vi view anstatt google als startseite+ umleitung bei hyperlinks

der_kaeptn · 01.02.2015, 21:18

lange rede kurzer sinn, hier die logs:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:02 on 01/02/2015 (morpheus)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

frst

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-10-2014 02 (ATTENTION: ====> FRST version is 112 days old and could be outdated)
Ran by morpheus (administrator) on MORPHEUS-PC on 01-02-2015 21:06:18
Running from C:\Users\morpheus\Desktop
Loaded Profile: morpheus (Available profiles: morpheus)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Creative Technology Ltd) C:\Windows\SysWOW64\CtHdaSvc.exe
(Qualcomm Atheros) C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
() C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
(Logitech Inc.) F:\Webcam\LWS\Webcam Software\LWS.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Program Files\Windows NT\Accessories\wordpad.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Samsung Electronics.) F:\Samsung Magician\Samsung Magician.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Creative Technology Ltd) C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\CTJckCfg.exe
() F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files (x86)\Common Files\logishrd\LQCVFX\COCIManager.exe
(Blizzard Entertainment) D:\Battle.net\Battle.net.5383\Battle.net.exe
(Valve Corporation) D:\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
(Valve Corporation) D:\Steam\bin\steamwebhelper.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe
(Skype Technologies S.A.) F:\Skype\Phone\Skype.exe
(TeamSpeak Systems GmbH) F:\TS3\ts3client_win64.exe
(SysTool PasSame LIMITED) C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe
(Oracle Corporation) C:\Program Files (x86)\Java\jre7\bin\javaw.exe
(XTab system) C:\Program Files (x86)\XTab\ProtectService.exe
(Malwarebytes Corporation) F:\ Malwarebytes Anti-Malware \mbam.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM-x32\...\Run: [UpdReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)
HKLM-x32\...\Run: [Sound Blaster Recon3Di SBX Control Panel] => C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe [976896 2012-11-28] (Creative Technology Ltd)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation)
HKLM-x32\...\Run: [LWS] => F:\Webcam\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\S-1-5-21-2650584954-4125578154-643085364-1000\...\MountPoints2: {b9777e4f-4968-11e4-8e4d-806e6f6e6963} - E:\Setup.exe
HKU\S-1-5-21-2650584954-4125578154-643085364-1000\...\MountPoints2: {bd2b5343-4997-11e4-8f3b-806e6f6e6963} - E:\Run.exe
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-10-04] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Killer Network Manager.lnk
ShortcutTarget: Killer Network Manager.lnk -> C:\Windows\Installer\{401FADAA-1C16-4721-9F02-19067E1A1CA8}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe (Flexera Software LLC)
Startup: C:\Users\morpheus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Samsung Magician.lnk
ShortcutTarget: Samsung Magician.lnk -> C:\Windows\System32\schtasks.exe (Microsoft Corporation)
Startup: C:\Users\morpheus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 2540 series.lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 2540 series.lnk -> C:\Program Files\HP\HP Deskjet 2540 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x684C4CC676DDCF01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://myhome.vi-view.com/web/?type=ds&ts=1422783944&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://myhome.vi-view.com/web/?type=ds&ts=1422783944&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://myhome.vi-view.com/web/?type=ds&ts=1422783944&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://myhome.vi-view.com/web/?type=ds&ts=1422783944&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&q={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://myhome.vi-view.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&ts=1422784018&type=default&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://myhome.vi-view.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&ts=1422784018&type=default&q={searchTerms}
SearchScopes: HKCU - {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = hxxp://myhome.vi-view.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&ts=1422784018&type=default&q={searchTerms}
SearchScopes: HKCU - {E733165D-CBCF-4FDA-883E-ADEF965B476C} URL = hxxp://myhome.vi-view.com/web/?utm_source=b&utm_medium=cor&utm_campaign=install_ie&utm_content=ds&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&ts=1422784018&type=default&q={searchTerms}
BHO-x32: IETabPage Class -> {3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C} -> C:\Program Files (x86)\XTab\SupTab.dll (Thinknice Co. Limited)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\morpheus\AppData\Roaming\Mozilla\Firefox\Profiles\oe9stjl8.default-1413372178239
FF DefaultSearchEngine: vi-view
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_296.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_296.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\morpheus\AppData\Roaming\Mozilla\Firefox\Profiles\oe9stjl8.default-1413372178239\searchplugins\vi-view.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\ddg.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FF Toolbar - C:\Users\morpheus\AppData\Roaming\Mozilla\Firefox\Profiles\oe9stjl8.default-1413372178239\Extensions\fftoolbar2014@etech.com [2015-02-01]
FF Extension: FireFTP - C:\Users\morpheus\AppData\Roaming\Mozilla\Firefox\Profiles\oe9stjl8.default-1413372178239\Extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f} [2015-01-15]
FF Extension: Adblock Plus - C:\Users\morpheus\AppData\Roaming\Mozilla\Firefox\Profiles\oe9stjl8.default-1413372178239\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-10-15]
FF HKLM-x32\...\Firefox\Extensions: [fftoolbar2014@etech.com] - C:\Users\morpheus\AppData\Roaming\Mozilla\Firefox\Profiles\oe9stjl8.default-1413372178239\extensions\fftoolbar2014@etech.com

Chrome: 
=======
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2014-10-01] (Creative Labs) [File not signed]
S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2014-10-01] (Creative Labs) [File not signed]
R2 CTAudSvcService; C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe [423424 2012-10-08] (Creative Technology Ltd) [File not signed]
R2 CtHdaSvc; C:\Windows\sysWow64\CtHdaSvc.exe [103936 2013-08-20] (Creative Technology Ltd)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-09] (Intel Corporation)
R2 IHProtect Service; C:\Program Files (x86)\XTab\ProtectService.exe [158896 2015-01-16] (XTab system)
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 Qualcomm Atheros Killer Service V2; C:\Program Files\Qualcomm Atheros\Network Manager\KillerService.exe [343040 2013-08-08] (Qualcomm Atheros) [File not signed]
S2 SkypeUpdate; F:\Skype\Updater\Updater.exe [315496 2014-12-11] (Skype Technologies)
R2 WindowsMangerProtect; C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [464384 2015-02-01] (SysTool PasSame LIMITED) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 BfLwf; C:\Windows\System32\DRIVERS\bflwfx64.sys [67888 2013-02-13] (Qualcomm Atheros, Inc.)
R3 cthda; C:\Windows\System32\drivers\cthda.sys [1049880 2013-08-20] (Creative Technology Ltd)
R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation)
R3 Ke2200; C:\Windows\System32\DRIVERS\e22w7x64.sys [154320 2013-03-20] (Qualcomm Atheros, Inc.)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-01] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
R1 Serial; C:\Windows\System32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
R1 {ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64; C:\Windows\System32\drivers\{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64.sys [48784 2015-01-31] (StdLib)
S3 gdrv; \??\C:\Windows\gdrv.sys [X]
S4 nvvad_WaveExtensible; system32\drivers\nvvad64v.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 21:06 - 2015-02-01 21:06 - 00014563 _____ () C:\Users\morpheus\Desktop\FRST.txt
2015-02-01 21:06 - 2015-02-01 21:06 - 00000000 ____D () C:\FRST
2015-02-01 21:02 - 2015-02-01 21:02 - 00000478 _____ () C:\Users\morpheus\Desktop\defogger_disable.log
2015-02-01 21:02 - 2015-02-01 21:02 - 00000000 _____ () C:\Users\morpheus\defogger_reenable
2015-02-01 20:29 - 2015-02-01 20:29 - 00000000 ____D () C:\Users\morpheus\AppData\Roaming\WinRAR
2015-02-01 12:55 - 2015-02-01 12:55 - 00050477 _____ () C:\Users\morpheus\Downloads\Defogger.exe
2015-02-01 10:54 - 2015-01-31 19:25 - 00048784 _____ (StdLib) C:\Windows\system32\Drivers\{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64.sys
2015-02-01 10:47 - 2015-02-01 10:47 - 00000000 ____D () C:\ProgramData\IHProtectUpDate
2015-02-01 10:46 - 2015-02-01 21:00 - 00000000 ____D () C:\Users\morpheus\AppData\Roaming\vi-view
2015-02-01 10:46 - 2015-02-01 10:47 - 00000000 ____D () C:\Program Files (x86)\XTab
2015-02-01 10:46 - 2015-02-01 10:46 - 00000000 ____D () C:\ProgramData\WindowsMangerProtect
2015-02-01 10:45 - 2015-02-01 10:45 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2015-02-01 10:45 - 2015-02-01 10:45 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2015-02-01 10:45 - 2015-02-01 10:45 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2015-02-01 10:45 - 2015-02-01 10:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-02-01 10:45 - 2015-02-01 10:45 - 00000679 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk
2015-02-01 10:45 - 2015-02-01 10:45 - 00000639 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk
2015-02-01 10:45 - 2015-02-01 10:45 - 00000624 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk
2015-02-01 10:45 - 2015-02-01 10:45 - 00000000 ____D () C:\ProgramData\Sun
2015-02-01 10:45 - 2015-02-01 10:45 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-02-01 10:45 - 2015-02-01 10:45 - 00000000 ____D () C:\Program Files (x86)\Java
2015-02-01 10:43 - 2015-02-01 10:43 - 00231544 _____ () C:\Users\morpheus\Downloads\install_jd_one.exe
2015-01-30 17:44 - 2015-01-30 17:44 - 00000000 ____D () C:\Users\morpheus\AppData\Roaming\steam.transformice.com
2015-01-25 10:34 - 2015-01-25 10:34 - 00000000 ____D () C:\Windows\SysWOW64\directx
2015-01-21 19:33 - 2015-01-21 19:33 - 00002219 _____ () C:\Users\Public\Desktop\HP Deskjet 2540 series.lnk
2015-01-21 19:33 - 2015-01-21 19:33 - 00001166 _____ () C:\Users\Public\Desktop\Shop für Zubehör - HP Deskjet 2540 series.lnk
2015-01-21 19:33 - 2015-01-21 19:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2015-01-21 19:33 - 2015-01-21 19:33 - 00000000 ____D () C:\Program Files\HP
2015-01-21 19:33 - 2015-01-21 19:33 - 00000000 ____D () C:\Program Files (x86)\HP
2015-01-21 19:33 - 2014-03-06 12:51 - 00763912 ____N (Hewlett-Packard Co.) C:\Windows\system32\HPDiscoPMC211.dll
2015-01-21 19:31 - 2015-01-21 19:31 - 00000057 _____ () C:\ProgramData\Ament.ini
2015-01-21 19:29 - 2015-01-21 19:54 - 00000000 ____D () C:\Users\morpheus\AppData\Local\HP
2015-01-20 18:00 - 2015-01-20 18:00 - 00000000 ____D () C:\Users\morpheus\AppData\Local\Microsoft Games
2015-01-20 16:59 - 2015-01-20 16:59 - 01948660 _____ () C:\Users\morpheus\Downloads\donazte.wav
2015-01-19 12:08 - 2015-01-19 12:08 - 00000000 _____ () C:\Users\morpheus\Desktop\Neues Textdokument (2).txt
2015-01-14 09:20 - 2014-12-19 04:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-01-14 09:20 - 2014-12-19 02:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2015-01-14 09:20 - 2014-12-12 06:35 - 05553592 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-01-14 09:20 - 2014-12-12 06:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-01-14 09:20 - 2014-12-12 06:31 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-01-14 09:20 - 2014-12-12 06:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-01-14 09:20 - 2014-12-12 06:11 - 03971512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-01-14 09:20 - 2014-12-12 06:11 - 03916728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-01-14 09:20 - 2014-12-12 06:07 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-01-14 09:20 - 2014-12-11 18:47 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2015-01-14 09:20 - 2014-12-06 05:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2015-01-14 09:20 - 2014-12-06 04:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2015-01-14 09:20 - 2014-12-06 04:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2015-01-14 00:11 - 2015-01-14 00:11 - 00000000 _____ () C:\Users\morpheus\Desktop\Neues Textdokument.txt
2015-01-12 23:02 - 2015-01-12 23:02 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-01-11 12:57 - 2015-01-21 19:33 - 00000000 ____D () C:\ProgramData\HP
2015-01-03 20:51 - 2015-01-03 20:53 - 00000000 ____D () C:\Users\morpheus\Desktop\hearthstone

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-01 21:05 - 2014-10-01 14:30 - 00000000 ____D () C:\Users\morpheus\AppData\Local\Battle.net
2015-02-01 21:02 - 2014-10-01 13:31 - 00000000 ____D () C:\Users\morpheus
2015-02-01 20:54 - 2014-12-25 23:26 - 00000000 ____D () C:\Users\morpheus\AppData\Roaming\Skype
2015-02-01 20:41 - 2014-10-01 13:31 - 01674767 _____ () C:\Windows\WindowsUpdate.log
2015-02-01 20:39 - 2014-10-01 14:13 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-01 18:55 - 2009-07-14 03:34 - 00000505 _____ () C:\Windows\win.ini
2015-02-01 18:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\GroupPolicy
2015-02-01 12:48 - 2014-12-06 10:52 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-02-01 00:38 - 2009-07-14 18:58 - 00699092 _____ () C:\Windows\system32\perfh007.dat
2015-02-01 00:38 - 2009-07-14 18:58 - 00149232 _____ () C:\Windows\system32\perfc007.dat
2015-02-01 00:38 - 2009-07-14 06:13 - 01619284 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-01 00:36 - 2009-07-14 05:51 - 00029428 _____ () C:\Windows\setupact.log
2015-01-31 18:57 - 2014-10-07 23:33 - 00000000 ____D () C:\Users\morpheus\AppData\Roaming\OBS
2015-01-31 18:33 - 2014-10-01 14:40 - 00000000 ____D () C:\Users\morpheus\AppData\Local\Arma 3
2015-01-29 22:19 - 2014-10-07 23:33 - 00000000 ____D () C:\Program Files\OBS
2015-01-27 12:52 - 2014-10-01 14:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-01-26 01:40 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-01-26 01:40 - 2009-07-14 05:45 - 00023168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-01-25 13:39 - 2014-10-01 14:13 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-01-25 13:39 - 2014-10-01 14:13 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-01-25 13:39 - 2014-10-01 14:13 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-01-25 10:33 - 2014-10-01 14:40 - 00000000 ____D () C:\Users\morpheus\Documents\my games
2015-01-23 19:57 - 2014-12-27 14:23 - 00000000 ____D () C:\Users\morpheus\AppData\Local\netz
2015-01-20 03:18 - 2014-10-01 13:50 - 00000000 ____D () C:\ProgramData\NVIDIA
2015-01-20 03:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-01-20 03:01 - 2014-10-01 13:37 - 01592628 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-01-15 03:01 - 2014-10-06 11:39 - 00000000 ____D () C:\Windows\system32\MRT
2015-01-15 03:00 - 2014-10-06 11:39 - 113365784 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-01-12 23:01 - 2014-10-04 09:48 - 00010398 _____ () C:\Windows\PFRO.log

Some content of TEMP:
====================
C:\Users\morpheus\AppData\Local\Temp\130672574034987469.exe
C:\Users\morpheus\AppData\Local\Temp\13067257410163128109.exe
C:\Users\morpheus\AppData\Local\Temp\i4jdel0.exe
C:\Users\morpheus\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\morpheus\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\morpheus\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\morpheus\AppData\Local\Temp\nvStInst.exe
C:\Users\morpheus\AppData\Local\Temp\qc_e3f0f3ef_27e6_4ca8_8a7c_a3d761aa54bb_64.exe
C:\Users\morpheus\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-01-24 00:04

==================== End Of Log ============================

addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-10-2014 02
Ran by morpheus at 2015-02-01 21:06:29
Running from C:\Users\morpheus\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Adobe Refresh Manager (x32 Version: 1.8.0 - Adobe Systems Incorporated) Hidden
Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)
Age of Empires® III: Complete Collection (HKLM-x32\...\Steam App 105450) (Version:  - Ensemble Studios)
Aliens vs. Predator (HKLM-x32\...\Steam App 10680) (Version:  - Rebellion)
Arma 3 (HKLM-x32\...\Steam App 107410) (Version:  - Bohemia Interactive)
Arma 3 Tools (HKLM-x32\...\Steam App 233800) (Version:  - Bohemia Interactive)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
CameraHelperMsi (x32 Version: 13.40.836.0 - Logitech) Hidden
Command and Conquer: Red Alert 3 (HKLM-x32\...\Steam App 17480) (Version:  - EA Los Angeles)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Epoch Launcher (HKCU\...\de6ddf4941177887) (Version: 0.0.1.12 - Epoch Mod Team)
erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version:  - Obsidian Entertainment)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
HP Deskjet 2540 series - Grundlegende Software für das Gerät (HKLM\...\{333E22D7-9F56-4482-A13C-1B9D35B9D641}) (Version: 32.2.188.47710 - Hewlett-Packard Co.)
Intel(R) Chipset Device Software (Version: 10.0.13 - Intel Corporation) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1204 - Intel Corporation)
Intel(R) Management Engine Components (Version: 10.0.0.1204 - Intel Corporation) Hidden
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3540 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.16 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
Java 7 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (HKLM-x32\...\5513-1208-7298-9440) (Version: 0.9 - AppWork GmbH)
Logitech Webcam-Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.40 - Logitech Inc.)
LWS Facebook (x32 Version: 13.31.1038.0 - Logitech) Hidden
LWS Gallery (x32 Version: 13.40.835.0 - Logitech) Hidden
LWS Help_main (x32 Version: 13.40.845.0 - Logitech) Hidden
LWS Launcher (x32 Version: 13.40.836.0 - Logitech) Hidden
LWS Motion Detection (x32 Version: 13.40.844.0 - Logitech) Hidden
LWS Pictures And Video (x32 Version: 13.40.844.0 - Logitech) Hidden
LWS Twitter (x32 Version: 13.30.1346.0 - Logitech) Hidden
LWS Video Mask Maker (x32 Version: 13.30.1379.0 - Logitech) Hidden
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
LWS Webcam Software (x32 Version: 13.31.1038.0 - Logitech) Hidden
LWS WLM Plugin (x32 Version: 1.30.1201.0 - Logitech) Hidden
LWS YouTube Plugin (x32 Version: 13.31.1038.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (Version: 4.5.51209 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (x32 Version: 11.0.60610 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
Mozilla Firefox 35.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 de)) (Version: 35.0.1 - Mozilla)
MySQL Workbench 6.2 CE (HKLM\...\{B632465A-857D-4FC2-A76E-B1F3693527D8}) (Version: 6.2.4 - Oracle Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.6.9 - Notepad++ Team)
NVIDIA 3D Vision Controller-Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.11 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.11 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.162.1274 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}) (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 344.11 (Version: 344.11 - NVIDIA Corporation) Hidden
Open Broadcaster Software (HKLM-x32\...\Open Broadcaster Software) (Version:  - )
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version:  - OVERKILL - a Starbreeze Studio.)
PAYDAY: The Heist (HKLM-x32\...\Steam App 24240) (Version:  - OVERKILL Software)
PBO Manager v.1.4 beta (HKLM\...\{127B5371-1802-4EDD-A25A-A43BF761D383}) (Version: 1.4.0 -  )
PuTTY version 0.63 (HKLM-x32\...\PuTTY_is1) (Version: 0.63 - Simon Tatham)
Qualcomm Atheros Bandwidth Control Filter Driver (Version: 1.0.30.1259 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer E220x Drivers (Version: 1.0.30.1259 - Qualcomm Atheros) Hidden
Qualcomm Atheros Killer Network Manager Suite (HKLM-x32\...\{FE5DFB80-6937-4154-A2C7-EF845C1301F8}) (Version: 1.0.30.1259 - Qualcomm Atheros)
Qualcomm Atheros Network Manager (Version: 1.0.30.1259 - Qualcomm Atheros) Hidden
RealLifeRPG (HKLM-x32\...\RealLifeRPG1.0) (Version: 1.0 - RealLifeRPG)
Robocraft (HKLM-x32\...\Steam App 301520) (Version:  - Freejam)
Samsung Magician (HKLM-x32\...\{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1) (Version: 4.4.0 - Samsung Electronics)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
Sound Blaster Recon3Di (HKLM-x32\...\{918F3CE9-7164-4C6D-9530-66F12EFB4585}) (Version: 1.03.00 - Creative Technology Limited)
Sound Blaster Recon3Di Extras (HKLM-x32\...\{536BDBFC-CA1A-4AC0-A8EB-BB2D0F1F522E}) (Version: 1.0 - Creative Technology Limited)
SourceTree (HKLM-x32\...\SourceTree 1.6.11) (Version: 1.6.11 - Atlassian)
SourceTree (x32 Version: 1.6.11 - Atlassian) Hidden
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
The Forest (HKLM-x32\...\Steam App 242760) (Version:  - Endnight Games Ltd)
Transformice (HKLM-x32\...\Steam App 335240) (Version:  - Atelier 801)
Tropico 5 (HKLM-x32\...\Steam App 245620) (Version:  - Haemimont Games)
Velvet Sundown (HKLM-x32\...\Steam App 307290) (Version:  - Tribe Studios)
War Thunder (HKLM-x32\...\Steam App 236390) (Version:  - Gaijin Entertainment)
WinSCP 5.5.6 (HKLM-x32\...\winscp3_is1) (Version: 5.5.6 - Martin Prikryl)
Worms Armageddon (HKLM-x32\...\Steam App 217200) (Version:  - Team17 Digital Ltd.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2650584954-4125578154-643085364-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)

==================== Restore Points  =========================

31-01-2015 02:28:33 Windows Update
01-02-2015 19:58:56 Removed 7-Zip 9.20 (x64 edition)

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2C4D8BBF-6505-4BCD-89CF-09BE8BFAD53B} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {36D928D9-829C-4DD5-B0C8-7EF10113FE2F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)
Task: {C3A33254-925B-4818-8E16-A80AB9A45241} - System32\Tasks\SamsungMagician => F:\Samsung Magician\Samsung Magician.exe [2014-05-19] (Samsung Electronics.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2014-10-01 13:49 - 2014-09-13 22:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2012-06-28 20:21 - 2012-06-28 20:21 - 00019456 _____ () F:\PBOmanager\PboShellExt.dll
2014-05-12 10:49 - 2014-05-12 10:49 - 00222720 _____ () F:\Notepad++\NppShell_06.dll
2013-08-08 13:30 - 2013-08-08 13:30 - 00283648 _____ () C:\Program Files\Qualcomm Atheros\Network Manager\NetworkManager.exe
2011-11-11 14:07 - 2011-11-11 14:07 - 00265240 _____ () F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe
2011-08-12 12:19 - 2011-08-12 12:19 - 00680984 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
2014-02-28 10:14 - 2014-02-28 10:14 - 00173568 _____ () F:\TS3\quazip.dll
2014-02-27 15:51 - 2014-02-27 15:51 - 01080832 _____ () F:\TS3\platforms\qwindows.dll
2014-02-27 15:51 - 2014-02-27 15:51 - 00833024 _____ () F:\TS3\sqldrivers\qsqlite.dll
2014-08-04 14:43 - 2014-08-04 14:43 - 00102344 _____ () F:\TS3\soundbackends\directsound_win64.dll
2014-08-04 14:43 - 2014-08-04 14:43 - 00108488 _____ () F:\TS3\soundbackends\windowsaudiosession_win64.dll
2014-02-27 15:51 - 2014-02-27 15:51 - 00030208 _____ () F:\TS3\imageformats\qgif.dll
2014-02-27 15:51 - 2014-02-27 15:51 - 00233984 _____ () F:\TS3\imageformats\qjpeg.dll
2014-08-04 14:46 - 2014-08-04 14:46 - 00563656 _____ () F:\TS3\plugins\clientquery_plugin.dll
2014-08-04 14:46 - 2014-08-04 14:46 - 00579016 _____ () F:\TS3\plugins\teamspeak_control_plugin.dll
2014-02-27 15:51 - 2014-02-27 15:51 - 00159232 _____ () F:\TS3\accessible\qtaccessiblewidgets.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 01260568 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\UMVPLMute.dll
2011-08-12 12:19 - 2011-08-12 12:19 - 00221208 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\FxPreview.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 01349656 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\MRSystem.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 00135192 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\MapTrackData.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 01323032 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\MMSystem.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 00294424 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\VMSystem.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 00053784 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\UMVPLMutePS.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 00054808 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\MRSystemPS.dll
2011-08-12 12:19 - 2011-08-12 12:19 - 00053784 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\FxPreviewPS.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 00053784 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\MMSysPS.dll
2011-08-12 12:20 - 2011-08-12 12:20 - 00053784 _____ () C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\VMSysPS.dll
2013-03-12 07:19 - 2013-03-12 07:19 - 00741376 _____ () C:\Program Files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\de-DE\SBRcni.resources.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 02145304 _____ () F:\Webcam\LWS\Webcam Software\QtCore4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 07956504 _____ () F:\Webcam\LWS\Webcam Software\QtGui4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00342552 _____ () F:\Webcam\LWS\Webcam Software\QtXml4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00029208 _____ () F:\Webcam\LWS\Webcam Software\imageformats\QGif4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00128536 _____ () F:\Webcam\LWS\Webcam Software\imageformats\QJpeg4.dll
2014-10-01 17:13 - 2014-05-06 10:24 - 00013824 _____ () F:\Samsung Magician\SAMSUNG_SSD.dll
2014-10-01 17:13 - 2014-05-19 19:20 - 00103424 _____ () F:\Samsung Magician\PAL.dll
2014-10-01 17:13 - 2014-05-19 19:20 - 00039424 _____ () F:\Samsung Magician\SATA.dll
2014-10-01 17:13 - 2014-05-19 19:19 - 00038400 _____ () F:\Samsung Magician\SAT.dll
2014-10-01 17:13 - 2014-05-19 19:20 - 00031232 _____ () F:\Samsung Magician\SMINI.dll
2014-10-01 17:13 - 2014-05-19 19:19 - 00029696 _____ () F:\Samsung Magician\SAS.dll
2011-12-12 15:44 - 2011-12-12 15:44 - 00336408 _____ () C:\Program Files (x86)\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 26065408 _____ () D:\Battle.net\Battle.net.5383\libcef.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00739840 _____ () D:\Battle.net\Battle.net.5383\libGLESv2.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00907776 _____ () D:\Battle.net\Battle.net.5383\platforms\qwindows.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00130048 _____ () D:\Battle.net\Battle.net.5383\libEGL.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00020992 _____ () D:\Battle.net\Battle.net.5383\imageformats\qgif.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00021504 _____ () D:\Battle.net\Battle.net.5383\imageformats\qico.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00205312 _____ () D:\Battle.net\Battle.net.5383\imageformats\qjpeg.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00225792 _____ () D:\Battle.net\Battle.net.5383\imageformats\qmng.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00015872 _____ () D:\Battle.net\Battle.net.5383\imageformats\qsvg.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00312832 _____ () D:\Battle.net\Battle.net.5383\imageformats\qtiff.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00010240 _____ () D:\Battle.net\Battle.net.5383\qml\QtQuick.2\qtquick2plugin.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00054272 _____ () D:\Battle.net\Battle.net.5383\qml\QtQuick\Layouts\qquicklayoutsplugin.dll
2014-12-10 19:49 - 2014-12-10 19:49 - 00010240 _____ () D:\Battle.net\Battle.net.5383\qml\QtQml\Models.2\modelsplugin.dll
2015-01-14 00:39 - 2015-01-14 00:39 - 16844464 ____N () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_257.dll
2014-10-01 14:04 - 2014-12-01 22:31 - 02396672 _____ () D:\Steam\libavcodec-56.dll
2014-10-01 14:04 - 2014-12-01 22:31 - 00442880 _____ () D:\Steam\libavutil-54.dll
2014-10-01 14:04 - 2014-12-01 22:31 - 00479744 _____ () D:\Steam\libavformat-56.dll
2014-10-01 14:04 - 2014-12-01 22:31 - 00332800 _____ () D:\Steam\libavresample-2.dll
2014-10-01 14:04 - 2014-11-11 19:47 - 00774656 _____ () D:\Steam\SDL2.dll
2015-01-20 13:35 - 2014-12-02 01:29 - 05002752 _____ () D:\Steam\v8.dll
2015-01-20 13:35 - 2014-12-02 01:29 - 01612800 _____ () D:\Steam\icui18n.dll
2015-01-20 13:35 - 2014-12-02 01:29 - 01210368 _____ () D:\Steam\icuuc.dll
2014-10-01 14:04 - 2015-01-19 19:49 - 02227904 _____ () D:\Steam\video.dll
2014-10-01 14:04 - 2014-12-01 22:31 - 00485888 _____ () D:\Steam\libswscale-3.dll
2014-10-01 14:04 - 2015-01-19 19:49 - 00696000 _____ () D:\Steam\bin\chromehtml.DLL
2015-01-20 13:35 - 2015-01-19 19:49 - 04567232 _____ () D:\Steam\bin\panorama\panorama.dll
2014-10-01 14:04 - 2015-01-19 19:49 - 00138432 _____ () D:\Steam\bin\audio.dll
2014-10-01 14:04 - 2014-11-11 19:48 - 00071680 _____ () D:\Steam\bin\mssmp3.asi
2014-10-01 14:04 - 2014-11-11 19:48 - 00153088 _____ () D:\Steam\bin\mssvoice.asi
2014-10-01 14:04 - 2015-01-16 00:42 - 34641288 _____ () D:\Steam\bin\libcef.dll
2014-10-01 14:04 - 2015-01-16 00:42 - 01709960 _____ () D:\Steam\bin\ffmpegsumo.dll
2014-10-01 14:07 - 2015-01-27 12:52 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2650584954-4125578154-643085364-500 - Administrator - Disabled)
Gast (S-1-5-21-2650584954-4125578154-643085364-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2650584954-4125578154-643085364-1002 - Limited - Enabled)
morpheus (S-1-5-21-2650584954-4125578154-643085364-1000 - Administrator - Enabled) => C:\Users\morpheus

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/01/2015 08:59:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x4858
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/01/2015 10:53:59 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x5e80
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/01/2015 10:52:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x5dac
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/01/2015 10:46:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x5d98
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/01/2015 10:45:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x44b8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (02/01/2015 10:44:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 35.0.1.5500, Zeitstempel: 0x54c1f9f3
Name des fehlerhaften Moduls: mozalloc.dll, Version: 35.0.1.5500, Zeitstempel: 0x54c1f224
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x26d8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (12/12/2014 09:35:26 PM) (Source: MsiInstaller) (EventID: 1024) (User: morpheus-PC)
Description: Produkt: Adobe Reader XI (11.0.09) - Deutsch - Update "{AC76BA86-7AD7-0000-2550-7A8C40011010}" konnte nicht installiert werden. Fehlercode 1625. Windows Installer kann Protokolle erstellen, um bei der Problembehandlung betreffend der Installation von Softwarepaketen behilflich zu sein. Verwenden Sie folgenden Link, um Anweisungen zur Aktivierung der Protokollierungsunterstützung zu erhalten: hxxp://go.microsoft.com/fwlink/?LinkId=23127

Error: (12/12/2014 08:07:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: UMVPFSrv.exe, Version: 13.40.840.0, Zeitstempel: 0x4ee983b7
Name des fehlerhaften Moduls: MRSystem.dll, Version: 13.30.1379.0, Zeitstempel: 0x4e457c65
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000f1a09
ID des fehlerhaften Prozesses: 0x15fc
Startzeit der fehlerhaften Anwendung: 0xUMVPFSrv.exe0
Pfad der fehlerhaften Anwendung: UMVPFSrv.exe1
Pfad des fehlerhaften Moduls: UMVPFSrv.exe2
Berichtskennung: UMVPFSrv.exe3

Error: (12/11/2014 00:11:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: arma3.exe, Version: 1.36.128.579, Zeitstempel: 0x5480321d
Name des fehlerhaften Moduls: arma3.exe, Version: 1.36.128.579, Zeitstempel: 0x5480321d
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00880e36
ID des fehlerhaften Prozesses: 0x19b4
Startzeit der fehlerhaften Anwendung: 0xarma3.exe0
Pfad der fehlerhaften Anwendung: arma3.exe1
Pfad des fehlerhaften Moduls: arma3.exe2
Berichtskennung: arma3.exe3

Error: (12/10/2014 11:50:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: arma3.exe, Version: 1.36.128.579, Zeitstempel: 0x5480321d
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x857833c0
ID des fehlerhaften Prozesses: 0x14dc
Startzeit der fehlerhaften Anwendung: 0xarma3.exe0
Pfad der fehlerhaften Anwendung: arma3.exe1
Pfad des fehlerhaften Moduls: arma3.exe2
Berichtskennung: arma3.exe3


System errors:
=============
Error: (02/01/2015 08:59:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Update ace race" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (02/01/2015 08:59:33 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Util ace race" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (01/27/2015 09:57:11 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (01/27/2015 09:57:11 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (01/27/2015 09:57:11 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 10. Der interne Fehlerstatus lautet: 10.

Error: (01/22/2015 10:37:09 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (01/22/2015 10:31:53 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Definitionsupdate für Microsoft Security Essentials – KB2310138 (Definition 1.191.3024.0)

Error: (01/22/2015 10:31:47 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 1.191.2930.0

	Aktualisierungsquelle: %NT-AUTORITÄT59

	Aktualisierungsphase: 4.6.0305.00

	Quellpfad: 4.6.0305.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\SYSTEM

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (01/22/2015 03:28:55 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 113.58.0.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.6.0305.00

	Quellpfad: 4.6.0305.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608

Error: (01/22/2015 03:28:50 AM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )
Description: Beim Aktualisieren der Signaturen wurde von %NT-AUTORITÄT60 ein Fehler festgestellt.

	Neue Signaturversion: 

	Vorherige Signaturversion: 1.191.2881.0

	Aktualisierungsquelle: %NT-AUTORITÄT51

	Aktualisierungsphase: 4.6.0305.00

	Quellpfad: 4.6.0305.01

	Signaturtyp: %NT-AUTORITÄT602

	Aktualisierungstyp: %NT-AUTORITÄT604

	Benutzer: NT-AUTORITÄT\NETZWERKDIENST

	Aktuelle Modulversion: %NT-AUTORITÄT605

	Vorherige Modulversion: %NT-AUTORITÄT606

	Fehlercode: %NT-AUTORITÄT607

	Fehlerbeschreibung: %NT-AUTORITÄT608


Microsoft Office Sessions:
=========================
Error: (02/01/2015 08:59:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f2248000000300001425485801d03e587a37ada3C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlld5f64c6e-aa4c-11e4-a429-74d435e62f1d

Error: (02/01/2015 10:53:59 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f22480000003000014255e8001d03e04dd7106f4C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll3db9b219-a9f8-11e4-a429-74d435e62f1d

Error: (02/01/2015 10:52:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f22480000003000014255dac01d03e0422fa0ee0C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll0f4f4d5c-a9f8-11e4-a429-74d435e62f1d

Error: (02/01/2015 10:46:00 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f22480000003000014255d9801d03e03e022a2e3C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll2054e050-a9f7-11e4-a429-74d435e62f1d

Error: (02/01/2015 10:45:44 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f224800000030000142544b801d03e03c1983228C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dll172f9618-a9f7-11e4-a429-74d435e62f1d

Error: (02/01/2015 10:44:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe35.0.1.550054c1f9f3mozalloc.dll35.0.1.550054c1f224800000030000142526d801d03e02e6ba8850C:\Program Files (x86)\Mozilla Firefox\plugin-container.exeC:\Program Files (x86)\Mozilla Firefox\mozalloc.dlleda4847f-a9f6-11e4-a429-74d435e62f1d

Error: (12/12/2014 09:35:26 PM) (Source: MsiInstaller) (EventID: 1024) (User: morpheus-PC)
Description: Adobe Reader XI (11.0.09) - Deutsch{AC76BA86-7AD7-0000-2550-7A8C40011010}1625(NULL)(NULL)(NULL)

Error: (12/12/2014 08:07:51 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: UMVPFSrv.exe13.40.840.04ee983b7MRSystem.dll13.30.1379.04e457c65c0000005000f1a0915fc01d0163b4232342dC:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exeC:\Program Files (x86)\Common Files\Logishrd\LQCVFX\MRSystem.dll2aa115f9-8232-11e4-a9ca-74d435e62f1d

Error: (12/11/2014 00:11:57 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: arma3.exe1.36.128.5795480321darma3.exe1.36.128.5795480321dc000000500880e3619b401d014cbbc5827caD:\Steam\steamapps\common\Arma 3\arma3.exeD:\Steam\steamapps\common\Arma 3\arma3.exeef6c959b-80c1-11e4-88c9-74d435e62f1d

Error: (12/10/2014 11:50:19 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: arma3.exe1.36.128.5795480321dunknown0.0.0.000000000c0000005857833c014dc01d014c6c30a3ee1D:\Steam\steamapps\common\Arma 3\arma3.exeunknowne9fdbdbf-80be-11e4-88c9-74d435e62f1d


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 44%
Total physical RAM: 8085.36 MB
Available physical RAM: 4448.83 MB
Total Pagefile: 16168.9 MB
Available Pagefile: 12320.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Windoof) (Fixed) (Total:59.5 GB) (Free:16.94 GB) NTFS
Drive d: (Games) (Fixed) (Total:232.76 GB) (Free:67.33 GB) NTFS
Drive e: (HP DJ2540) (CDROM) (Total:0.55 GB) (Free:0 GB) CDFS
Drive f: (Datengrab) (Fixed) (Total:931.51 GB) (Free:729.71 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 067DCE1C)
Partition 1: (Active) - (Size=931.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 59.6 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 232.9 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

der_kaeptn · 01.02.2015, 21:19

post ist zu lang, hier der rest:

gmer
[CODE]
GMER Logfile:

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-02-01 21:13:55
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\00000068 SAMSUNG_ rev.CXM0 59,63GB
Running: 2eyxgt1h.exe; Driver: C:\Users\morpheus\AppData\Local\Temp\fxtdqkoc.sys


---- User code sections - GMER 2.1 ----

.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                 0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                   0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                 0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                 0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                    0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                             0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                    0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                             0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                   0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                        0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                 0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                   0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                      0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                   0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                 0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                             0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\LWS.exe[2660] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                             0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                   0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                     0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                   0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                   0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                      0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                               0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                      0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                               0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                     0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                          0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                   0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                     0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                        0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                     0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                   0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                               0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    F:\Webcam\LWS\Webcam Software\CameraHelperShell.exe[3288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                               0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                   0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                     0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                   0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                   0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                      0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                               0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                      0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                               0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                     0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                          0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                   0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                     0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                        0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                     0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                   0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                               0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe[3384] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                               0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                          0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                            0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                          0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                          0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                             0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                      0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                             0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                      0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                            0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                 0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                          0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                            0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                               0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                            0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                          0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                      0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    D:\Battle.net\Battle.net.5383\Battle.net.exe[4360] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                      0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                                                                                                                    0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                                                                                                                      0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                                                                                                                                    0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                                                                                                                                    0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                                                                                                                       0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                                0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                                                                                                                       0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                                0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                                                                                                                      0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                                                                                                                           0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                                    0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                                                                                                                      0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                                                                                                         0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                                                                                                                      0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                                                                                                                    0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                                0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\Steam.exe[4516] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                                0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                                                                            0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                                                                              0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                                                                                            0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                                                                                            0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                                                                               0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                        0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                                                                               0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                        0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                                                                              0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                                                                                   0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                                                                            0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                                                                              0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                                                                 0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                                                                              0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                                                                            0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                                                                        0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3220] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                                                                        0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                       0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                         0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                       0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                       0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                          0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                   0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                          0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                   0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                         0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                              0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                       0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                         0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                            0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                         0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                       0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                   0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[7932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                   0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                      0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                        0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                      0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                      0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                         0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                  0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                         0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                  0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                        0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                             0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                      0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                        0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                           0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                        0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                      0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                  0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    D:\Steam\bin\steamwebhelper.exe[11912] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                  0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                 0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                   0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                 0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                 0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                    0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                             0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                    0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                             0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                   0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                        0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                 0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                   0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                      0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                   0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                 0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                             0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\Battle.net\Agent\Agent.3715\Agent.exe[21160] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                             0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                        0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                          0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                        0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                        0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                           0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                    0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                           0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                    0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                          0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                               0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                        0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                          0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                             0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                          0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                        0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                    0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[23940] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                    0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                       0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                         0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                       0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                       0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                          0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                   0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                          0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                   0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                         0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                              0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                       0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                         0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                            0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                         0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                       0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                   0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Java\jre7\bin\javaw.exe[22904] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                   0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                       0000000076bc1401 2 bytes JMP 7752b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                         0000000076bc1419 2 bytes JMP 7752b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                       0000000076bc1431 2 bytes JMP 775a8ea9 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                       0000000076bc144a 2 bytes CALL 775048ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                 * 9
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                          0000000076bc14dd 2 bytes JMP 775a87a2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                   0000000076bc14f5 2 bytes JMP 775a8978 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                          0000000076bc150d 2 bytes JMP 775a8698 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                   0000000076bc1525 2 bytes JMP 775a8a62 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                         0000000076bc153d 2 bytes JMP 7751fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                              0000000076bc1555 2 bytes JMP 775268ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                       0000000076bc156d 2 bytes JMP 775a8f61 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                         0000000076bc1585 2 bytes JMP 775a8ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                            0000000076bc159d 2 bytes JMP 775a865c C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                         0000000076bc15b5 2 bytes JMP 7751fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                       0000000076bc15cd 2 bytes JMP 7752b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                   0000000076bc16b2 2 bytes JMP 775a8e24 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\XTab\ProtectService.exe[16880] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                   0000000076bc16bd 2 bytes JMP 775a85f1 C:\Windows\syswow64\kernel32.dll
---- Processes - GMER 2.1 ----

Library  F:\7Zip\7-zip.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [1844]                                                                                                                                                             0000000003d90000
Process  C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [23940] (Windows SysTool  Service/SysTool PasSame LIMITED)(2015-02-01 09:46:27)  0000000000b60000

---- EOF - GMER 2.1 ----

--- --- ---

schrauber · 02.02.2015, 11:31

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

der_kaeptn · 02.02.2015, 13:28

hallo schrauber,

combofix

Code:

ATTFilter

ComboFix 15-02-02.01 - morpheus 02.02.2015  13:23:27.1.8 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8085.5063 [GMT 1:00]
ausgeführt von:: c:\users\morpheus\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
SP: Microsoft Security Essentials *Disabled/Updated* {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\tmp9674.tmp
c:\windows\SysWow64\tmp9711.tmp
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-01-02 bis 2015-02-02  ))))))))))))))))))))))))))))))
.
.
2015-02-02 12:25 . 2015-02-02 12:25	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-02-02 02:28 . 2014-12-02 10:26	11870360	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{934BA96C-EE29-42C5-909A-48F3C46BECFE}\mpengine.dll
2015-02-01 20:06 . 2015-02-01 20:06	--------	d-----w-	C:\FRST
2015-02-01 09:54 . 2015-01-31 18:25	48784	----a-w-	c:\windows\system32\drivers\{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64.sys
2015-02-01 09:47 . 2015-02-01 09:47	--------	d-----w-	c:\programdata\IHProtectUpDate
2015-02-01 09:46 . 2015-02-01 09:47	--------	d-----w-	c:\program files (x86)\XTab
2015-02-01 09:46 . 2015-02-01 09:46	--------	d-----w-	c:\programdata\WindowsMangerProtect
2015-02-01 09:46 . 2015-02-01 20:00	--------	d-----w-	c:\users\morpheus\AppData\Roaming\vi-view
2015-02-01 09:45 . 2015-02-01 09:45	--------	d-----w-	c:\program files (x86)\Common Files\Java
2015-02-01 09:45 . 2015-02-01 09:45	96168	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-02-01 09:45 . 2015-02-01 09:45	--------	d-----w-	c:\program files (x86)\Java
2015-02-01 02:28 . 2014-12-02 10:26	11870360	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-01-30 16:44 . 2015-01-30 16:44	--------	d-----w-	c:\users\morpheus\AppData\Roaming\steam.transformice.com
2015-01-22 21:31 . 2014-09-10 14:30	1188440	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{394C16BB-5C7A-46A3-8E8A-D9652D1B652F}\gapaengine.dll
2015-01-22 21:31 . 2014-09-10 14:30	1188440	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{9A2FB7D7-5102-4CD0-830E-B522173FC6ED}\gapaengine.dll
2015-01-21 18:33 . 2014-03-06 11:51	763912	------w-	c:\windows\system32\HPDiscoPMC211.dll
2015-01-21 18:33 . 2015-01-21 18:33	--------	d-----w-	c:\program files\HP
2015-01-21 18:33 . 2015-01-21 18:33	--------	d-----w-	c:\program files (x86)\HP
2015-01-21 18:29 . 2015-01-21 18:54	--------	d-----w-	c:\users\morpheus\AppData\Local\HP
2015-01-20 17:00 . 2015-01-20 17:00	--------	d-----w-	c:\users\morpheus\AppData\Local\Microsoft Games
2015-01-17 14:19 . 2015-01-27 11:52	73840	----a-w-	c:\program files (x86)\Mozilla Firefox\wow_helper.exe
2015-01-17 02:27 . 2014-09-10 14:30	1188440	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{F5E6D51A-2656-417C-B700-E5D4FAAD6547}\gapaengine.dll
2015-01-11 11:57 . 2015-01-21 18:33	--------	d-----w-	c:\programdata\HP
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-01 11:48 . 2014-12-06 09:52	129752	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-01-25 12:39 . 2014-10-01 13:13	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-01-25 12:39 . 2014-10-01 13:13	701616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-01-15 02:00 . 2014-10-06 10:39	113365784	----a-w-	c:\windows\system32\MRT.exe
2014-12-31 11:14 . 2014-10-01 13:04	298120	------w-	c:\windows\system32\MpSigStub.exe
2014-12-13 05:09 . 2014-12-18 08:09	144384	----a-w-	c:\windows\system32\ieUnatt.exe
2014-12-13 03:33 . 2014-12-18 08:09	115712	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2014-12-12 18:46 . 2014-12-12 18:46	53248	----a-r-	c:\users\morpheus\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2014-12-04 02:50 . 2014-12-10 01:55	413184	----a-w-	c:\windows\system32\generaltel.dll
2014-12-04 02:50 . 2014-12-10 01:55	741376	----a-w-	c:\windows\system32\invagent.dll
2014-12-04 02:50 . 2014-12-10 01:55	396800	----a-w-	c:\windows\system32\devinv.dll
2014-12-04 02:50 . 2014-12-10 01:55	830976	----a-w-	c:\windows\system32\appraiser.dll
2014-12-04 02:50 . 2014-12-10 01:55	227328	----a-w-	c:\windows\system32\aepdu.dll
2014-12-04 02:50 . 2014-12-10 01:55	192000	----a-w-	c:\windows\system32\aepic.dll
2014-12-04 02:44 . 2014-12-10 01:55	1083392	----a-w-	c:\windows\system32\aeinv.dll
2014-12-01 23:28 . 2014-12-10 01:55	1232040	----a-w-	c:\windows\system32\aitstatic.exe
2014-11-27 01:43 . 2014-12-10 02:08	389296	----a-w-	c:\windows\system32\iedkcs32.dll
2014-11-22 03:13 . 2014-12-10 02:08	25059840	----a-w-	c:\windows\system32\mshtml.dll
2014-11-22 03:06 . 2014-12-10 02:08	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-11-22 03:06 . 2014-12-10 02:08	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-11-22 02:50 . 2014-12-10 02:08	66560	----a-w-	c:\windows\system32\iesetup.dll
2014-11-22 02:50 . 2014-12-10 02:08	580096	----a-w-	c:\windows\system32\vbscript.dll
2014-11-22 02:49 . 2014-12-10 02:08	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-11-22 02:49 . 2014-12-10 02:08	2885120	----a-w-	c:\windows\system32\iertutil.dll
2014-11-22 02:48 . 2014-12-10 02:08	88064	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-11-22 02:41 . 2014-12-10 02:08	54784	----a-w-	c:\windows\system32\jsproxy.dll
2014-11-22 02:40 . 2014-12-10 02:08	34304	----a-w-	c:\windows\system32\iernonce.dll
2014-11-22 02:37 . 2014-12-10 02:08	633856	----a-w-	c:\windows\system32\ieui.dll
2014-11-22 02:35 . 2014-12-10 02:08	114688	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-11-22 02:34 . 2014-12-10 02:08	814080	----a-w-	c:\windows\system32\jscript9diag.dll
2014-11-22 02:34 . 2014-12-10 02:08	6039552	----a-w-	c:\windows\system32\jscript9.dll
2014-11-22 02:26 . 2014-12-10 02:08	968704	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-11-22 02:22 . 2014-12-10 02:08	490496	----a-w-	c:\windows\system32\dxtmsft.dll
2014-11-22 02:20 . 2014-12-10 02:08	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-11-22 02:14 . 2014-12-10 02:08	77824	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-22 02:09 . 2014-12-10 02:08	199680	----a-w-	c:\windows\system32\msrating.dll
2014-11-22 02:08 . 2014-12-10 02:08	92160	----a-w-	c:\windows\system32\mshtmled.dll
2014-11-22 02:07 . 2014-12-10 02:08	501248	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-11-22 02:07 . 2014-12-10 02:08	62464	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-11-22 02:06 . 2014-12-10 02:08	47616	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-11-22 02:05 . 2014-12-10 02:08	64000	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2014-11-22 02:05 . 2014-12-10 02:08	316928	----a-w-	c:\windows\system32\dxtrans.dll
2014-11-22 01:54 . 2014-12-10 02:08	620032	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-11-22 01:49 . 2014-12-10 02:08	718848	----a-w-	c:\windows\system32\ie4uinit.exe
2014-11-22 01:49 . 2014-12-10 02:08	800768	----a-w-	c:\windows\system32\msfeeds.dll
2014-11-22 01:47 . 2014-12-10 02:08	1359360	----a-w-	c:\windows\system32\mshtmlmedia.dll
2014-11-22 01:46 . 2014-12-10 02:08	2125312	----a-w-	c:\windows\system32\inetcpl.cpl
2014-11-22 01:43 . 2014-12-10 02:08	14412800	----a-w-	c:\windows\system32\ieframe.dll
2014-11-22 01:40 . 2014-12-10 02:08	60416	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-11-22 01:29 . 2014-12-10 02:08	4299264	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-11-22 01:28 . 2014-12-10 02:08	2358272	----a-w-	c:\windows\system32\wininet.dll
2014-11-22 01:22 . 2014-12-10 02:08	2052096	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-11-22 01:21 . 2014-12-10 02:08	1155072	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2014-11-22 01:15 . 2014-12-10 02:08	1548288	----a-w-	c:\windows\system32\urlmon.dll
2014-11-22 01:03 . 2014-12-10 02:08	800768	----a-w-	c:\windows\system32\ieapfltr.dll
2014-11-22 01:00 . 2014-12-10 02:08	1888256	----a-w-	c:\windows\SysWow64\wininet.dll
2014-11-21 05:14 . 2014-12-06 09:52	63704	----a-w-	c:\windows\system32\drivers\mwac.sys
2014-11-21 05:14 . 2014-12-06 09:52	93400	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-11-21 05:14 . 2014-12-06 09:52	25816	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-11-11 03:09 . 2014-12-10 01:54	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2014-11-11 03:08 . 2014-11-19 10:56	241152	----a-w-	c:\windows\system32\pku2u.dll
2014-11-11 03:08 . 2014-11-19 10:56	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-11-11 02:44 . 2014-12-10 01:54	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2014-11-11 02:44 . 2014-11-19 10:56	186880	----a-w-	c:\windows\SysWow64\pku2u.dll
2014-11-11 02:44 . 2014-11-19 10:56	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-11-11 01:46 . 2014-12-10 01:54	119296	----a-w-	c:\windows\system32\drivers\tdx.sys
2014-11-08 03:16 . 2014-12-10 01:49	2048	----a-w-	c:\windows\system32\tzres.dll
2014-11-08 02:45 . 2014-12-10 01:49	2048	----a-w-	c:\windows\SysWow64\tzres.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}]
2015-01-16 08:45	210096	----a-w-	c:\program files (x86)\XTab\SupTab.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112]
"Sound Blaster Recon3Di SBX Control Panel"="c:\program files (x86)\Creative\Sound Blaster Recon3Di\Sound Blaster Recon3Di Control Panel\SBRcni.exe" [2012-11-28 976896]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2014-02-21 292848]
"LWS"="f:\webcam\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\morpheus\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Samsung Magician.lnk - c:\windows\system32\schtasks.exe  /run /tn SamsungMagician [2014-10-3 285696]
Tintenwarnungen überwachen - HP Deskjet 2540 series.lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 2540 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN4BL572D20604;CONNECTION=USB;MONITOR=1; [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Killer Network Manager.lnk - c:\windows\Installer\{401FADAA-1C16-4721-9F02-19067E1A1CA8}\NetworkManager.exe_130C27D738F34C89BDDF21BCFD74B56D.exe -minimize [2014-10-1 72040]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;f:\skype\Updater\Updater.exe;f:\skype\Updater\Updater.exe [x]
R2 WindowsMangerProtect;WindowsMangerProtect Service;c:\programdata\WindowsMangerProtect\ProtectWindowsManager.exe;c:\programdata\WindowsMangerProtect\ProtectWindowsManager.exe [x]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R4 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 {ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64;{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64;c:\windows\system32\drivers\{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64.sys;c:\windows\SYSNATIVE\drivers\{ebf755a7-a244-4bc6-ac93-a366f9eccf49}Gw64.sys [x]
S1 BfLwf;Qualcomm Atheros Bandwidth Control;c:\windows\system32\DRIVERS\bflwfx64.sys;c:\windows\SYSNATIVE\DRIVERS\bflwfx64.sys [x]
S2 CtHdaSvc;SB Recon3D Service;c:\windows\sysWow64\CtHdaSvc.exe;c:\windows\sysWow64\CtHdaSvc.exe [x]
S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
S2 IHProtect Service;IHProtect Service;c:\program files (x86)\XTab\ProtectService.exe;c:\program files (x86)\XTab\ProtectService.exe [x]
S2 Qualcomm Atheros Killer Service V2;Qualcomm Atheros Killer Service V2;c:\program files\Qualcomm Atheros\Network Manager\KillerService.exe;c:\program files\Qualcomm Atheros\Network Manager\KillerService.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]
S3 cthda;SB Recon3D HDAudio;c:\windows\system32\drivers\cthda.sys;c:\windows\SYSNATIVE\drivers\cthda.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 Ke2200;NDIS Miniport Driver for the Killer e2200 PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\e22w7x64.sys;c:\windows\SYSNATIVE\DRIVERS\e22w7x64.sys [x]
S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]
S3 LVUVC64;Logitech HD Pro Webcam C920(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - FXTDQKOC
*NewlyCreated* - {EBF755A7-A244-4BC6-AC93-A366F9ECCF49}GW64
*Deregistered* - fxtdqkoc
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-10-01 12:39]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2014-08-22 1331288]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
mDefault_Search_URL = hxxp://myhome.vi-view.com/web/?type=ds&ts=1422783944&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&q={searchTerms}
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://myhome.vi-view.com/web/?type=ds&ts=1422783944&from=cor&uid=SAMSUNGXHD103SJ_S246J90Z842520&q={searchTerms}
TCP: DhcpNameServer = 192.168.2.1 192.168.2.1
FF - ProfilePath - c:\users\morpheus\AppData\Roaming\Mozilla\Firefox\Profiles\oe9stjl8.default-1413372178239\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-02-02  13:25:44
ComboFix-quarantined-files.txt  2015-02-02 12:25
.
Vor Suchlauf: 8 Verzeichnis(se), 18.994.102.272 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 19.051.110.400 Bytes frei
.
- - End Of File - - 40D8D2901C769FA63C1BEFA061722355
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 02.02.2015, 17:48

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

vi view anstatt google als startseite+ umleitung bei hyperlinks

Log-Analyse und Auswertung: vi view anstatt google als startseite+ umleitung bei hyperlinks

vi view anstatt google als startseite+ umleitung bei hyperlinks

vi view anstatt google als startseite+ umleitung bei hyperlinks

vi view anstatt google als startseite+ umleitung bei hyperlinks

vi view anstatt google als startseite+ umleitung bei hyperlinks

vi view anstatt google als startseite+ umleitung bei hyperlinks

Ähnliche Themen: vi view anstatt google als startseite+ umleitung bei hyperlinks