A7-B24F-25CF05F98856} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) =============
2015-01-12 09:42 - 2014-12-13 09:03 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-04-02 01:25 - 2014-04-02 01:25 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2014-04-02 01:22 - 2014-04-02 01:22 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2014-04-02 01:28 - 2014-04-02 01:28 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2014-10-13 02:49 - 2014-06-20 07:42 - 00401280 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files (x86)\Panda Security\Panda Security Protection\SQLite3.dll
2014-06-01 21:39 - 2014-06-01 21:36 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-10-13 02:49 - 2014-03-04 12:20 - 00117760 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\QtSolutions_SOAP-2.7.dll
2014-10-13 02:49 - 2014-04-22 03:14 - 00065536 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\QHttpServer.dll
2014-10-13 02:49 - 2014-05-06 06:39 - 00861184 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\platforms\qwindows.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00021504 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qgif.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00020992 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qico.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00204800 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qjpeg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00218112 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qmng.dll
2014-10-13 02:49 - 2014-05-06 06:58 - 00015872 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qsvg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00015360 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qtga.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00307712 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qtiff.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00014848 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qwbmp.dll
2014-10-13 02:49 - 2014-05-06 07:31 - 00015872 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\sensors\qtsensors_dummy.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00036352 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\bearer\qgenericbearer.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00038912 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\bearer\qnativewifibearer.dll
2014-12-09 18:56 - 2014-12-09 18:56 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Josephine Mireille\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "DivXMediaServer"
HKLM\...\StartupApproved\Run32: => "DivXUpdate"
HKLM\...\StartupApproved\Run32: => "DXM6Patch_981116"
========================= Accounts: ==========================
Administrator (S-1-5-21-768070318-4204382875-4262773496-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-768070318-4204382875-4262773496-501 - Limited - Disabled)
Josephine Mireille (S-1-5-21-768070318-4204382875-4262773496-1001 - Administrator - Enabled) => C:\Users\Josephine Mireille
==================== Faulty Device Manager Devices =============
Name: Broadcom NetLink (TM)-Gigabit-Ethernet
Description: Broadcom NetLink (TM)-Gigabit-Ethernet
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom Corporation
Service: k57nd60a
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/13/2015 05:26:41 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: Der Desktopfenster-Manager hat einen schwerwiegenden Fehler (0x8898008d) festgestellt.
Error: (01/12/2015 09:43:13 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (01/12/2015 09:42:42 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcMessaging remove all devices. [0]
Error: (01/12/2015 09:39:22 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [18]
Error: (01/12/2015 00:10:16 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0]
Error: (01/12/2015 00:10:15 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [18]
Error: (01/11/2015 07:20:00 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0]
Error: (01/11/2015 07:19:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [18]
Error: (01/11/2015 03:05:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: FlashPlayerPlugin_16_0_0_235.exe, Version: 16.0.0.235, Zeitstempel: 0x546fbf96
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x02667488
ID des fehlerhaften Prozesses: 0xca0
Startzeit der fehlerhaften Anwendung: 0xFlashPlayerPlugin_16_0_0_235.exe0
Pfad der fehlerhaften Anwendung: FlashPlayerPlugin_16_0_0_235.exe1
Pfad des fehlerhaften Moduls: FlashPlayerPlugin_16_0_0_235.exe2
Berichtskennung: FlashPlayerPlugin_16_0_0_235.exe3
Vollständiger Name des fehlerhaften Pakets: FlashPlayerPlugin_16_0_0_235.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: FlashPlayerPlugin_16_0_0_235.exe5
Error: (01/08/2015 08:15:25 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0]
System errors:
=============
Error: (01/13/2015 10:24:08 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (01/13/2015 10:20:44 PM) (Source: DCOM) (EventID: 10010) (User: MIREILLE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/13/2015 10:20:44 PM) (Source: DCOM) (EventID: 10010) (User: MIREILLE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/12/2015 00:43:10 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (01/12/2015 10:30:28 AM) (Source: DCOM) (EventID: 10010) (User: MIREILLE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/12/2015 10:30:28 AM) (Source: DCOM) (EventID: 10010) (User: MIREILLE)
Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9}
Error: (01/12/2015 09:45:32 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (01/12/2015 09:40:44 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (01/12/2015 00:23:13 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: Microsoft.BingWeather
Error: (01/12/2015 00:23:00 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80246013 fehlgeschlagen: microsoft.windowscommunicationsapps
Microsoft Office Sessions:
=========================
Error: (01/13/2015 05:26:41 PM) (Source: Desktop Window Manager) (EventID: 9020) (User: )
Description: 0x8898008d
Error: (01/12/2015 09:43:13 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcFailed continue stopping. [0]
Error: (01/12/2015 09:42:42 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcMessaging remove all devices. [0]
Error: (01/12/2015 09:39:22 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [18]
Error: (01/12/2015 00:10:16 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0]
Error: (01/12/2015 00:10:15 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [18]
Error: (01/11/2015 07:20:00 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0]
Error: (01/11/2015 07:19:59 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [18]
Error: (01/11/2015 03:05:10 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: FlashPlayerPlugin_16_0_0_235.exe16.0.0.235546fbf96unknown0.0.0.000000000c000000502667488ca001d02d983a64061eC:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_16_0_0_235.exeunknownda0a36a3-999a-11e4-bede-485ab66d3c08
Error: (01/08/2015 08:15:25 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [0]
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz
Percentage of memory in use: 37%
Total physical RAM: 3976.36 MB
Available physical RAM: 2484.21 MB
Total Pagefile: 5832.36 MB
Available Pagefile: 4154.91 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.42 GB) (Free:305.71 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D9550422)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.4 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Geändert von LuffyXD (14.01.2015 um 00:38 Uhr) |
|
14.01.2015, 00:34
| #2 |
| | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen Gmer.txt
__________________Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-01-13 23:43:41
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000032 ST500LT012-9WS142 rev.0001SDM1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\JOSEPH~1\AppData\Local\Temp\pwlcypow.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable fffff96000184200 15 bytes [00, 28, F6, 01, 80, 1C, 6C, ...]
.text C:\WINDOWS\System32\win32k.sys!W32pServiceTable + 16 fffff96000184210 11 bytes [00, 0E, FC, FF, 00, 05, C4, ...]
---- User code sections - GMER 2.1 ----
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\WINDOWS\system32\dwm.exe[1052] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1152] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\WINDOWS\system32\nvvsvc.exe[1160] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffffc4c169a 4 bytes [4C, FC, FF, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[1160] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffffc4c16a2 4 bytes [4C, FC, FF, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[1160] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffffc4c181a 4 bytes [4C, FC, FF, 7F]
.text C:\WINDOWS\system32\nvvsvc.exe[1160] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffffc4c1832 4 bytes [4C, FC, FF, 7F]
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\SYSTEM32\d3d9.dll!Direct3DCreate9Ex 00007ffff1efa204 5 bytes JMP 00007ffffb9805a8
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\SYSTEM32\d3d9.dll!Direct3DCreate9 00007ffff1f122cc 6 bytes JMP 00007ffffb980570
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3716] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\SYSTEM32\user32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\SYSTEM32\user32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\SYSTEM32\user32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\SYSTEM32\user32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\SYSTEM32\user32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\WINDOWS\system32\taskhostex.exe[3748] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Windows\System32\InputMethod\KOR\KorIME.exe[3932] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\WINDOWS\system32\igfxEM.exe[4080] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\WINDOWS\system32\igfxHK.exe[3084] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Windows\System32\skydrive.exe[3672] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007fffe62c1f6a 4 bytes [2C, E6, FF, 7F]
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[4276] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007fffe62c1f82 4 bytes [2C, E6, FF, 7F]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4288] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe[4308] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4400] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb8d0260
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb8d0298
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb8d0308
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb8d0340
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb8d02d0
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb8d01f0
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb8d0228
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb8d00d8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb8d0180
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb8d0148
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb8d0110
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb8d01b8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffffc4c169a 4 bytes [4C, FC, FF, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffffc4c16a2 4 bytes [4C, FC, FF, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffffc4c181a 4 bytes [4C, FC, FF, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffffc4c1832 4 bytes [4C, FC, FF, 7F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb8d0420
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb8d03b0
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb8d03e8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb8d0458
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb8d0378
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb8d0490
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffb4ef90}
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb8d04c8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb8d0538
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4452] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb8d0500
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ffffc4c169a 4 bytes [4C, FC, FF, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ffffc4c16a2 4 bytes [4C, FC, FF, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ffffc4c181a 4 bytes [4C, FC, FF, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ffffc4c1832 4 bytes [4C, FC, FF, 7F]
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[4656] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\Windows\System32\SettingSyncHost.exe[5596] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\WINDOWS\System32\msdt.exe[5136] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffffc5328c0 7 bytes JMP 00008000fb980260
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007ffffc5343d8 7 bytes JMP 00008000fb980298
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007ffffc5e1f20 7 bytes JMP 00008000fb980308
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007ffffc5e40b4 7 bytes JMP 00008000fb980340
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007ffffc5e4510 7 bytes JMP 00008000fb9802d0
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffffc60cea0 7 bytes JMP 00008000fb9801f0
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffffc60cf10 7 bytes JMP 00008000fb980228
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007ffffb99299c 7 bytes JMP 00008000fb9800d8
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007ffffb9954c8 5 bytes JMP 00008000fb980180
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007ffffb9955b0 5 bytes JMP 00008000fb980148
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffffb995e58 5 bytes JMP 00008000fb980110
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleFileNameExW 00007ffffba06200 5 bytes JMP 00008000fb9801b8
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket 00007ffffdd49318 7 bytes JMP 00008000fb980538
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance 00007ffffdd4cbe0 7 bytes JMP 00008000fb980500
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffffbd81500 1 byte JMP 00008000fb980490
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2 00007ffffbd81502 6 bytes {JMP 0xffffffffffbfef90}
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffffbd81750 8 bytes JMP 00008000fb9804c8
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007ffffe047834 10 bytes JMP 00008000fb980420
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007ffffe04b4d0 5 bytes JMP 00008000fb9803b0
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007ffffe04c6d8 5 bytes JMP 00008000fb9803e8
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\USER32.dll!ChangeDisplaySettingsExW 00007ffffe04c8fc 5 bytes JMP 00008000fb980458
.text C:\WINDOWS\System32\sdiagnhost.exe[6372] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffffe04e39c 9 bytes JMP 00008000fb980378
---- Threads - GMER 2.1 ----
Thread C:\WINDOWS\system32\csrss.exe [580:676] fffff96000884b90
Thread C:\WINDOWS\system32\svchost.exe [1244:5004] 00007fffeffe10e0
Thread C:\WINDOWS\system32\svchost.exe [1244:7384] 00007fffea7d38e0
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime 0x6F 0x64 0xA5 0x32 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime 0x3D 0x25 0xA9 0xD7 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime 0x33 0xAA 0xAF 0x32 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime 0x3D 0x25 0xA9 0xD7 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@de-DE 122
Reg HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\CMN17350_32_07DC_E0^32E5A83C84F67081B9C9AD9E235CC62C@Timestamp 0x76 0x26 0xAD 0x33 ...
Reg HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid 776
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber 4521700
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 1855716501
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId 126
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime 432497077
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime 1836
Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime 1437
Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID 1100eba6-e79c-4bfb-ab0c-b3543bf
Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter 3
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\485ab66d3c08
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\485ab66d3c08@98d6f71f35ef 0xFA 0xDF 0xB9 0xAD ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\485ab66d3c08@f05a09322187 0xAA 0x16 0x55 0xF1 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Services\{00001200-0000-1000-8000-00805f9b34fb}@SecurityFlags 2
Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Upgrade\LocalRadioSettings
Reg HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\Probe\{89051d3d-2ba8-4492-b7ce-b54e5f73c9d4}@LastProbeTime 1421188017
Reg HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{609760BF-8900-46BB-92D7-E44FE5CD150D}@DefunctTimestamp 0xEF 0x99 0xB5 0x54 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\rdyboost\Parameters@LastBootPlanUserTime ?Di?, ?Jan ?13 ?15, 10:25:19???????????????????????????????????
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 12476
Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 2659
Reg HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence 124
Reg HKLM\SYSTEM\CurrentControlSet\Services\SynTP\Parameters@DetectTimeMS 470
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5E000D1-FFA6-4238-A061-B4ABAAC40588}@LeaseObtainedTime 1421187447
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5E000D1-FFA6-4238-A061-B4ABAAC40588}@T1 1421619447
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5E000D1-FFA6-4238-A061-B4ABAAC40588}@T2 1421943447
Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{D5E000D1-FFA6-4238-A061-B4ABAAC40588}@LeaseTerminatesTime 1422051447
Reg HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop 0
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ...
Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D9AC5E73-BB10-467b-B884-AA1E475C51F5}
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace\{D9AC5E73-BB10-467b-B884-AA1E475C51F5}@ SynTPCpl0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{17b6eaa6-e8d4-11e3-be66-806e6f6e6963}@Generation 358
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{17b6eaa7-e8d4-11e3-be66-806e6f6e6963}@Generation 382
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{17b6eaab-e8d4-11e3-be66-806e6f6e6963}@Generation 383
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown 1
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Group Policy\PolicyApplicationState@PolicyState 0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsRequestBucketDrainTime 0xF0 0x20 0x42 0xC5 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsLargeRequestBucketDrainTime 0xF0 0x20 0x42 0xC5 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastOtherRequestBucketDrainTime 0xF0 0x20 0x42 0xC5 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastGlobalRequestBucketDrainTime 0xF0 0x20 0x42 0xC5 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@RoamingSyncToken LM%3d63556775966940%3bID%3d10C593320689C62C!107%3bLR%3d63556784271073%3bEP%3d4%3bTD%3dTrue%3bSO%3d0
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest 0xC7 0xB1 0x51 0x22 ...
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\SettingSync\SyncData@PendingOperations 16
Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug@StoreLocation C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Gmer-19357.exe_d0d3955a196d9f2ab4b8ad4ff555b78d2c0b7_69ff3d88_00c3fe4d
Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles@CheckingForSolutionDialog 0x24 0x03 0x0C 0x00 ...
Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles@CloseDialog 0x24 0x03 0x0C 0x00 ...
---- EOF - GMER 2.1 ----
|
|
14.01.2015, 07:25
| #3 |
| /// the machine /// TB-Ausbilder    | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen hi,
__________________Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ |
|
14.01.2015, 13:00
| #4 |
| | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen Hallo schrauber, erstmal danke für deine Hilfe. MBAM hat 54 unerwünschte Programme und eine Malware(rogue.multiple) gefunden. AdwCleaner hat Registryeinträge gelöscht, dabei wurde doch in dem Forum darauf hingewiesen, die Registry unberührt zu lassen. War es richtig diese zu löschen oder hätte ich die Makierung entfernen sollen? Nach der Anwendung von JRT war der Laptop wieder spürbar langsamer. Ist das normal? hier sind die Logfiles: mbam.txt Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 14.01.2015 Suchlauf-Zeit: 11:37:41 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.01.14.03 Rootkit Datenbank: v2015.01.07.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 8.1 CPU: x64 Dateisystem: NTFS Benutzer: Josephine Mireille Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 417482 Verstrichene Zeit: 20 Min, 20 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 20 Rogue.Multiple, C:\ProgramData\374311380, Keine Aktion durch Benutzer, [39129f58f4959c9a200eae78e41fd927], PUP.Optional.NewPlayer.A, C:\Users\Josephine Mireille\AppData\Local\newplayer, In Quarantäne, [eb608d6a8bfeff3704dd8d0a44bf09f7], PUP.Optional.NewPlayer.A, C:\Users\Josephine Mireille\AppData\Local\newplayer\Playlists, In Quarantäne, [eb608d6a8bfeff3704dd8d0a44bf09f7], PUP.Optional.NewPlayer.A, C:\Users\Josephine Mireille\AppData\Local\newplayer\Snap, In Quarantäne, [eb608d6a8bfeff3704dd8d0a44bf09f7], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\log, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices, In Quarantäne, [a0ab4cab3257e056a2864cff2dd6e719], PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update, In Quarantäne, [a0ab4cab3257e056a2864cff2dd6e719], PUP.Optional.SearchProtect.A, C:\Users\Josephine Mireille\AppData\Local\SearchProtect, In Quarantäne, [4506dc1b781149ed43e6074440c3f10f], PUP.Optional.SearchProtect.A, C:\Users\Josephine Mireille\AppData\Local\SearchProtect\Logs, In Quarantäne, [4506dc1b781149ed43e6074440c3f10f], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger, In Quarantäne, [98b3a3544b3e989ed6ef490223e0936d], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log, In Quarantäne, [98b3a3544b3e989ed6ef490223e0936d], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update, In Quarantäne, [98b3a3544b3e989ed6ef490223e0936d], PUP.Optional.ReMarkable.A, C:\Program Files (x86)\-Re_Markable, In Quarantäne, [ce7db542daaf60d6432b77d528db3dc3], PUP.Optional.FreeSoftToday.A, C:\Users\Josephine Mireille\AppData\Local\fst_de_55, In Quarantäne, [1239b443e9a0e0565a3edb737d8602fe], PUP.Optional.FreeSoftToday.A, C:\Users\Josephine Mireille\AppData\Local\fst_de_55\fst_de_55, In Quarantäne, [1239b443e9a0e0565a3edb737d8602fe], PUP.Optional.FreeSoftToday.A, C:\Users\Josephine Mireille\AppData\Local\fst_de_55\fst_de_55\1.10, In Quarantäne, [1239b443e9a0e0565a3edb737d8602fe], PUP.Optional.SupTab.A, C:\Users\Josephine Mireille\AppData\Roaming\SupTab, In Quarantäne, [4407ca2dbbce5fd77a177fd4c73c7987], Dateien: 36 PUP.Optional.NewPlayer.A, C:\Users\Josephine Mireille\AppData\Local\newplayer\log.txt, In Quarantäne, [eb608d6a8bfeff3704dd8d0a44bf09f7], PUP.Optional.WebsSearches.A, C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\webssearches.xml, In Quarantäne, [5af1fbfc01881e1867225253758e2ad6], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\124.json, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\MessageBox.xml, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\uninstallDlg2.xml, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\bg.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\bg1.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\bk_shadow.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\button.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\button1.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\checkbox.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\checkbox_select.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\checked.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\close.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\loading_bg.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\loading_light.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\min.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\scrollbar.bmp, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\Thumbs.db, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\unchecked.png, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code\code1.jpg, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code\code2.jpg, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code\code3.jpg, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code\code4.jpg, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code\code5.jpg, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code\code6.jpg, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\images\code\Thumbs.db, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\log\UninstallManager_2014-06-23[15-55-21-098].log, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.WebsSearches.A, C:\Users\Josephine Mireille\AppData\Roaming\webssearches\log\UninstallManager_2014-06-23[15-58-31-420].log, In Quarantäne, [24277a7d4346c175f04cd16be320d42c], PUP.Optional.IePluginServices.A, C:\ProgramData\IePluginServices\update\conf, In Quarantäne, [a0ab4cab3257e056a2864cff2dd6e719], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\log\wprotectmanager_2014-06-23[15-47-09-534].log, In Quarantäne, [98b3a3544b3e989ed6ef490223e0936d], PUP.Optional.WPM.A, C:\ProgramData\WindowsProtectManger\update\conf, In Quarantäne, [98b3a3544b3e989ed6ef490223e0936d], PUP.Optional.ReMarkable.A, C:\Program Files (x86)\-Re_Markable\174.xpi, In Quarantäne, [ce7db542daaf60d6432b77d528db3dc3], PUP.Optional.FreeSoftToday.A, C:\Users\Josephine Mireille\AppData\Local\fst_de_55\upfst_de_55.cyl, In Quarantäne, [1239b443e9a0e0565a3edb737d8602fe], PUP.Optional.FreeSoftToday.A, C:\Users\Josephine Mireille\AppData\Local\fst_de_55\fst_de_55\1.10\cnf.cyl, In Quarantäne, [1239b443e9a0e0565a3edb737d8602fe], PUP.Optional.FreeSoftToday.A, C:\Users\Josephine Mireille\AppData\Local\fst_de_55\fst_de_55\1.10\eorezo.cyl, In Quarantäne, [1239b443e9a0e0565a3edb737d8602fe], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.107 - Bericht erstellt am 14/01/2015 um 12:30:11
# Aktualisiert 07/01/2015 von Xplode
# Database : 2015-01-13.2 [Live]
# Betriebssystem : Windows 8.1 Pro (64 bits)
# Benutzername : Josephine Mireille - MIREILLE
# Gestartet von : C:\Users\Josephine Mireille\Downloads\AdwCleaner_4.107.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\374311380
Ordner Gelöscht : C:\Users\Josephine Mireille\AppData\Local\globalUpdate
Ordner Gelöscht : C:\Users\Josephine Mireille\AppData\Local\pdfforge
Ordner Gelöscht : C:\Users\Josephine Mireille\AppData\Local\DownloadManager
Ordner Gelöscht : C:\Users\Josephine Mireille\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Josephine Mireille\Documents\Optimizer Pro
Datei Gelöscht : C:\END
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00B11DA2-75ED-4364-ABA5-9A95B1F5E946}
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17416
-\\ Mozilla Firefox v34.0.5 (x86 de)
*************************
AdwCleaner[R0].txt - [1397 octets] - [14/01/2015 12:19:15]
AdwCleaner[S0].txt - [1272 octets] - [14/01/2015 12:30:11]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1332 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.1 (12.28.2014:1)
OS: Windows 8.1 Pro x64
Ran by Josephine Mireille on 14.01.2015 at 12:38:18,68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 14.01.2015 at 12:39:53,12
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2015 02
Ran by Josephine Mireille (administrator) on MIREILLE on 14-01-2015 12:44:31
Running from C:\Users\Josephine Mireille\Desktop
Loaded Profile: Josephine Mireille (Available profiles: Josephine Mireille & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(VTech) C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechServiceInstaller.exe
(VTech) C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechUSBSocketService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20689_x64__8wekyb3d8bbwe\livecomm.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Microsoft Corporation) C:\Windows\SysWOW64\WWAHost.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13427784 2013-03-18] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-08] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3010800 2014-06-01] (Synaptics Incorporated)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-28] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [AgentMonitor] => C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe [401280 2014-06-20] ()
HKLM-x32\...\Run: [DXM6Patch_981116] => C:\WINDOWS\p_981116.exe [497376 1998-11-30] (Microsoft Corporation)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [134784 2014-04-02] ( (Atheros Communications))
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\...\MountPoints2: {8447746c-297d-11e4-bea7-485ab66d3c08} - "E:\Startme.exe"
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [165760 2014-12-13] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.digimonmasters.com/index.aspx
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
DPF: HKLM-x32 {9A3D12F9-8802-4316-B877-022025566DA1} hxxp://www.digimonmasters.com/inc/ActiveX/launcher/20130813/Digitalic%20Launcher.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Josephine Mireille\AppData\Roaming\Mozilla\Firefox\Profiles\5h2pxznh.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-768070318-4204382875-4262773496-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Josephine Mireille\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Josephine Mireille\AppData\Roaming\Mozilla\Firefox\Profiles\5h2pxznh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-22]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [319104 2014-04-02] (Windows (R) Win 7 DDK provider)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-11-21] (BitRaider, LLC)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-17] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2014-06-01] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-24] (Electronic Arts)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 VTechUSBSocketService; C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechServiceInstaller.exe [82824 2013-03-29] (VTech)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3892224 2014-03-06] (Qualcomm Atheros Communications, Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-06-27] ()
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2014-11-21] (BitRaider)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-04-02] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-06-27] ()
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-06-01] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-14 12:44 - 2015-01-14 12:45 - 00016070 _____ () C:\Users\Josephine Mireille\Desktop\FRST.txt
2015-01-14 12:39 - 2015-01-14 12:39 - 00000631 _____ () C:\Users\Josephine Mireille\Desktop\JRT.txt
2015-01-14 12:38 - 2015-01-14 12:38 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-14 12:31 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-01-14 12:19 - 2015-01-14 12:30 - 00000000 ____D () C:\AdwCleaner
2015-01-14 12:05 - 2015-01-14 12:14 - 00009459 _____ () C:\Users\Josephine Mireille\Desktop\mbam.txt
2015-01-14 12:05 - 2015-01-14 12:05 - 00009459 _____ () C:\Users\Josephine Mireille\Desktop\mbam01.txt
2015-01-14 11:33 - 2015-01-14 12:42 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-14 11:31 - 2015-01-14 11:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-14 11:31 - 2015-01-14 11:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-14 11:31 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-14 11:31 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-14 11:31 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-14 11:22 - 2015-01-14 11:22 - 01707939 _____ (Thisisu) C:\Users\Josephine Mireille\Downloads\JRT.exe
2015-01-14 11:21 - 2015-01-14 11:21 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Josephine Mireille\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-14 11:21 - 2015-01-14 11:21 - 02191360 _____ () C:\Users\Josephine Mireille\Downloads\AdwCleaner_4.107.exe
2015-01-13 23:43 - 2015-01-13 23:43 - 00083661 _____ () C:\Users\Josephine Mireille\Downloads\Gmer.log
2015-01-13 23:25 - 2015-01-13 23:44 - 00000270 _____ () C:\Users\Josephine Mireille\Downloads\defogger_enable.log
2015-01-13 23:04 - 2015-01-13 23:06 - 00020254 _____ () C:\Users\Josephine Mireille\Downloads\Addition.txt
2015-01-13 23:03 - 2015-01-14 12:44 - 00000000 ____D () C:\FRST
2015-01-13 23:03 - 2015-01-13 23:06 - 00031833 _____ () C:\Users\Josephine Mireille\Downloads\FRST.txt
2015-01-13 23:02 - 2015-01-13 23:35 - 00000498 _____ () C:\Users\Josephine Mireille\Downloads\defogger_disable.log
2015-01-13 22:59 - 2015-01-13 22:59 - 02124288 _____ (Farbar) C:\Users\Josephine Mireille\Desktop\FRST64.exe
2015-01-13 22:55 - 2015-01-13 22:55 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\10 WBC
2015-01-13 22:53 - 2015-01-13 22:54 - 00380416 _____ () C:\Users\Josephine Mireille\Downloads\Gmer-19357.exe
2015-01-13 22:45 - 2015-01-13 22:45 - 00050477 _____ () C:\Users\Josephine Mireille\Downloads\Defogger.exe
2015-01-12 15:19 - 2015-01-12 15:19 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\TeraSAVES
2015-01-12 09:51 - 2015-01-12 09:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-12 09:51 - 2014-12-13 01:11 - 02824504 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 02210040 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 01715224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 01291464 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2015-01-12 09:50 - 2015-01-12 10:30 - 00000000 ____D () C:\WINDOWS\SysWOW64\NV
2015-01-12 09:50 - 2015-01-12 10:30 - 00000000 ____D () C:\WINDOWS\system32\NV
2015-01-12 09:50 - 2015-01-12 09:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2015-01-12 09:49 - 2015-01-12 09:50 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2015-01-12 09:48 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 18594432 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 17264312 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 16040184 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 14128496 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2015-01-12 09:48 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 02897824 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6434709.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6434709.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00496272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00399688 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00391488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00346944 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00031376 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvpciflt.sys
2015-01-12 09:48 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2015-01-12 09:48 - 2014-11-22 11:46 - 00035472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2015-01-12 09:48 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2015-01-12 09:42 - 2015-01-12 09:50 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-12 09:42 - 2014-12-13 09:03 - 06859408 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 03513488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 02558608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 01097360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00935240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2015-01-12 09:42 - 2014-12-13 09:03 - 00386368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00075080 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00062608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2015-01-12 09:42 - 2014-12-13 00:11 - 04151176 _____ () C:\WINDOWS\system32\nvcoproc.bin
2015-01-12 03:17 - 2015-01-12 03:17 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Panda Security
2015-01-12 03:16 - 2015-01-12 03:16 - 00000180 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-01-12 01:28 - 2015-01-12 01:28 - 00001298 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2015-01-12 01:28 - 2015-01-12 01:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2015-01-12 00:23 - 2015-01-12 00:23 - 00227096 _____ () C:\Users\Administrator\Downloads\avira_registry_cleaner_de.exe
2015-01-12 00:16 - 2014-12-31 12:14 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-01-12 00:15 - 2015-01-12 01:28 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-01-12 00:15 - 2015-01-12 00:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Panda Security
2015-01-12 00:15 - 2015-01-12 00:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-01-12 00:13 - 2015-01-12 00:16 - 00000000 ____D () C:\ProgramData\Panda Security
2015-01-02 22:10 - 2015-01-13 22:58 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\Sims 4
2014-12-25 10:35 - 2014-12-25 10:35 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-24 22:43 - 2014-12-24 22:43 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\Electronic Arts
2014-12-24 22:41 - 2014-12-24 22:41 - 00001362 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-12-24 22:41 - 2014-12-24 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-12-24 22:41 - 2014-09-16 18:45 - 00447752 _____ (On2.com) C:\WINDOWS\SysWOW64\vp6vfw.dll
2014-12-19 20:27 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-19 20:27 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-18 11:48 - 2014-12-18 11:48 - 00004608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w95inf32.dll
2014-12-18 11:48 - 2014-12-18 11:48 - 00002272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w95inf16.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 01088272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\danim.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 00155408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LMRT.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unam4ie.exe
2014-12-18 11:48 - 1998-09-02 09:28 - 00038160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LMRTREND.dll
2014-12-18 11:48 - 1998-09-02 09:02 - 00194320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qcut.dll
2014-12-18 11:48 - 1998-08-27 05:51 - 00182032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft3.dll
2014-12-18 11:48 - 1998-08-20 12:02 - 00140800 _____ (The Duck Corporation) C:\WINDOWS\SysWOW64\tm20dec.ax
2014-12-18 11:48 - 1998-08-20 11:38 - 00217984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\strmdll.dll
2014-12-18 11:48 - 1998-08-17 10:21 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mciqtz.drv
2014-12-18 11:48 - 1998-08-17 10:21 - 00010240 _____ () C:\WINDOWS\SysWOW64\vidx16.dll
2014-12-18 11:48 - 1998-08-17 10:21 - 00005672 _____ () C:\WINDOWS\SysWOW64\quartz.vxd
2014-12-18 11:24 - 2014-12-26 17:54 - 00000000 ____D () C:\Program Files (x86)\Catan
2014-12-18 11:24 - 1998-10-21 18:43 - 00328704 _____ (InstallShield Software Corporation ) C:\WINDOWS\IsUn0407.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-14 12:43 - 2014-05-31 23:16 - 01186589 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-14 12:42 - 2014-06-01 09:37 - 00000000 __RDO () C:\Users\Josephine Mireille\OneDrive
2015-01-14 12:41 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-14 12:41 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-14 12:31 - 2014-03-18 02:51 - 00214458 _____ () C:\WINDOWS\PFRO.log
2015-01-14 12:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-13 23:44 - 2014-05-31 23:06 - 00000000 ____D () C:\Users\Josephine Mireille
2015-01-13 23:24 - 2014-05-31 16:59 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\CrashDumps
2015-01-13 23:12 - 2014-03-18 11:04 - 01689572 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-13 23:12 - 2014-03-18 10:25 - 00728968 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-13 23:12 - 2014-03-18 10:25 - 00152122 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-13 23:07 - 2014-05-31 11:11 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\Bluetooth Folder
2015-01-13 22:20 - 2014-06-02 13:48 - 00000000 ____D () C:\ProgramData\Origin
2015-01-13 22:19 - 2014-06-02 13:48 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-01-13 20:59 - 2014-06-03 22:48 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\Gameforge Live
2015-01-12 19:17 - 2014-11-11 11:44 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-01-12 10:07 - 2014-05-31 16:15 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-768070318-4204382875-4262773496-1001
2015-01-12 09:51 - 2014-06-01 07:22 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\NVIDIA Corporation
2015-01-12 09:51 - 2014-05-31 16:35 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-01-12 09:51 - 2014-05-31 16:35 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-01-12 09:50 - 2013-08-22 15:46 - 00008474 _____ () C:\WINDOWS\setupact.log
2015-01-12 09:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-12 09:41 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Help
2015-01-12 09:40 - 2013-08-22 15:44 - 00384464 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-12 00:34 - 2014-05-31 23:36 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-768070318-4204382875-4262773496-500
2015-01-12 00:21 - 2014-11-04 09:11 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-12 00:10 - 2014-05-31 23:06 - 00000000 ____D () C:\Users\Administrator
2015-01-12 00:08 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-11 00:33 - 2014-08-14 12:23 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\TS3Client
2014-12-28 20:10 - 2014-06-01 19:23 - 00007605 _____ () C:\Users\Josephine Mireille\AppData\Local\Resmon.ResmonCfg
2014-12-24 20:06 - 2014-06-02 13:50 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Origin
2014-12-24 20:06 - 2014-06-02 13:50 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-12-21 17:28 - 2014-06-01 08:58 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Atheros
2014-12-20 13:08 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-12-19 15:34 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-18 11:47 - 2013-08-22 12:22 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2014-12-18 11:47 - 2013-08-22 12:22 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2014-12-18 11:47 - 2013-08-22 12:17 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2014-12-18 11:47 - 2013-08-22 12:17 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2014-12-18 11:47 - 2013-08-22 12:17 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2014-12-18 11:47 - 2013-08-22 05:05 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2014-12-18 11:47 - 2013-08-22 05:03 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2014-12-18 11:47 - 2013-08-22 04:59 - 00214016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2014-12-18 11:47 - 2013-08-22 04:56 - 00377856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2014-12-18 11:47 - 2013-08-22 04:56 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2014-12-18 11:47 - 2013-08-22 04:51 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2014-12-17 21:22 - 2014-05-31 16:09 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\Packages
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Administrator\AppData\Local\Temp\{8AE74035-125D-44A3-8BA6-7E8172E91058}.exe
C:\Users\Josephine Mireille\AppData\Local\Temp\avgnt.exe
C:\Users\Josephine Mireille\AppData\Local\Temp\Quarantine.exe
C:\Users\Josephine Mireille\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-09 13:16
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-01-2015 02
Ran by Josephine Mireille at 2015-01-14 12:45:33
Running from C:\Users\Josephine Mireille\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Panda Free Antivirus (Disabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Free Antivirus (Disabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version: - Gameforge)
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.01.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.3.18.1010 - Electronic Arts Inc.)
DigimonMasters Online (HKLM-x32\...\DigimonMasters) (Version: - Move games)
DigimonMasters Online Launcher (HKLM-x32\...\DigimonMasters Launcher) (Version: - Move games)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.3.52 - DivX, LLC)
Gameforge Live 2.0.5 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.5 - Gameforge)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3496 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Windows Application Compatibility Database (HKLM\...\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb) (Version: - )
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.09 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.11.2806 - Electronic Arts, Inc.)
Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.104 - Panda Security)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Free Antivirus (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0002 - Panda Security)
Panda Free Antivirus (Version: 7.23.00.0000 - Panda Security) Hidden
PDF Architect 2 Edit Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.320 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.31 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6865 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.9200.28130 - Realtek Semiconductor Corp.)
ServiceInstaller (HKLM-x32\...\ServiceInstaller) (Version: - )
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.59 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.3.4.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Unity Web Player (HKU\S-1-5-21-768070318-4204382875-4262773496-1001\...\UnityWebPlayer) (Version: 4.6.0f3 - Unity Technologies ApS)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
VTech Download Manager (HKLM-x32\...\VTechDownloadManager) (Version: - VTech)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-768070318-4204382875-4262773496-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
28-12-2014 19:12:00 Removed Java 8 Update 5
07-01-2015 13:07:14 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {4F0F85C3-4DFA-44AF-A3FD-E3F618B0D5EB} - System32\Tasks\{0BFEC8A9-7CA1-4DF0-8B13-D074D1A03D80} => pcalua.exe -a C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_223_Plugin.exe -c -maintain plugin
Task: {E2600F8A-C7E0-43A7-B24F-25CF05F98856} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) =============
2015-01-12 09:42 - 2014-12-13 09:03 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-04-02 01:25 - 2014-04-02 01:25 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2014-04-02 01:22 - 2014-04-02 01:22 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2014-04-02 01:28 - 2014-04-02 01:28 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2014-10-13 02:49 - 2014-06-20 07:42 - 00401280 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files (x86)\Panda Security\Panda Security Protection\SQLite3.dll
2014-10-13 02:49 - 2014-03-04 12:20 - 00117760 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\QtSolutions_SOAP-2.7.dll
2014-10-13 02:49 - 2014-04-22 03:14 - 00065536 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\QHttpServer.dll
2014-10-13 02:49 - 2014-05-06 06:39 - 00861184 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\platforms\qwindows.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00021504 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qgif.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00020992 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qico.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00204800 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qjpeg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00218112 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qmng.dll
2014-10-13 02:49 - 2014-05-06 06:58 - 00015872 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qsvg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00015360 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qtga.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00307712 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qtiff.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00014848 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qwbmp.dll
2014-10-13 02:49 - 2014-05-06 07:31 - 00015872 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\sensors\qtsensors_dummy.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00036352 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\bearer\qgenericbearer.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00038912 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\bearer\qnativewifibearer.dll
2014-06-01 21:39 - 2014-06-01 21:36 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Josephine Mireille\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "DivXMediaServer"
HKLM\...\StartupApproved\Run32: => "DivXUpdate"
HKLM\...\StartupApproved\Run32: => "DXM6Patch_981116"
========================= Accounts: ==========================
Administrator (S-1-5-21-768070318-4204382875-4262773496-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-768070318-4204382875-4262773496-501 - Limited - Disabled)
Josephine Mireille (S-1-5-21-768070318-4204382875-4262773496-1001 - Administrator - Enabled) => C:\Users\Josephine Mireille
==================== Faulty Device Manager Devices =============
Name: Broadcom NetLink (TM)-Gigabit-Ethernet
Description: Broadcom NetLink (TM)-Gigabit-Ethernet
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom Corporation
Service: k57nd60a
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Error: (01/14/2015 00:42:05 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz
Percentage of memory in use: 31%
Total physical RAM: 3976.36 MB
Available physical RAM: 2705.44 MB
Total Pagefile: 5832.36 MB
Available Pagefile: 4469.34 MB
Total Virtual: 131072 MB
Available Virtual: 131071.84 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.42 GB) (Free:305.68 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D9550422)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.4 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Geändert von LuffyXD (14.01.2015 um 13:28 Uhr) |
|
14.01.2015, 13:25
| #5 |
| /// the machine /// TB-Ausbilder | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten BereichenESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
14.01.2015, 21:52
| #6 |
| | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen Hallo schrauber, Eset Online Scanner hatte zunächst Probleme beim Downloaden der Signaturen. Nach mehrmaligen Neustarten des Programmes funktionierte es dann einwandfrei. Es wurden 2 Bedrohungen entdeckt. Während des Scanlaufes ist mir aufgefallen, dass noch alte Treiberreste von meiner Grafikkarte vorhanden sind, so gesehen die Version, die ich zuvor noch installiert hatte. Hier die neuen Logfiles: Eset Online Scanner Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
esets_scanner_update returned -1 esets_gle=12
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5f8922fc5e9d8548a72dea96c2516265
# engine=21968
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-14 07:21:30
# local_time=2015-01-14 08:21:30 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='Panda Cloud Antivirus'
# compatibility_mode=1552 16777213 75 93 248740 207459264 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 4503780 46144583 0 0
# scanned=133
# found=0
# cleaned=0
# scan_time=34
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=5f8922fc5e9d8548a72dea96c2516265
# engine=21968
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-01-14 08:31:56
# local_time=2015-01-14 09:31:56 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.2.9200 NT
# compatibility_mode_1='Panda Cloud Antivirus'
# compatibility_mode=1552 16777213 75 93 252966 207463490 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 4508006 46148809 0 0
# scanned=187600
# found=2
# cleaned=0
# scan_time=4152
sh=15219C0F274C5C9956981C91ABEC5D4E3A1F6442 ft=1 fh=3fec66b3c1704bce vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\Panda Security\Panda Security Protection\Tools\PandaSecurityTb.exe"
sh=27BE2CB6B8D7EA55306D3C0EC4888BD1402A7690 ft=1 fh=6f771ae31cc34ec8 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Administrator\AppData\Local\Temp\{8AE74035-125D-44A3-8BA6-7E8172E91058}.exe"
Code:
ATTFilter Results of screen317's Security Check version 0.99.93
x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Panda Free Antivirus
Windows Defender
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Panda Cloud Cleaner
Adobe Flash Player 16.0.0.235
Adobe Reader XI
Mozilla Firefox (34.0.5)
````````Process Check: objlist.exe by Laurent````````
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-01-2015 02
Ran by Josephine Mireille (administrator) on MIREILLE on 14-01-2015 21:46:46
Running from C:\Users\Josephine Mireille\Downloads
Loaded Profile: Josephine Mireille (Available profiles: Josephine Mireille & Administrator)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe
(VTech) C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechServiceInstaller.exe
(VTech) C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechUSBSocketService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Intel Corporation) C:\Windows\System32\igfxTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\System32\InputMethod\KOR\KorIME.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files\WindowsApps\Disney.FrozenFreeFall_2.2.0.2_x86__6rarf9sa4v8jt\Template.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13427784 2013-03-18] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1278024 2013-03-08] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3010800 2014-06-01] (Synaptics Incorporated)
HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [286192 2013-01-31] (Intel Corporation)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [455512 2014-05-28] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [AgentMonitor] => C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe [401280 2014-06-20] ()
HKLM-x32\...\Run: [DXM6Patch_981116] => C:\WINDOWS\p_981116.exe [497376 1998-11-30] (Microsoft Corporation)
HKLM-x32\...\Run: [PSUAMain] => C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAMain.exe [37624 2014-10-16] (Panda Security, S.L.)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [134784 2014-04-02] ( (Atheros Communications))
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\...\MountPoints2: {8447746c-297d-11e4-bea7-485ab66d3c08} - "E:\Startme.exe"
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [165760 2014-12-13] (NVIDIA Corporation)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.digimonmasters.com/index.aspx
HKU\S-1-5-21-768070318-4204382875-4262773496-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
DPF: HKLM-x32 {9A3D12F9-8802-4316-B877-022025566DA1} hxxp://www.digimonmasters.com/inc/ActiveX/launcher/20130813/Digitalic%20Launcher.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Josephine Mireille\AppData\Roaming\Mozilla\Firefox\Profiles\5h2pxznh.default
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.0.72 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-768070318-4204382875-4262773496-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Josephine Mireille\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Josephine Mireille\AppData\Roaming\Mozilla\Firefox\Profiles\5h2pxznh.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-22]
Chrome:
=======
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - No Path
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [319104 2014-04-02] (Windows (R) Win 7 DDK provider)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2014-11-21] (BitRaider, LLC)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15344 2013-01-31] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [282096 2014-03-17] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [732160 2012-12-10] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [803872 2012-12-10] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [167736 2014-06-01] (Intel Corporation)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)
R2 NanoServiceMain; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSANHost.exe [142072 2014-10-13] (Panda Security, S.L.)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [1903472 2014-12-24] (Electronic Arts)
R2 PandaAgent; C:\Program Files (x86)\Panda Security\Panda Devices Agent\AgentSvc.exe [66808 2014-10-09] (Panda Security, S.L.)
R2 PSUAService; C:\Program Files (x86)\Panda Security\Panda Security Protection\PSUAService.exe [38136 2014-10-16] (Panda Security, S.L.)
R2 VTechUSBSocketService; C:\Program Files (x86)\VTech\DownloadManager\Applications\AppAccessory\12051\VTechUSBSocketService\VTechServiceInstaller.exe [82824 2013-03-29] (VTech)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S3 COMSysApp; %SystemRoot%\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3892224 2014-03-06] (Qualcomm Atheros Communications, Inc.)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2014-06-27] ()
S3 BRDriver64_1_3_3_E02B25FC; C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver64.sys [78088 2014-11-21] (BitRaider)
S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2014-04-02] (Qualcomm Atheros)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2014-06-27] ()
S3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-11-21] (Malwarebytes Corporation)
R1 NNSALPC; C:\Windows\System32\DRIVERS\NNSAlpc.sys [96800 2014-06-04] (Panda Security, S.L.)
R1 NNSHTTP; C:\Windows\System32\DRIVERS\NNSHttp.sys [162336 2014-06-18] (Panda Security, S.L.)
R1 NNSHTTPS; C:\Windows\System32\DRIVERS\NNSHttps.sys [112160 2014-06-04] (Panda Security, S.L.)
R1 NNSIDS; C:\Windows\System32\DRIVERS\NNSIds.sys [115232 2014-06-04] (Panda Security, S.L.)
R1 NNSNAHSL; C:\Windows\system32\DRIVERS\NNSNAHSL.sys [47360 2014-01-16] (Panda Security, S.L.)
R1 NNSPICC; C:\Windows\System32\DRIVERS\NNSPicc.sys [95776 2014-06-04] (Panda Security, S.L.)
R1 NNSPIHSW; C:\Windows\System32\DRIVERS\NNSPihsw.sys [70176 2014-06-04] (Panda Security, S.L.)
R1 NNSPOP3; C:\Windows\System32\DRIVERS\NNSPop3.sys [125984 2014-06-04] (Panda Security, S.L.)
R1 NNSPROT; C:\Windows\System32\DRIVERS\NNSProt.sys [306720 2014-06-04] (Panda Security, S.L.)
R1 NNSPRV; C:\Windows\System32\DRIVERS\NNSPrv.sys [169504 2014-06-04] (Panda Security, S.L.)
R1 NNSSMTP; C:\Windows\System32\DRIVERS\NNSSmtp.sys [115744 2014-06-04] (Panda Security, S.L.)
R1 NNSSTRM; C:\Windows\System32\DRIVERS\NNSStrm.sys [261152 2014-06-04] (Panda Security, S.L.)
R1 NNSTLSC; C:\Windows\System32\DRIVERS\NNSTlsc.sys [109088 2014-06-04] (Panda Security, S.L.)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R2 PSINAflt; C:\Windows\System32\DRIVERS\PSINAflt.sys [163088 2014-10-13] (Panda Security, S.L.)
R2 PSINFile; C:\Windows\System32\DRIVERS\PSINFile.sys [121616 2014-10-13] (Panda Security, S.L.)
R1 PSINKNC; C:\Windows\System32\DRIVERS\psinknc.sys [195616 2014-07-24] (Panda Security, S.L.)
R2 PSINProc; C:\Windows\System32\DRIVERS\PSINProc.sys [122400 2014-07-24] (Panda Security, S.L.)
R2 PSINProt; C:\Windows\System32\DRIVERS\PSINProt.sys [132128 2014-07-24] (Panda Security, S.L.)
R2 PSINReg; C:\Windows\System32\DRIVERS\PSINReg.sys [107792 2014-10-13] (Panda Security, S.L.)
R3 PSKMAD; C:\Windows\System32\DRIVERS\PSKMAD.sys [60400 2014-03-25] (Panda Security, S.L.)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [31472 2014-06-01] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 EagleX64; \??\C:\WINDOWS\system32\drivers\EagleX64.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-14 21:45 - 2015-01-14 21:46 - 00016051 _____ () C:\Users\Josephine Mireille\Downloads\FRST.txt
2015-01-14 21:44 - 2015-01-14 21:44 - 00000498 _____ () C:\Users\Josephine Mireille\Downloads\defogger_disable.log
2015-01-14 21:44 - 2015-01-14 21:44 - 00000000 _____ () C:\Users\Josephine Mireille\defogger_reenable
2015-01-14 19:29 - 2015-01-14 21:39 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-01-14 19:09 - 2015-01-14 19:09 - 00852505 _____ () C:\Users\Josephine Mireille\Downloads\SecurityCheck.exe
2015-01-14 19:07 - 2015-01-14 19:08 - 02347384 _____ (ESET) C:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
2015-01-14 12:38 - 2015-01-14 12:38 - 00000000 ____D () C:\WINDOWS\ERUNT
2015-01-14 12:31 - 2014-03-25 14:15 - 00060400 _____ (Panda Security, S.L.) C:\WINDOWS\system32\Drivers\PSKMAD.sys
2015-01-14 12:19 - 2015-01-14 12:30 - 00000000 ____D () C:\AdwCleaner
2015-01-14 11:33 - 2015-01-14 19:00 - 00129752 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2015-01-14 11:31 - 2015-01-14 11:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-01-14 11:31 - 2015-01-14 11:31 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-01-14 11:31 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2015-01-14 11:31 - 2014-11-21 06:14 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2015-01-14 11:31 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2015-01-14 11:22 - 2015-01-14 11:22 - 01707939 _____ (Thisisu) C:\Users\Josephine Mireille\Downloads\JRT.exe
2015-01-14 11:21 - 2015-01-14 11:21 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Josephine Mireille\Downloads\mbam-setup-2.0.4.1028.exe
2015-01-14 11:21 - 2015-01-14 11:21 - 02191360 _____ () C:\Users\Josephine Mireille\Downloads\AdwCleaner_4.107.exe
2015-01-13 23:03 - 2015-01-14 21:46 - 00000000 ____D () C:\FRST
2015-01-13 22:59 - 2015-01-13 22:59 - 02124288 _____ (Farbar) C:\Users\Josephine Mireille\Downloads\FRST64.exe
2015-01-13 22:55 - 2015-01-13 22:55 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\10 WBC
2015-01-13 22:53 - 2015-01-13 22:54 - 00380416 _____ () C:\Users\Josephine Mireille\Downloads\Gmer-19357.exe
2015-01-13 22:45 - 2015-01-13 22:45 - 00050477 _____ () C:\Users\Josephine Mireille\Downloads\Defogger.exe
2015-01-12 15:19 - 2015-01-12 15:19 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\TeraSAVES
2015-01-12 09:51 - 2015-01-12 09:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-01-12 09:51 - 2014-12-13 01:11 - 02824504 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspcap64.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 02210040 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspcap.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 01715224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvspbridge64.dll
2015-01-12 09:51 - 2014-12-13 01:11 - 01291464 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvspbridge.dll
2015-01-12 09:50 - 2015-01-12 10:30 - 00000000 ____D () C:\WINDOWS\SysWOW64\NV
2015-01-12 09:50 - 2015-01-12 10:30 - 00000000 ____D () C:\WINDOWS\system32\NV
2015-01-12 09:50 - 2015-01-12 09:50 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2015-01-12 09:48 - 2014-12-13 11:08 - 32099472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglv64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 25460552 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcompiler.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 24764232 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglv32.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 20465808 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcompiler.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 18594432 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvwgf2umx.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 17264312 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvd3dumx.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 16040184 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvwgf2um.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 14128496 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvd3dum.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 13288360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvopencl.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 13202520 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuda.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10770120 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvopencl.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10710160 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuda.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 10345280 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvlddmkm.sys
2015-01-12 09:48 - 2014-12-13 11:08 - 03610440 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcuvid.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 03248968 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvcuvid.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 02897824 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvapi.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 01895056 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispco6434709.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 01556624 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvdispgenco6434709.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00968336 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFR64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00942400 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvFBC64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00928072 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFR.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00906560 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvFBC.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00496272 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvEncodeAPI64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00399688 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvEncodeAPI.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00391488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\NvIFROpenGL.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00353224 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvoglshim64.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00346944 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\NvIFROpenGL.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00306328 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvoglshim32.dll
2015-01-12 09:48 - 2014-12-13 11:08 - 00031376 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvpciflt.sys
2015-01-12 09:48 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\WINDOWS\system32\Drivers\nvvad64v.sys
2015-01-12 09:48 - 2014-11-22 11:46 - 00035472 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvaudcap64v.dll
2015-01-12 09:48 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\WINDOWS\SysWOW64\nvaudcap32v.dll
2015-01-12 09:42 - 2015-01-12 09:50 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-12 09:42 - 2014-12-13 09:03 - 06859408 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvcpl.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 03513488 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvc64.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 02558608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvsvcr.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 01097360 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshext.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00935240 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvvsvc.exe
2015-01-12 09:42 - 2014-12-13 09:03 - 00386368 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvmctray.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00075080 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nv3dappshextr.dll
2015-01-12 09:42 - 2014-12-13 09:03 - 00062608 _____ (NVIDIA Corporation) C:\WINDOWS\system32\nvshext.dll
2015-01-12 09:42 - 2014-12-13 00:11 - 04151176 _____ () C:\WINDOWS\system32\nvcoproc.bin
2015-01-12 03:17 - 2015-01-12 03:17 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Panda Security
2015-01-12 03:16 - 2015-01-12 03:16 - 00000180 _____ () C:\WINDOWS\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-01-12 01:28 - 2015-01-12 01:28 - 00001298 _____ () C:\Users\Public\Desktop\Panda Cloud Cleaner.lnk
2015-01-12 01:28 - 2015-01-12 01:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Security
2015-01-12 00:23 - 2015-01-12 00:23 - 00227096 _____ () C:\Users\Administrator\Downloads\avira_registry_cleaner_de.exe
2015-01-12 00:16 - 2014-12-31 12:14 - 00298120 ____N (Microsoft Corporation) C:\WINDOWS\system32\MpSigStub.exe
2015-01-12 00:15 - 2015-01-12 01:28 - 00000000 ____D () C:\Program Files (x86)\Panda Security
2015-01-12 00:15 - 2015-01-12 00:15 - 00000000 ____D () C:\Users\Administrator\AppData\Roaming\Panda Security
2015-01-12 00:15 - 2015-01-12 00:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Panda Free Antivirus
2015-01-12 00:13 - 2015-01-12 00:16 - 00000000 ____D () C:\ProgramData\Panda Security
2015-01-02 22:10 - 2015-01-13 22:58 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\Sims 4
2014-12-25 10:35 - 2014-12-25 10:35 - 00003886 _____ () C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task
2014-12-24 22:43 - 2014-12-24 22:43 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\Electronic Arts
2014-12-24 22:41 - 2014-12-24 22:41 - 00001362 _____ () C:\Users\Public\Desktop\Die Sims 4.lnk
2014-12-24 22:41 - 2014-12-24 22:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Die Sims 4
2014-12-24 22:41 - 2014-09-16 18:45 - 00447752 _____ (On2.com) C:\WINDOWS\SysWOW64\vp6vfw.dll
2014-12-19 20:27 - 2014-10-30 23:37 - 00129536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-12-19 20:27 - 2014-10-30 23:34 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-12-18 11:48 - 2014-12-18 11:48 - 00004608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w95inf32.dll
2014-12-18 11:48 - 2014-12-18 11:48 - 00002272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\w95inf16.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 01088272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\danim.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 00155408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LMRT.dll
2014-12-18 11:48 - 1998-09-02 09:28 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\unam4ie.exe
2014-12-18 11:48 - 1998-09-02 09:28 - 00038160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\LMRTREND.dll
2014-12-18 11:48 - 1998-09-02 09:02 - 00194320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qcut.dll
2014-12-18 11:48 - 1998-08-27 05:51 - 00182032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft3.dll
2014-12-18 11:48 - 1998-08-20 12:02 - 00140800 _____ (The Duck Corporation) C:\WINDOWS\SysWOW64\tm20dec.ax
2014-12-18 11:48 - 1998-08-20 11:38 - 00217984 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\strmdll.dll
2014-12-18 11:48 - 1998-08-17 10:21 - 00011776 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mciqtz.drv
2014-12-18 11:48 - 1998-08-17 10:21 - 00010240 _____ () C:\WINDOWS\SysWOW64\vidx16.dll
2014-12-18 11:48 - 1998-08-17 10:21 - 00005672 _____ () C:\WINDOWS\SysWOW64\quartz.vxd
2014-12-18 11:24 - 2014-12-26 17:54 - 00000000 ____D () C:\Program Files (x86)\Catan
2014-12-18 11:24 - 1998-10-21 18:43 - 00328704 _____ (InstallShield Software Corporation ) C:\WINDOWS\IsUn0407.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-01-14 21:44 - 2014-05-31 23:06 - 00000000 ____D () C:\Users\Josephine Mireille
2015-01-14 21:02 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2015-01-14 20:53 - 2014-05-31 23:16 - 01460569 _____ () C:\WINDOWS\WindowsUpdate.log
2015-01-14 14:42 - 2012-07-26 08:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2015-01-14 13:16 - 2014-06-01 09:37 - 00000000 ___DO () C:\Users\Josephine Mireille\OneDrive
2015-01-14 13:13 - 2013-08-22 15:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2015-01-14 13:05 - 2014-06-03 22:48 - 00000000 ____D () C:\Users\Josephine Mireille\Downloads\Gameforge Live
2015-01-14 12:41 - 2013-08-22 14:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2015-01-14 12:31 - 2014-03-18 02:51 - 00214458 _____ () C:\WINDOWS\PFRO.log
2015-01-13 23:24 - 2014-05-31 16:59 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\CrashDumps
2015-01-13 23:12 - 2014-03-18 11:04 - 01689572 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2015-01-13 23:12 - 2014-03-18 10:25 - 00728968 _____ () C:\WINDOWS\system32\perfh007.dat
2015-01-13 23:12 - 2014-03-18 10:25 - 00152122 _____ () C:\WINDOWS\system32\perfc007.dat
2015-01-13 23:07 - 2014-05-31 11:11 - 00000000 ____D () C:\Users\Josephine Mireille\Documents\Bluetooth Folder
2015-01-13 22:20 - 2014-06-02 13:48 - 00000000 ____D () C:\ProgramData\Origin
2015-01-13 22:19 - 2014-06-02 13:48 - 00000000 ____D () C:\Program Files (x86)\Origin
2015-01-12 19:17 - 2014-11-11 11:44 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2015-01-12 10:07 - 2014-05-31 16:15 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-768070318-4204382875-4262773496-1001
2015-01-12 09:51 - 2014-06-01 07:22 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\NVIDIA Corporation
2015-01-12 09:51 - 2014-05-31 16:35 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-01-12 09:51 - 2014-05-31 16:35 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2015-01-12 09:50 - 2013-08-22 15:46 - 00008474 _____ () C:\WINDOWS\setupact.log
2015-01-12 09:47 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2015-01-12 09:41 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\Help
2015-01-12 09:40 - 2013-08-22 15:44 - 00384464 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2015-01-12 00:34 - 2014-05-31 23:36 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-768070318-4204382875-4262773496-500
2015-01-12 00:21 - 2014-11-04 09:11 - 00000000 ____D () C:\ProgramData\Package Cache
2015-01-12 00:10 - 2014-05-31 23:06 - 00000000 ____D () C:\Users\Administrator
2015-01-12 00:08 - 2013-08-22 14:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2015-01-11 00:33 - 2014-08-14 12:23 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\TS3Client
2014-12-28 20:10 - 2014-06-01 19:23 - 00007605 _____ () C:\Users\Josephine Mireille\AppData\Local\Resmon.ResmonCfg
2014-12-24 20:06 - 2014-06-02 13:50 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Origin
2014-12-24 20:06 - 2014-06-02 13:50 - 00000000 ____D () C:\Program Files (x86)\Origin Games
2014-12-21 17:28 - 2014-06-01 08:58 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Roaming\Atheros
2014-12-19 15:34 - 2013-08-22 16:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-12-18 11:47 - 2013-08-22 12:22 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnet.dll
2014-12-18 11:47 - 2013-08-22 12:22 - 00034304 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnsvr.exe
2014-12-18 11:47 - 2013-08-22 12:17 - 00066560 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnathlp.dll
2014-12-18 11:47 - 2013-08-22 12:17 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhupnp.dll
2014-12-18 11:47 - 2013-08-22 12:17 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\system32\dpnhpast.dll
2014-12-18 11:47 - 2013-08-22 05:05 - 00023552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpmodemx.dll
2014-12-18 11:47 - 2013-08-22 05:03 - 00030720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplaysvr.exe
2014-12-18 11:47 - 2013-08-22 04:59 - 00214016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dplayx.dll
2014-12-18 11:47 - 2013-08-22 04:56 - 00377856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnet.dll
2014-12-18 11:47 - 2013-08-22 04:56 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnsvr.exe
2014-12-18 11:47 - 2013-08-22 04:51 - 00059904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnathlp.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00045056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpwsockx.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhupnp.dll
2014-12-18 11:47 - 2013-08-22 04:51 - 00009216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dpnhpast.dll
2014-12-17 21:22 - 2014-05-31 16:09 - 00000000 ____D () C:\Users\Josephine Mireille\AppData\Local\Packages
Some content of TEMP:
====================
C:\Users\Administrator\AppData\Local\Temp\avgnt.exe
C:\Users\Administrator\AppData\Local\Temp\{8AE74035-125D-44A3-8BA6-7E8172E91058}.exe
C:\Users\Josephine Mireille\AppData\Local\Temp\avgnt.exe
C:\Users\Josephine Mireille\AppData\Local\Temp\Quarantine.exe
C:\Users\Josephine Mireille\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-01-09 13:16
==================== End Of Log ============================
Addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-01-2015 02
Ran by Josephine Mireille at 2015-01-14 21:47:05
Running from C:\Users\Josephine Mireille\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Panda Free Antivirus (Disabled - Up to date) {5FD6C936-849B-5CE2-14BA-709E1D6FD1DA}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Panda Free Antivirus (Disabled - Up to date) {E4B728D2-A2A1-536C-2E0A-4BEC66E89B67}
FW: Panda Firewall (Disabled) {67ED4813-CEF4-5DBA-3FE5-D9ABE3BC96A1}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AION Free-to-Play (HKLM-x32\...\{82E73E8D-E1E7-45A4-A311-6D31492AA913}_is1) (Version: - Gameforge)
ANNO 1404 (HKLM-x32\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.01.0000 - Ubisoft)
Anno 1404 (x32 Version: 1.00.0000 - Ubisoft) Hidden
BitRaider Streaming Client (HKLM-x32\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Die Sims™ 4 (HKLM-x32\...\{48EBEBBF-B9F8-4520-A3CF-89A730721917}) (Version: 1.3.18.1010 - Electronic Arts Inc.)
DigimonMasters Online (HKLM-x32\...\DigimonMasters) (Version: - Move games)
DigimonMasters Online Launcher (HKLM-x32\...\DigimonMasters Launcher) (Version: - Move games)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.3.52 - DivX, LLC)
Gameforge Live 2.0.5 (HKLM-x32\...\{9C98989A-3A15-42DA-A3B9-D20331437D67}}_is1) (Version: 2.0.5 - Gameforge)
GIMP 2.8.10 (HKLM\...\GIMP-2_is1) (Version: 2.8.10 - The GIMP Team)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.0.1310 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3496 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.0.0.1083 - Intel Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Windows Application Compatibility Database (HKLM\...\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb) (Version: - )
Mozilla Firefox 34.0.5 (x86 de) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 de)) (Version: 34.0.5 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.09 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.11.2806 - Electronic Arts, Inc.)
Panda Cloud Cleaner (HKLM-x32\...\{92B2B132-C7F0-43DC-921A-4493C04F78A4}_is1) (Version: 1.0.104 - Panda Security)
Panda Devices Agent (HKLM-x32\...\Panda Devices Agent) (Version: 1.03.04 - Panda Security)
Panda Devices Agent (x32 Version: 1.05.00 - Panda Security) Hidden
Panda Free Antivirus (HKLM-x32\...\Panda Universal Agent Endpoint) (Version: 15.00.04.0002 - Panda Security)
Panda Free Antivirus (Version: 7.23.00.0000 - Panda Security) Hidden
PDF Architect 2 Edit Module (x32 Version: 2.1.6.19758 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.0 - pdfforge)
Pflanzen gegen Zombies™ (HKLM-x32\...\{5E6536C2-E79A-49CF-83EA-817AD81F9FC8}) (Version: 1.2.0.1093 - Electronic Arts, Inc.)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.320 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.31 - Qualcomm Atheros)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6865 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\...\{C1594429-8296-4652-BF54-9DBE4932A44C}) (Version: 6.2.9200.28130 - Realtek Semiconductor Corp.)
ServiceInstaller (HKLM-x32\...\ServiceInstaller) (Version: - )
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
Star Wars The Old Republic (HKLM-x32\...\swtor_swtor) (Version: 7.0.0.59 - Bioware/EA)
Star Wars: The Old Republic (HKLM-x32\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 16.3.4.5 - Synaptics Incorporated)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TERA (HKLM-x32\...\{A2F166A0-F031-4E27-A057-C69733219434}_is1) (Version: 28 - Gameforge Productions GmbH)
Unity Web Player (HKU\S-1-5-21-768070318-4204382875-4262773496-1001\...\UnityWebPlayer) (Version: 4.6.0f3 - Unity Technologies ApS)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VTech Download Agent Library (x32 Version: 1.00.0000 - VTech) Hidden
VTech Download Manager (HKLM-x32\...\VTechDownloadManager) (Version: - VTech)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-768070318-4204382875-4262773496-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\WINDOWS\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
28-12-2014 19:12:00 Removed Java 8 Update 5
07-01-2015 13:07:14 Geplanter Prüfpunkt
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {4F0F85C3-4DFA-44AF-A3FD-E3F618B0D5EB} - System32\Tasks\{0BFEC8A9-7CA1-4DF0-8B13-D074D1A03D80} => pcalua.exe -a C:\WINDOWS\SysWOW64\Macromed\Flash\FlashUtil32_15_0_0_223_Plugin.exe -c -maintain plugin
Task: {E2600F8A-C7E0-43A7-B24F-25CF05F98856} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
==================== Loaded Modules (whitelisted) =============
2015-01-12 09:42 - 2014-12-13 09:03 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-04-02 01:25 - 2014-04-02 01:25 - 00011264 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll
2014-04-02 01:22 - 2014-04-02 01:22 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2014-04-02 01:28 - 2014-04-02 01:28 - 00012928 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\ActivateDesktop.exe
2014-10-13 02:49 - 2014-06-20 07:42 - 00401280 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\AgentMonitor.exe
2014-12-24 14:00 - 2014-12-24 14:01 - 00130048 _____ () C:\Program Files\WindowsApps\Disney.FrozenFreeFall_2.2.0.2_x86__6rarf9sa4v8jt\Template.exe
2013-04-12 18:23 - 2013-04-12 18:23 - 00612664 _____ () C:\Program Files (x86)\Panda Security\Panda Security Protection\SQLite3.dll
2014-06-01 21:39 - 2014-06-01 21:36 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-10-13 02:49 - 2014-03-04 12:20 - 00117760 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\QtSolutions_SOAP-2.7.dll
2014-10-13 02:49 - 2014-04-22 03:14 - 00065536 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\QHttpServer.dll
2014-10-13 02:49 - 2014-05-06 06:39 - 00861184 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\platforms\qwindows.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00021504 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qgif.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00020992 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qico.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00204800 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qjpeg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00218112 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qmng.dll
2014-10-13 02:49 - 2014-05-06 06:58 - 00015872 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qsvg.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00015360 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qtga.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00307712 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qtiff.dll
2014-10-13 02:49 - 2014-05-06 11:44 - 00014848 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\imageformats\qwbmp.dll
2014-10-13 02:49 - 2014-05-06 07:31 - 00015872 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\sensors\qtsensors_dummy.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00036352 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\bearer\qgenericbearer.dll
2014-10-13 02:49 - 2014-05-06 06:38 - 00038912 _____ () C:\Program Files (x86)\VTech\DownloadManager\System\plugins\bearer\qnativewifibearer.dll
2014-12-28 11:55 - 2014-12-28 11:55 - 00631296 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\Template\9748bd14ef7fee75b77b5b0e7330ddc5\Template.ni.exe
2014-11-07 15:55 - 2014-11-07 15:55 - 03530752 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.UI.Xaml\90a4331ab5b5bb3ead23d75d4349a491\Windows.UI.Xaml.ni.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 00043520 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\UnityPlayer\6644fd283d03b173b04793e3f7cab104\UnityPlayer.ni.dll
2014-12-17 21:21 - 2014-12-17 21:21 - 09444864 _____ () C:\Program Files\WindowsApps\Disney.FrozenFreeFall_2.2.0.2_x86__6rarf9sa4v8jt\UnityPlayer.dll
2014-11-07 15:55 - 2014-11-07 15:55 - 01130496 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.App640a3541#\6e37f358bf8363dad51e2333292d61a9\Windows.ApplicationModel.ni.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 00278016 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\WinRTBridge\9c224632a4a33a069ec8ed50c19df73e\WinRTBridge.ni.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 00090624 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\BridgeInterface\25bf1662b32ccc264f2da294bc6896ec\BridgeInterface.ni.dll
2014-12-28 11:55 - 2014-12-28 11:55 - 09838592 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\Assembly-CSharp\d18c142758317484d989eae95a2ddd85\Assembly-CSharp.ni.dll
2014-12-28 11:59 - 2014-12-28 11:59 - 04752384 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\UnityEngine\cf478b7f7cdb1ccd3cdb1b61f7f7f6dc\UnityEngine.ni.dll
2014-11-07 15:55 - 2014-11-07 15:55 - 00960000 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.UI\6c2169e34bfb3814fa44f267572335f6\Windows.UI.ni.dll
2014-11-07 15:55 - 2014-11-07 15:55 - 00808448 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Storage\f0a2c10499402eff632a7a7df0b4afef\Windows.Storage.ni.dll
2014-11-07 15:55 - 2014-11-07 15:55 - 00228864 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Foundation\f7e726805e56676bd7b8662a3d842b0e\Windows.Foundation.ni.dll
2014-12-28 11:59 - 2014-12-28 11:59 - 00798208 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\Assembly-CS2939542b#\538bb6e5ed99ec142e6d7e5e8ff4ddb8\Assembly-CSharp-firstpass.ni.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 01344512 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\UnityEngineProxy\d9a01b0aacca4c66aa1addc8d0c9df5c\UnityEngineProxy.ni.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 00048640 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\Assembly-UnityScript\a16f7fa5fbee6508005894f4f32fddc7\Assembly-UnityScript.ni.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 00373248 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\Boo.Lang\1a505c25dbc999e80a3d53db2c2c2188\Boo.Lang.ni.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 00053760 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\UnityScript.Lang\3676a9e2a3613f59dd04f167ecb3912c\UnityScript.Lang.ni.dll
2014-12-17 21:21 - 2014-12-17 21:21 - 00394752 _____ () C:\Program Files\WindowsApps\Disney.FrozenFreeFall_2.2.0.2_x86__6rarf9sa4v8jt\UnityEngineDelegates.dll
2014-12-18 01:10 - 2014-12-18 01:10 - 01572352 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\WinRTLegacy\2d1583f5f8d48b800b5d7f16f5ce5699\WinRTLegacy.ni.dll
2014-11-07 19:24 - 2014-11-07 19:24 - 00797696 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Networking\e1a2f3f274995f1f847c00f962657943\Windows.Networking.ni.dll
2014-12-28 11:55 - 2014-12-28 11:55 - 01582592 _____ () C:\Users\Josephine Mireille\AppData\Local\Packages\Disney.FrozenFreeFall_6rarf9sa4v8jt\AC\Microsoft\CLR_v4.0_32\NativeImages\msdk\8c9036e07e84b6490677f0b2690630b2\msdk.ni.dll
2014-11-07 15:55 - 2014-11-07 15:55 - 00133120 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.System\7819e306c2c55c42f35a5fa10b93710f\Windows.System.ni.dll
2014-11-07 19:24 - 2014-11-07 19:24 - 00402432 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Security\ade4f25e9d8384f190ede9eb090281cb\Windows.Security.ni.dll
2014-11-07 19:24 - 2014-11-07 19:24 - 00337920 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\Windows.Data\fe565d34d4335337c06264bb0d85e3b0\Windows.Data.ni.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\Josephine Mireille\OneDrive:ms-properties
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSUAService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NanoServiceMain => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PSUAService => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKLM\...\StartupApproved\Run32: => "DivXMediaServer"
HKLM\...\StartupApproved\Run32: => "DivXUpdate"
HKLM\...\StartupApproved\Run32: => "DXM6Patch_981116"
========================= Accounts: ==========================
Administrator (S-1-5-21-768070318-4204382875-4262773496-500 - Administrator - Disabled) => C:\Users\Administrator
Gast (S-1-5-21-768070318-4204382875-4262773496-501 - Limited - Disabled)
Josephine Mireille (S-1-5-21-768070318-4204382875-4262773496-1001 - Administrator - Enabled) => C:\Users\Josephine Mireille
==================== Faulty Device Manager Devices =============
Name: Broadcom NetLink (TM)-Gigabit-Ethernet
Description: Broadcom NetLink (TM)-Gigabit-Ethernet
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom Corporation
Service: k57nd60a
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (01/14/2015 09:36:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 08:21:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 08:21:50 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 08:15:34 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 08:15:33 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 08:10:37 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 07:30:27 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 07:30:24 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 07:29:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
Error: (01/14/2015 07:29:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifest.
Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifest.
System errors:
=============
Error: (01/14/2015 01:13:30 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (01/14/2015 00:48:32 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (01/14/2015 00:42:05 PM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureActions" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Microsoft Office Sessions:
=========================
Error: (01/14/2015 09:36:41 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe
Error: (01/14/2015 08:21:51 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 08:21:50 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 08:15:34 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 08:15:33 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 08:10:37 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 07:30:27 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 07:30:24 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 07:29:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
Error: (01/14/2015 07:29:39 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_6242a4b3ecbb55a1.manifestC:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17031_none_a9efdb8b01377ea7.manifestC:\Users\Josephine Mireille\Downloads\esetsmartinstaller_deu.exe
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4200M CPU @ 2.50GHz
Percentage of memory in use: 47%
Total physical RAM: 3976.36 MB
Available physical RAM: 2090.06 MB
Total Pagefile: 5832.36 MB
Available Pagefile: 3718.9 MB
Total Virtual: 131072 MB
Available Virtual: 131071.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:465.42 GB) (Free:304.57 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: D9550422)
Partition 1: (Active) - (Size=350 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.4 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
15.01.2015, 07:09
| #7 |
| /// the machine /// TB-Ausbilder | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen Sieht gut aus. Bestehen noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.01.2015, 11:42
| #8 |
| | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen An sich denke ich, dass es keine Probleme sind, die mit Adware, Malware oder sonstigen schädlichen Programmen zu tun hat. Wahrscheinlich bleibt mir nichts anderes, als das Gerät einzuschicken, da eventuell Hardwareprobleme Ursache sein können. Das Seltsame ist halt, dass es immer wunderbar geklappt hat, bis zu einem gewissen Punkt, möglicherweise auch ein Problem verursacht durch ein Update des Spieleherstellers. Firefox schwächelt auch ab und an noch. Sind die Programme eventuell beschädigt, durch die Malware und unerwünschten Programme, die sich auf meinem Laptop tummelten? Vielen Dank aufjedenfall für die Bemühungen und Hilfe, der Systemstart z.B ist deutlich schneller und andere Anwendungen laufen auch wieder flüssiger. Mit freundlichem Gruß, LuffyXD |
|
15.01.2015, 12:47
| #9 |
| /// the machine /// TB-Ausbilder | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen dann sag mir doch mal im Klartext was noch nicht 100% passt, dann kann ich dazu evtl mehr sagen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
15.01.2015, 16:35
| #10 |
| | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen Hallo schrauber, Firefox Firefox brauch teilweise sehr lange um Websites zu laden. Besonders auffällig ist auch, die lange Ladezeiten von Grafiken, Videos etc. Jedoch kommt dies immer nur in unregelmäßigen Abständen vor. Deswegen habe ich schon mehrfach den Firefox vollständig deinstalliert, die Daten in Ausführen>%appdata% von Firefox gelöscht und auch in der Registry nach der Deinstallation die Daten in den Bereichen HKEY_CURRENT_USER & HKEY_LOCALE_MACHINE > Software > Mozilla & Mozilla Plugins gelöscht. Danach hatte ich den Firefox neuinstalliert & neu eingerichtet, Adblock & Noscript hinzugefügt. Wobei ich Noscript später wieder entfernt hatte, da meine Frau damit schlecht zurecht gekommen ist. Damit war dann vorübergehend das Problem gelöst, jedoch nicht allzu lange, eventuell auch durch die Malware, PUP's etc was halt durch deine Hilfe bereits entfernt wurde. Nach deinen Anweisungen habe ich an Firefox noch keine Veränderungen getätigt, vor alle auch deswegen, da hier im Forum oft darüber informiert wurde, die Registry unangetastet zu lassen. Ich habe nie Tuning Programme oder CCleaner auf dem Laptop angewendet. Tera Rising (MMORPG) Hier tritt halt seit kurzer Zeit immer häufiger das Problem auf, dass ich extreme FPS Einbrüche habe. Vor allem in den sogenannten Schlachtgruppen. Das sind Gebiete wo bis zu 20 gegen 20 Spieler gegeneinander antreten. Natürlich wird dort einiges an Speicherverbrauch abverlangt. Mein Notebook hat dies aber relativ gut gemeistert, so dass das Spiel noch spielbar war. Doch seit kurzer Zeit sinkt die FPS bis auf 0, ich hab ständig Standbilder, immer längere Ladebildschirme, Abstürze im Minuten takt usw. Daraufhin habe ich getestet, ob die Grafikeinstellungen eventuell zu hoch eingestellt sind und diese bis auf das Minimum gesenkt. Doch selbst dann ist die FPS nicht mal minimal besser. Um mal die wichtigsten Daten aufzuführen: - Acer Aspire V3-772G - Intel i5-4200M 2.5GHz bis zu 3.1 GHz - Nvidia Geforce GTX 760M 2GB - 4 GB Ram von Kingston - 16000er Leitung wovon aber vll 10000-11000 ankommen nach Straßenarbeiten vor unserer Wohnung Natürlich ist das nicht das Beste vom Besten, dass ist mir bewusst, jedoch wenn ich von Spielern höre, die deutlich schlechtere Ressourcen haben, aber das Spiel besser läuft als bei mir, dann kommt das einem sehr fragwürdig vor. Und wie schon erläutert, hatte ich anfangs nicht das Problem. Ich habe zu dem Ressourcenmonitor vom Taskmanager nebenbei beobachtet, weder Ram noch CPU waren stark ausgelastet, lediglich die Festplatte lief meist auf 99-100%. Jedoch habe ich diese Probleme kaum noch, seit dem ich statt Avira Antiviren neuerdings Panda Free Antivir benutze. Den Ping habe ich mit CMD getestet und dabei sind mir nur zwischendurch ein hoher Ping aufgefallen von bis zu 480ms. Normalerweise lag dieser bei 2-18ms. Als Gegenmaßnahme habe ich dann Lösungvorschläge ausprobiert: - Auslagerungsdatei festlegen 4096-8192 - Reparaturfunktion des Spiels benutzen - Daten aus dem Spielordner löschen (Tera>Client>S1Game>alle Daten die mit S1Game beginnen) Einem Cleaninstall bin ich bisher aus dem Weg gegangen, da dieser bis zu 2 Tage dauert. Das Notebook ist gerade mal 6-7 Monate alt. Ich hoffe, dass die Informationen soweit eventuell weiterhelfen. Mit freundlichem Gruß Geändert von LuffyXD (15.01.2015 um 16:49 Uhr) |
|
15.01.2015, 17:14
| #11 | |
| /// the machine /// TB-Ausbilder | Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten BereichenZitat:
https://support.mozilla.org/de/kb/fi...einfach-loesen Dann die Hardwarebeschleunigung in FF abschalten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Laptop - Windows 8.1 Pro 64 Bit: System zunehmend langsamer in bestimmten Bereichen |
| adware, antivir, avg, avira, browser, cpu, device driver, dllhost.exe, fehler, firefox, flash player, frage, installation, mozilla, problem, realtek, registry, rundll, scan, security, services.exe, software, svchost.exe, system, viren, windows, wlan |
Linear-Darstellung
