| |
| |||||||
Log-Analyse und Auswertung: Ads Positive Finds bei win7 - wie entfernen ?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
21.02.2015, 15:30
| #1 |
 |  Ads Positive Finds bei win7 - wie entfernen ?FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01 Ran by TJHHH (administrator) on TJHHH-PC on 21-02-2015 14:55:27 Running from C:\Users\TJHHH\Desktop Loaded Profiles: TJHHH (Available profiles: TJHHH) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7611608 2014-05-27] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation) HKLM-x32\...\Run: [SHIWebOnDiskManager] => C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [245760 2012-08-08] (SHI Elektronische Medien GmbH) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\MountPoints2: {6cc057ca-9b93-11e4-aefd-806e6f6e6963} - E:\Run.exe HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\MountPoints2: {cde2fc09-9c27-11e4-991a-806e6f6e6963} - E:\Start.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D1%26b%3D{browser}%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional SearchScopes: HKLM -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> DefaultScope {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = https://de.search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10048_swoc_campaign_150202__yaie&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com () FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com () FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2015-01-14] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.com/" CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll () CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Profile: C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-19] CHR Extension: (Kaspersky Protection) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-01-19] CHR Extension: (Google Wallet) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-15] CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-09] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [494864 2013-08-29] (Intel Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2015-01-14] (Kaspersky Lab ZAO) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2015-01-14] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2015-01-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-21] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) S3 gdrv; \??\C:\Windows\gdrv.sys [X] U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2015-02-22 10:39 - 2015-02-22 10:40 - 13087456 _____ (Microsoft Corporation) C:\Users\TJHHH\Downloads\Silverlight_x64.exe 2015-02-21 14:55 - 2015-02-21 14:55 - 00017226 _____ () C:\Users\TJHHH\Desktop\FRST.txt 2015-02-21 14:55 - 2015-02-21 14:55 - 00000000 ____D () C:\FRST 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64.exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64 (1).exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Desktop\FRST64.exe 2015-02-21 14:11 - 2015-02-21 14:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-21 14:11 - 2015-02-21 14:11 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-21 14:09 - 2015-02-21 14:11 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\TJHHH\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-19 20:57 - 2015-02-20 20:02 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:59 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:57 - 00001986 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00001980 _____ () C:\Users\Public\Desktop\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2015-02-19 20:47 - 2015-02-19 20:53 - 112861768 _____ (PokerStars) C:\Users\TJHHH\Downloads\PokerStarsInstallEU.exe 2015-02-19 19:53 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-19 19:53 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-17 18:23 - 2015-02-17 18:35 - 231012738 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\WinZip 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\WinZip 2015-02-17 18:17 - 2015-02-17 18:17 - 00002271 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00002265 _____ () C:\Users\Public\Desktop\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2015-02-17 18:16 - 2015-02-17 18:17 - 00000000 ____D () C:\Program Files\WinZip 2015-02-17 18:14 - 2015-02-17 18:14 - 00000000 ____D () C:\Program Files\File Association Helper 2015-02-17 18:13 - 2015-02-17 18:13 - 00881984 _____ ( ) C:\Users\TJHHH\Downloads\wz19-dl.exe 2015-02-17 18:11 - 2015-02-17 18:15 - 34208634 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar.crdownload 2015-02-13 15:35 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-13 15:35 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-12 18:59 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-12 18:59 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-12 18:59 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-12 18:59 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-12 18:59 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-02-12 18:59 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-12 18:59 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-12 18:59 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-02-12 18:59 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-12 18:59 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-02-12 18:59 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-12 18:59 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-12 18:59 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-12 18:59 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-12 18:59 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-12 18:59 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-12 18:59 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-12 18:59 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-12 18:59 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-12 18:59 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-02-12 18:58 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-12 18:58 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-12 18:58 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-12 18:58 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-12 18:56 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-12 18:56 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-12 18:56 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-12 18:56 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-12 18:56 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-12 18:56 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-12 18:56 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-12 18:56 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-12 18:56 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-12 18:56 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-12 18:56 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-12 18:56 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-12 18:56 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-12 18:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-12 18:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-12 18:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-12 18:56 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-12 18:56 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-12 18:56 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-12 18:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-12 18:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-12 18:56 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-12 18:56 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-12 18:56 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-12 18:56 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-12 18:56 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-04 12:39 - 2015-02-04 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2015-02-02 15:08 - 2015-02-02 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\TuneUp Software 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:50 - 00000000 ____D () C:\ProgramData\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2015-02-02 14:46 - 2015-02-02 14:47 - 00105808 _____ (GreenTree Applications SRL) C:\Users\TJHHH\Downloads\YTDSetup.exe 2015-02-02 14:36 - 2015-02-02 14:36 - 00005056 _____ () C:\Windows\SysWOW64\LavasoftTcpService.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\system32\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00000276 _____ () C:\prefs.js 2015-02-02 14:36 - 2015-02-02 14:36 - 00000000 ____D () C:\searchplugins 2015-02-02 14:36 - 2015-01-23 06:39 - 00378832 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll 2015-02-02 14:36 - 2015-01-23 06:39 - 00332216 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll 2015-02-02 14:34 - 2015-02-02 14:34 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\RHEng 2015-02-02 14:32 - 2015-02-02 15:15 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\DVDVideoSoft 2015-02-02 14:31 - 2015-02-02 14:32 - 03533008 _____ (DVDVideoSoft Ltd. ) C:\Users\TJHHH\Downloads\FreeYouTubeDownload.exe 2015-01-23 20:21 - 2015-01-23 20:21 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2015-01-23 20:21 - 2015-01-09 23:27 - 00621200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2015-01-23 20:20 - 2015-01-10 00:29 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2015-01-23 20:19 - 2015-01-13 05:15 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2015-01-23 20:19 - 2015-01-13 05:15 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-01-23 20:19 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00994712 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00877488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00164568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2015-01-23 19:57 - 2015-01-23 19:57 - 00001156 _____ () C:\Users\TJHHH\Downloads\150202ICEW.ics 2015-01-23 19:38 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2015-01-23 19:38 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-22 11:02 - 2015-01-14 20:43 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-21 14:33 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-21 14:33 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-21 14:23 - 2011-04-12 08:43 - 00700128 _____ () C:\Windows\system32\perfh007.dat 2015-02-21 14:23 - 2011-04-12 08:43 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2015-02-21 14:23 - 2009-07-14 06:13 - 01622694 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-21 14:21 - 2015-01-14 20:35 - 01330370 _____ () C:\Windows\WindowsUpdate.log 2015-02-21 14:18 - 2015-01-14 21:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2015-02-21 14:18 - 2015-01-14 20:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-21 14:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-21 14:18 - 2009-07-14 05:51 - 00041016 _____ () C:\Windows\setupact.log 2015-02-21 14:17 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-02-21 14:17 - 2010-11-21 04:47 - 00014846 _____ () C:\Windows\PFRO.log 2015-02-21 14:00 - 2015-01-14 20:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-20 13:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-19 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-14 20:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-13 03:19 - 2009-07-14 05:45 - 00411240 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-13 03:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-13 03:03 - 2015-01-19 13:19 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-13 03:02 - 2015-01-19 11:42 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-13 03:00 - 2015-01-19 11:42 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-09 19:55 - 2015-01-14 20:43 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-09 19:55 - 2015-01-14 20:43 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-02 15:08 - 2015-01-19 13:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2015-02-02 15:05 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2015-01-30 14:56 - 2015-01-14 20:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2015-01-23 20:21 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2015-01-23 20:21 - 2015-01-14 21:15 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2015-01-23 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports 2015-01-23 19:44 - 2015-01-19 19:43 - 00004096 _____ () C:\Users\Public\Documents\0000ACC2.LCS 2015-01-23 19:38 - 2015-01-14 21:02 - 00000000 ____D () C:\Program Files\NVIDIA Corporation ==================== Files in the root of some directories ======= 2015-01-14 20:48 - 2015-01-14 20:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Some content of TEMP: ==================== C:\Users\TJHHH\AppData\Local\Temp\DseShExt-x64.dll C:\Users\TJHHH\AppData\Local\Temp\DseShExt-x86.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVisionIePlugin.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVisionIePlugin64.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreaming.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreaming64.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreamingIePlugin.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreamingIePlugin64.dll C:\Users\TJHHH\AppData\Local\Temp\nvSCPAPI.dll C:\Users\TJHHH\AppData\Local\Temp\nvStInst.exe C:\Users\TJHHH\AppData\Local\Temp\ose00000.exe C:\Users\TJHHH\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\TJHHH\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\TJHHH\AppData\Local\Temp\SpOrder.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-13 03:00 ==================== End Of Log ============================ FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01 Ran by TJHHH (administrator) on TJHHH-PC on 21-02-2015 14:55:27 Running from C:\Users\TJHHH\Desktop Loaded Profiles: TJHHH (Available profiles: TJHHH) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7611608 2014-05-27] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation) HKLM-x32\...\Run: [SHIWebOnDiskManager] => C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [245760 2012-08-08] (SHI Elektronische Medien GmbH) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\MountPoints2: {6cc057ca-9b93-11e4-aefd-806e6f6e6963} - E:\Run.exe HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\MountPoints2: {cde2fc09-9c27-11e4-991a-806e6f6e6963} - E:\Start.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D1%26b%3D{browser}%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional SearchScopes: HKLM -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> DefaultScope {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = https://de.search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10048_swoc_campaign_150202__yaie&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com () FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com () FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2015-01-14] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.com/" CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll () CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Profile: C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-19] CHR Extension: (Kaspersky Protection) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-01-19] CHR Extension: (Google Wallet) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-15] CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-09] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [494864 2013-08-29] (Intel Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2015-01-14] (Kaspersky Lab ZAO) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2015-01-14] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2015-01-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-21] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) S3 gdrv; \??\C:\Windows\gdrv.sys [X] U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2015-02-22 10:39 - 2015-02-22 10:40 - 13087456 _____ (Microsoft Corporation) C:\Users\TJHHH\Downloads\Silverlight_x64.exe 2015-02-21 14:55 - 2015-02-21 14:55 - 00017226 _____ () C:\Users\TJHHH\Desktop\FRST.txt 2015-02-21 14:55 - 2015-02-21 14:55 - 00000000 ____D () C:\FRST 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64.exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64 (1).exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Desktop\FRST64.exe 2015-02-21 14:11 - 2015-02-21 14:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-21 14:11 - 2015-02-21 14:11 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-21 14:09 - 2015-02-21 14:11 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\TJHHH\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-19 20:57 - 2015-02-20 20:02 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:59 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:57 - 00001986 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00001980 _____ () C:\Users\Public\Desktop\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2015-02-19 20:47 - 2015-02-19 20:53 - 112861768 _____ (PokerStars) C:\Users\TJHHH\Downloads\PokerStarsInstallEU.exe 2015-02-19 19:53 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-19 19:53 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-17 18:23 - 2015-02-17 18:35 - 231012738 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\WinZip 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\WinZip 2015-02-17 18:17 - 2015-02-17 18:17 - 00002271 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00002265 _____ () C:\Users\Public\Desktop\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2015-02-17 18:16 - 2015-02-17 18:17 - 00000000 ____D () C:\Program Files\WinZip 2015-02-17 18:14 - 2015-02-17 18:14 - 00000000 ____D () C:\Program Files\File Association Helper 2015-02-17 18:13 - 2015-02-17 18:13 - 00881984 _____ ( ) C:\Users\TJHHH\Downloads\wz19-dl.exe 2015-02-17 18:11 - 2015-02-17 18:15 - 34208634 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar.crdownload 2015-02-13 15:35 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-13 15:35 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-12 18:59 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-12 18:59 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-12 18:59 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-12 18:59 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-12 18:59 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-02-12 18:59 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-12 18:59 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-12 18:59 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-02-12 18:59 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-12 18:59 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-02-12 18:59 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-12 18:59 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-12 18:59 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-12 18:59 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-12 18:59 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-12 18:59 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-12 18:59 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-12 18:59 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-12 18:59 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-12 18:59 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-02-12 18:58 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-12 18:58 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-12 18:58 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-12 18:58 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-12 18:56 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-12 18:56 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-12 18:56 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-12 18:56 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-12 18:56 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-12 18:56 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-12 18:56 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-12 18:56 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-12 18:56 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-12 18:56 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-12 18:56 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-12 18:56 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-12 18:56 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-12 18:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-12 18:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-12 18:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-12 18:56 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-12 18:56 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-12 18:56 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-12 18:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-12 18:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-12 18:56 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-12 18:56 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-12 18:56 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-12 18:56 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-12 18:56 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-04 12:39 - 2015-02-04 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2015-02-02 15:08 - 2015-02-02 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\TuneUp Software 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:50 - 00000000 ____D () C:\ProgramData\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2015-02-02 14:46 - 2015-02-02 14:47 - 00105808 _____ (GreenTree Applications SRL) C:\Users\TJHHH\Downloads\YTDSetup.exe 2015-02-02 14:36 - 2015-02-02 14:36 - 00005056 _____ () C:\Windows\SysWOW64\LavasoftTcpService.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\system32\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00000276 _____ () C:\prefs.js 2015-02-02 14:36 - 2015-02-02 14:36 - 00000000 ____D () C:\searchplugins 2015-02-02 14:36 - 2015-01-23 06:39 - 00378832 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll 2015-02-02 14:36 - 2015-01-23 06:39 - 00332216 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll 2015-02-02 14:34 - 2015-02-02 14:34 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\RHEng 2015-02-02 14:32 - 2015-02-02 15:15 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\DVDVideoSoft 2015-02-02 14:31 - 2015-02-02 14:32 - 03533008 _____ (DVDVideoSoft Ltd. ) C:\Users\TJHHH\Downloads\FreeYouTubeDownload.exe 2015-01-23 20:21 - 2015-01-23 20:21 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2015-01-23 20:21 - 2015-01-09 23:27 - 00621200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2015-01-23 20:20 - 2015-01-10 00:29 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2015-01-23 20:19 - 2015-01-13 05:15 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2015-01-23 20:19 - 2015-01-13 05:15 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-01-23 20:19 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00994712 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00877488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00164568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2015-01-23 19:57 - 2015-01-23 19:57 - 00001156 _____ () C:\Users\TJHHH\Downloads\150202ICEW.ics 2015-01-23 19:38 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2015-01-23 19:38 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-22 11:02 - 2015-01-14 20:43 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-21 14:33 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-21 14:33 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-21 14:23 - 2011-04-12 08:43 - 00700128 _____ () C:\Windows\system32\perfh007.dat 2015-02-21 14:23 - 2011-04-12 08:43 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2015-02-21 14:23 - 2009-07-14 06:13 - 01622694 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-21 14:21 - 2015-01-14 20:35 - 01330370 _____ () C:\Windows\WindowsUpdate.log 2015-02-21 14:18 - 2015-01-14 21:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2015-02-21 14:18 - 2015-01-14 20:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-21 14:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-21 14:18 - 2009-07-14 05:51 - 00041016 _____ () C:\Windows\setupact.log 2015-02-21 14:17 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-02-21 14:17 - 2010-11-21 04:47 - 00014846 _____ () C:\Windows\PFRO.log 2015-02-21 14:00 - 2015-01-14 20:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-20 13:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-19 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-14 20:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-13 03:19 - 2009-07-14 05:45 - 00411240 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-13 03:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-13 03:03 - 2015-01-19 13:19 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-13 03:02 - 2015-01-19 11:42 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-13 03:00 - 2015-01-19 11:42 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-09 19:55 - 2015-01-14 20:43 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-09 19:55 - 2015-01-14 20:43 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-02 15:08 - 2015-01-19 13:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2015-02-02 15:05 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2015-01-30 14:56 - 2015-01-14 20:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2015-01-23 20:21 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2015-01-23 20:21 - 2015-01-14 21:15 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2015-01-23 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports 2015-01-23 19:44 - 2015-01-19 19:43 - 00004096 _____ () C:\Users\Public\Documents\0000ACC2.LCS 2015-01-23 19:38 - 2015-01-14 21:02 - 00000000 ____D () C:\Program Files\NVIDIA Corporation ==================== Files in the root of some directories ======= 2015-01-14 20:48 - 2015-01-14 20:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Some content of TEMP: ==================== C:\Users\TJHHH\AppData\Local\Temp\DseShExt-x64.dll C:\Users\TJHHH\AppData\Local\Temp\DseShExt-x86.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVisionIePlugin.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVisionIePlugin64.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreaming.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreaming64.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreamingIePlugin.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreamingIePlugin64.dll C:\Users\TJHHH\AppData\Local\Temp\nvSCPAPI.dll C:\Users\TJHHH\AppData\Local\Temp\nvStInst.exe C:\Users\TJHHH\AppData\Local\Temp\ose00000.exe C:\Users\TJHHH\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\TJHHH\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\TJHHH\AppData\Local\Temp\SpOrder.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-13 03:00 ==================== End Of Log ============================ --- --- --- |
|
21.02.2015, 15:33
| #2 |
| | Ads Positive Finds bei win7 - wie entfernen ? FRST Logfile:
__________________FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01 Ran by TJHHH (administrator) on TJHHH-PC on 21-02-2015 14:55:27 Running from C:\Users\TJHHH\Desktop Loaded Profiles: TJHHH (Available profiles: TJHHH) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7611608 2014-05-27] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation) HKLM-x32\...\Run: [SHIWebOnDiskManager] => C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [245760 2012-08-08] (SHI Elektronische Medien GmbH) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\Run: [Web Companion] => C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe --minimize HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\MountPoints2: {6cc057ca-9b93-11e4-aefd-806e6f6e6963} - E:\Run.exe HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\...\MountPoints2: {cde2fc09-9c27-11e4-991a-806e6f6e6963} - E:\Start.exe ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D1%26b%3D{browser}%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional SearchScopes: HKLM -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> DefaultScope {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = https://de.search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10048_swoc_campaign_150202__yaie&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 StartMenuInternet: IEXPLORE.EXE - iexplore.exe FireFox: ======== FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com () FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com () FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2015-01-14] Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.com/" CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll () CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No File CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll () CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) CHR Profile: C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-19] CHR Extension: (Kaspersky Protection) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-01-19] CHR Extension: (Google Wallet) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-01-15] CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-09] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [494864 2013-08-29] (Intel Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2015-01-14] (Kaspersky Lab ZAO) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2015-01-14] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2015-01-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-21] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) S3 gdrv; \??\C:\Windows\gdrv.sys [X] U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2015-02-22 10:39 - 2015-02-22 10:40 - 13087456 _____ (Microsoft Corporation) C:\Users\TJHHH\Downloads\Silverlight_x64.exe 2015-02-21 14:55 - 2015-02-21 14:55 - 00017226 _____ () C:\Users\TJHHH\Desktop\FRST.txt 2015-02-21 14:55 - 2015-02-21 14:55 - 00000000 ____D () C:\FRST 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64.exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64 (1).exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Desktop\FRST64.exe 2015-02-21 14:11 - 2015-02-21 14:18 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-21 14:11 - 2015-02-21 14:11 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-21 14:09 - 2015-02-21 14:11 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\TJHHH\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-19 20:57 - 2015-02-20 20:02 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:59 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:57 - 00001986 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00001980 _____ () C:\Users\Public\Desktop\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2015-02-19 20:47 - 2015-02-19 20:53 - 112861768 _____ (PokerStars) C:\Users\TJHHH\Downloads\PokerStarsInstallEU.exe 2015-02-19 19:53 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-19 19:53 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-17 18:23 - 2015-02-17 18:35 - 231012738 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\WinZip 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\WinZip 2015-02-17 18:17 - 2015-02-17 18:17 - 00002271 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00002265 _____ () C:\Users\Public\Desktop\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2015-02-17 18:16 - 2015-02-17 18:17 - 00000000 ____D () C:\Program Files\WinZip 2015-02-17 18:14 - 2015-02-17 18:14 - 00000000 ____D () C:\Program Files\File Association Helper 2015-02-17 18:13 - 2015-02-17 18:13 - 00881984 _____ ( ) C:\Users\TJHHH\Downloads\wz19-dl.exe 2015-02-17 18:11 - 2015-02-17 18:15 - 34208634 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar.crdownload 2015-02-13 15:35 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-13 15:35 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-12 18:59 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-12 18:59 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-12 18:59 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-12 18:59 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-12 18:59 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-02-12 18:59 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-12 18:59 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-12 18:59 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-02-12 18:59 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-12 18:59 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-02-12 18:59 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-12 18:59 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-12 18:59 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-12 18:59 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-12 18:59 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-12 18:59 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-12 18:59 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-12 18:59 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-12 18:59 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-12 18:59 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-02-12 18:58 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-12 18:58 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-12 18:58 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-12 18:58 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-12 18:56 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-12 18:56 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-12 18:56 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-12 18:56 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-12 18:56 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-12 18:56 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-12 18:56 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-12 18:56 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-12 18:56 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-12 18:56 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-12 18:56 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-12 18:56 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-12 18:56 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-12 18:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-12 18:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-12 18:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-12 18:56 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-12 18:56 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-12 18:56 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-12 18:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-12 18:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-12 18:56 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-12 18:56 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-12 18:56 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-12 18:56 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-12 18:56 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-04 12:39 - 2015-02-04 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2015-02-02 15:08 - 2015-02-02 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\TuneUp Software 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:50 - 00000000 ____D () C:\ProgramData\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2015-02-02 14:46 - 2015-02-02 14:47 - 00105808 _____ (GreenTree Applications SRL) C:\Users\TJHHH\Downloads\YTDSetup.exe 2015-02-02 14:36 - 2015-02-02 14:36 - 00005056 _____ () C:\Windows\SysWOW64\LavasoftTcpService.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\system32\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00000276 _____ () C:\prefs.js 2015-02-02 14:36 - 2015-02-02 14:36 - 00000000 ____D () C:\searchplugins 2015-02-02 14:36 - 2015-01-23 06:39 - 00378832 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll 2015-02-02 14:36 - 2015-01-23 06:39 - 00332216 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll 2015-02-02 14:34 - 2015-02-02 14:34 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\RHEng 2015-02-02 14:32 - 2015-02-02 15:15 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\DVDVideoSoft 2015-02-02 14:31 - 2015-02-02 14:32 - 03533008 _____ (DVDVideoSoft Ltd. ) C:\Users\TJHHH\Downloads\FreeYouTubeDownload.exe 2015-01-23 20:21 - 2015-01-23 20:21 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies 2015-01-23 20:21 - 2015-01-09 23:27 - 00621200 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe 2015-01-23 20:20 - 2015-01-10 00:29 - 02558608 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll 2015-01-23 20:19 - 2015-01-13 05:15 - 00195728 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys 2015-01-23 20:19 - 2015-01-13 05:15 - 00030536 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 32102544 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 25459856 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 24765584 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 20465296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 17250776 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 13295552 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 13210248 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10774544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10714488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 10274448 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys 2015-01-23 20:19 - 2015-01-10 09:07 - 03607184 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 03245712 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 01895240 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434725.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 01556808 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434725.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00994712 _____ (NVIDIA Corporation) C:\Windows\system32\nvumdshimx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00969360 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00942736 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00929424 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00906384 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00877488 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvumdshim.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00496456 _____ (NVIDIA Corporation) C:\Windows\system32\nvEncodeAPI64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00399688 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvEncodeAPI.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00390472 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00353040 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglshim64.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00345744 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00305320 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglshim32.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00177624 _____ (NVIDIA Corporation) C:\Windows\system32\nvinitx.dll 2015-01-23 20:19 - 2015-01-10 09:07 - 00164568 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvinit.dll 2015-01-23 19:57 - 2015-01-23 19:57 - 00001156 _____ () C:\Users\TJHHH\Downloads\150202ICEW.ics 2015-01-23 19:38 - 2014-11-22 11:46 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys 2015-01-23 19:38 - 2014-11-22 11:46 - 00032400 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-22 11:02 - 2015-01-14 20:43 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-21 14:33 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-21 14:33 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-21 14:23 - 2011-04-12 08:43 - 00700128 _____ () C:\Windows\system32\perfh007.dat 2015-02-21 14:23 - 2011-04-12 08:43 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2015-02-21 14:23 - 2009-07-14 06:13 - 01622694 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-21 14:21 - 2015-01-14 20:35 - 01330370 _____ () C:\Windows\WindowsUpdate.log 2015-02-21 14:18 - 2015-01-14 21:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2015-02-21 14:18 - 2015-01-14 20:43 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-21 14:18 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-21 14:18 - 2009-07-14 05:51 - 00041016 _____ () C:\Windows\setupact.log 2015-02-21 14:17 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-02-21 14:17 - 2010-11-21 04:47 - 00014846 _____ () C:\Windows\PFRO.log 2015-02-21 14:00 - 2015-01-14 20:43 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-20 13:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-19 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-14 20:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-13 03:19 - 2009-07-14 05:45 - 00411240 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-13 03:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-13 03:03 - 2015-01-19 13:19 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-13 03:02 - 2015-01-19 11:42 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-13 03:00 - 2015-01-19 11:42 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-09 19:55 - 2015-01-14 20:43 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-09 19:55 - 2015-01-14 20:43 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-02 15:08 - 2015-01-19 13:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2015-02-02 15:05 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2015-01-30 14:56 - 2015-01-14 20:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2015-01-23 20:21 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation 2015-01-23 20:21 - 2015-01-14 21:15 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation 2015-01-23 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\LiveKernelReports 2015-01-23 19:44 - 2015-01-19 19:43 - 00004096 _____ () C:\Users\Public\Documents\0000ACC2.LCS 2015-01-23 19:38 - 2015-01-14 21:02 - 00000000 ____D () C:\Program Files\NVIDIA Corporation ==================== Files in the root of some directories ======= 2015-01-14 20:48 - 2015-01-14 20:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl Some content of TEMP: ==================== C:\Users\TJHHH\AppData\Local\Temp\DseShExt-x64.dll C:\Users\TJHHH\AppData\Local\Temp\DseShExt-x86.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVisionIePlugin.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVisionIePlugin64.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreaming.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreaming64.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreamingIePlugin.dll C:\Users\TJHHH\AppData\Local\Temp\Nv3DVStreamingIePlugin64.dll C:\Users\TJHHH\AppData\Local\Temp\nvSCPAPI.dll C:\Users\TJHHH\AppData\Local\Temp\nvStInst.exe C:\Users\TJHHH\AppData\Local\Temp\ose00000.exe C:\Users\TJHHH\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\TJHHH\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\TJHHH\AppData\Local\Temp\SpOrder.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-13 03:00 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01
Ran by TJHHH at 2015-02-21 14:55:38
Running from C:\Users\TJHHH\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Canon MG4100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4100_series) (Version: - )
File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Drive (HKLM-x32\...\{65EACBB4-B0B8-4A5B-AE46-22DBE15C70B5}) (Version: 1.19.8406.6504 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1204 - Intel Corporation)
Intel(R) Network Connections 18.8.136.0 (HKLM\...\PROSetDX) (Version: 18.8.136.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3540 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.0.3.1001 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.16 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}) (Version: 15.0.1.415 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.1.415 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.25 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version: - PokerStars.eu)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7256 - Realtek Semiconductor Corp.)
Rudolf Müller Verlag Deutsches Dachdeckerhandwerk - Rege 5.5 (HKLM-x32\...\RUDOLF M_LLER VERLAG DEUTSCHES DACHDECKERHANDWERK _ REGE 5_5) (Version: 5.5 - Rudolf Müller Verlag)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
WinZip 19.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E7}) (Version: 19.0.11294 - WinZip Computing, S.L. )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
02-02-2015 15:16:26 LavasoftWeCompanion
02-02-2015 15:17:05 TuneUp Utilities 2014 wird entfernt
02-02-2015 15:17:18 TuneUp Utilities 2014 (de-DE) wird entfernt
04-02-2015 12:54:23 Windows Update
09-02-2015 17:05:02 Windows Update
13-02-2015 03:00:24 Windows Update
14-02-2015 03:00:18 Windows Update
19-02-2015 19:53:55 Windows Update
19-02-2015 21:53:19 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {56B76397-198F-4B90-AB07-46D02E23BB89} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14] (Google Inc.)
Task: {925CCB8E-DC2B-412D-B860-481359CF0782} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C1752237-56B9-43E1-84C0-B80FAAA7F4B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-01-14 21:15 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-08-30 17:12 - 2014-08-30 17:12 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\kpcengine.2.3.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 14965064 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\TJHHH\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-2831150185-3866919313-2850936559-500 - Administrator - Disabled)
Gast (S-1-5-21-2831150185-3866919313-2850936559-501 - Limited - Disabled)
TJHHH (S-1-5-21-2831150185-3866919313-2850936559-1000 - Administrator - Enabled) => C:\Users\TJHHH
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/21/2015 02:19:52 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/22/2015 10:07:45 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/20/2015 01:11:22 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/19/2015 07:51:08 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/19/2015 06:46:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/17/2015 05:47:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/16/2015 09:37:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/15/2015 11:12:45 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/15/2015 11:04:29 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/15/2015 10:54:46 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (02/22/2015 10:09:12 AM) (Source: Microsoft-Windows-Time-Service) (EventID: 34) (User: NT-AUTORITÄT)
Description: Der Zeitdienst hat festgestellt, dass die Systemzeit um -86443 Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal 54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone richtig sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->134.170.185.211:123) ordnungsgemäß ausgeführt wird.
Error: (02/19/2015 06:44:39 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 18.02.2015 um 06:49:33 unerwartet heruntergefahren.
Error: (02/16/2015 08:01:10 PM) (Source: Microsoft-Windows-Time-Service) (EventID: 34) (User: NT-AUTORITÄT)
Description: Der Zeitdienst hat festgestellt, dass die Systemzeit um -86450 Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal 54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone richtig sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->134.170.185.211:123) ordnungsgemäß ausgeführt wird.
Error: (02/15/2015 11:15:12 AM) (Source: Microsoft-Windows-Time-Service) (EventID: 34) (User: NT-AUTORITÄT)
Description: Der Zeitdienst hat festgestellt, dass die Systemzeit um -86451 Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal 54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone richtig sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->134.170.185.211:123) ordnungsgemäß ausgeführt wird.
Error: (02/13/2015 03:20:17 AM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst AVP15.0.1 erreicht.
Error: (02/10/2015 03:49:39 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Kaspersky Anti-Virus Service 15.0.1" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 10000 Millisekunden durchgeführt: Neustart des Diensts.
Error: (02/09/2015 05:04:09 PM) (Source: Microsoft-Windows-Time-Service) (EventID: 34) (User: NT-AUTORITÄT)
Description: Der Zeitdienst hat festgestellt, dass die Systemzeit um -86458 Sekunden geändert werden muss. Die Systemzeit kann durch den Zeitdienst um maximal 54000 Sekunden geändert werden. Stellen Sie sicher, dass die Uhrzeit und Zeitzone richtig sind und dass die Zeitquelle time.windows.com,0x9 (ntp.m|0x9|0.0.0.0:123->134.170.185.211:123) ordnungsgemäß ausgeführt wird.
Error: (02/02/2015 09:09:16 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (02/02/2015 09:09:15 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.
Error: (02/02/2015 03:16:42 PM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "LavasoftTcpService" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2015-02-14 03:01:26.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:01:26.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:00:41.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:00:41.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-23 19:37:08.733
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-23 19:37:08.655
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:15.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:15.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:03.054
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:03.054
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 28%
Total physical RAM: 8056.85 MB
Available physical RAM: 5800.71 MB
Total Pagefile: 16111.89 MB
Available Pagefile: 13284.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:117.38 GB) (Free:69.98 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.41 GB) (Free:930.9 GB) NTFS
Drive e: (ELS_Tobi) (CDROM) (Total:0.21 GB) (Free:0 GB) CDFS
Drive g: (INTENSO) (Fixed) (Total:465.65 GB) (Free:447.25 GB) FAT32
Drive h: () (Fixed) (Total:465.76 GB) (Free:450.66 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 7A1BDDB8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 117.4 GB) (Disk ID: 7A1BDDA0)
Partition 1: (Not Active) - (Size=117.4 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 44AEB7EB)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=0C)
========================================================
Disk: 4 (Size: 465.8 GB) (Disk ID: 3DF9EC21)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
21.02.2015, 15:51
| #3 |
| | Ads Positive Finds bei win7 - wie entfernen ?Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-02-21 15:16:21 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\00000075 SanDisk_ rev.3.2. 117,38GB Running: Gmer-19357.exe; Driver: C:\Users\TJHHH\AppData\Local\Temp\fgloipow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe[1428] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 000000007732faa8 5 bytes JMP 0000000172812e30 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe[1428] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077330038 5 bytes JMP 0000000172812df0 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075f81401 2 bytes JMP 74d7b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075f81419 2 bytes JMP 74d7b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075f81431 2 bytes JMP 74df8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075f8144a 2 bytes CALL 74d548ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075f814dd 2 bytes JMP 74df87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075f814f5 2 bytes JMP 74df8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075f8150d 2 bytes JMP 74df8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075f81525 2 bytes JMP 74df8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075f8153d 2 bytes JMP 74d6fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075f81555 2 bytes JMP 74d768ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075f8156d 2 bytes JMP 74df8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075f81585 2 bytes JMP 74df8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075f8159d 2 bytes JMP 74df865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075f815b5 2 bytes JMP 74d6fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075f815cd 2 bytes JMP 74d7b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075f816b2 2 bytes JMP 74df8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe[2144] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075f816bd 2 bytes JMP 74df85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075f81401 2 bytes JMP 74d7b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075f81419 2 bytes JMP 74d7b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075f81431 2 bytes JMP 74df8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075f8144a 2 bytes CALL 74d548ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075f814dd 2 bytes JMP 74df87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075f814f5 2 bytes JMP 74df8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075f8150d 2 bytes JMP 74df8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075f81525 2 bytes JMP 74df8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075f8153d 2 bytes JMP 74d6fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075f81555 2 bytes JMP 74d768ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075f8156d 2 bytes JMP 74df8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075f81585 2 bytes JMP 74df8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075f8159d 2 bytes JMP 74df865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075f815b5 2 bytes JMP 74d6fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075f815cd 2 bytes JMP 74d7b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075f816b2 2 bytes JMP 74df8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe[2240] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075f816bd 2 bytes JMP 74df85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075f81401 2 bytes JMP 74d7b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075f81419 2 bytes JMP 74d7b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075f81431 2 bytes JMP 74df8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075f8144a 2 bytes CALL 74d548ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075f814dd 2 bytes JMP 74df87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075f814f5 2 bytes JMP 74df8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075f8150d 2 bytes JMP 74df8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075f81525 2 bytes JMP 74df8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075f8153d 2 bytes JMP 74d6fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075f81555 2 bytes JMP 74d768ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075f8156d 2 bytes JMP 74df8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075f81585 2 bytes JMP 74df8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075f8159d 2 bytes JMP 74df865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075f815b5 2 bytes JMP 74d6fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075f815cd 2 bytes JMP 74d7b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075f816b2 2 bytes JMP 74df8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[2408] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075f816bd 2 bytes JMP 74df85f1 C:\Windows\syswow64\kernel32.dll ? C:\Windows\system32\mssprxy.dll [2408] entry point in ".rdata" section 0000000072ed71e6 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5600] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5188] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, FF, 00, 00, 00, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes JMP 3f3f3f3f .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5904] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes {JMP QWORD [RIP-0x4a220]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes {JMP QWORD [RIP-0x49cef]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes {JMP QWORD [RIP-0x4ac62]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes {JMP QWORD [RIP-0x4a80f]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes {JMP QWORD [RIP-0x4adda]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes {JMP QWORD [RIP-0x49edf]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes {JMP QWORD [RIP-0x4a1b5]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes {JMP QWORD [RIP-0x4ab13]} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Windows\SysWOW64\cmd.exe[5924] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes {JMP QWORD [RIP-0x4a220]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes {JMP QWORD [RIP-0x49cef]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes {JMP QWORD [RIP-0x4ac62]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes {JMP QWORD [RIP-0x4a80f]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes {JMP QWORD [RIP-0x4adda]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes {JMP QWORD [RIP-0x49edf]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes {JMP QWORD [RIP-0x4a1b5]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes {JMP QWORD [RIP-0x4ab13]} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0} .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\plugin-nm-server.exe[4668] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 2 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...] .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes {JMP QWORD [RIP-0x4a220]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes {JMP QWORD [RIP-0x49cef]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes {JMP QWORD [RIP-0x4ac62]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes {JMP QWORD [RIP-0x4a80f]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes {JMP QWORD [RIP-0x4adda]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes {JMP QWORD [RIP-0x49edf]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes {JMP QWORD [RIP-0x4a1b5]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes {JMP QWORD [RIP-0x4ab13]} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] teil1 |
|
21.02.2015, 16:52
| #4 |
| | Ads Positive Finds bei win7 - wie entfernen ? Teil2 Code:
ATTFilter .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes {JMP QWORD [RIP-0x4adda]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes {JMP QWORD [RIP-0x49edf]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes {JMP QWORD [RIP-0x4a1b5]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes {JMP QWORD [RIP-0x4ab13]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5812] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5820] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes {JMP QWORD [RIP-0x4a220]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes {JMP QWORD [RIP-0x49cef]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes {JMP QWORD [RIP-0x4ac62]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes {JMP QWORD [RIP-0x4a80f]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes {JMP QWORD [RIP-0x4adda]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes {JMP QWORD [RIP-0x49edf]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes {JMP QWORD [RIP-0x4a1b5]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes {JMP QWORD [RIP-0x4ab13]}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[3852] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[3680] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes JMP 3f3f3f3f
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[5320] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 424 0000000077131398 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007713143f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 500 0000000077131594 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007713191e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 212 0000000077131bf8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077131d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077131edf 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 89 0000000077131fc5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000771327b0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000771327d2 8 bytes {JMP 0x10}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007713282f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 184 0000000077132898 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077132d1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 375 0000000077132d67 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007713323b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 920 00000000771333c8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077133a5e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077133ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077133b85 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077134190 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 161 0000000077134241 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetNameFromLangInfoNode + 277 00000000771342b5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 214 00000000771343f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpIsQualifiedLanguage + 276 0000000077134434 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 408 00000000771345d8 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlpNtOpenKey + 657 00000000771346d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 284 0000000077134a9c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberOfSetBitsUlongPtr + 483 0000000077134b63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 231 0000000077134c57 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!TpWaitForWait + 518 0000000077134d76 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlDeactivateActivationContext + 256 0000000077134ea0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContext + 67 0000000077134ef3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlActivateActivationContextEx + 501 00000000771350f5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateUserThread + 256 00000000771352f0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringExW + 247 00000000771353f7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlIpv6AddressToStringW + 484 00000000771355e4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseAlpcCompletion + 438 00000000771364d6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!atol + 194 000000007713668e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!qsort + 76 000000007713687c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlLookupElementGenericTableFullAvl + 45 00000000771368bd 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 4 00000000771368d4 8 bytes [70, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlNumberGenericTableElementsAvl + 92 000000007713692c 8 bytes [60, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!RtlSubtreePredecessor + 790 0000000077137166 8 bytes [40, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroupMembers + 241 0000000077137dd1 8 bytes [10, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseCleanupGroup + 119 0000000077137e57 8 bytes [00, 6C, F8, 7E, 00, 00, 00, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077181380 8 bytes {JMP QWORD [RIP-0x4a220]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077181500 8 bytes {JMP QWORD [RIP-0x49cef]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077181530 8 bytes {JMP QWORD [RIP-0x4ac62]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077181650 8 bytes {JMP QWORD [RIP-0x4a80f]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077181700 8 bytes {JMP QWORD [RIP-0x4adda]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077181d30 8 bytes {JMP QWORD [RIP-0x49edf]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077181f80 8 bytes {JMP QWORD [RIP-0x4a1b5]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000771827e0 8 bytes {JMP QWORD [RIP-0x4ab13]}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074bd13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074bd146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074bd16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074bd19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074bd19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\TJHHH\Desktop\Gmer-19357.exe[6044] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074bd1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Kernel IAT/EAT - GMER 2.1 ----
IAT C:\Windows\System32\win32k.sys[ntoskrnl.exe!KeUserModeCallback] [fffff88004fa8ff4] \SystemRoot\system32\DRIVERS\klif.sys [PAGE]
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 21.02.2015 Suchlauf-Zeit: 14:12:34 Logdatei: malwarebytes.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.21.04 Rootkit Datenbank: v2015.02.20.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: TJHHH Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 326849 Verstrichene Zeit: 3 Min, 59 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 5 PUP.Optional.FindPositive.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe, 5384, Löschen bei Neustart, [9c7c3be60a808fa7d3c5534506fd49b7] PUP.Optional.FindPositive.A, C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe, 5352, Löschen bei Neustart, [a77134edd8b2c96dd5c3efa97b88ad53] PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\Plugin.exe, 4860, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff] PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\Plugin.exe, 1132, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff] PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8\Plugin.exe, 4904, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff] Module: 1 PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\6cb02ea3-fa70-47b5-9d54-6b6876f84698.dll, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], Registrierungsschlüssel: 13 PUP.Optional.FindPositive.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{30c85a3d-1d96-4589-b63f-91fb7ef45a41}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.FindPositive.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{63C63464-1423-4FDB-BA5D-6F75F491C63E}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.FindPositive.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{50F60937-910A-4C05-8E36-FE4E299191CF}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.FindPositive.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{50F60937-910A-4C05-8E36-FE4E299191CF}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.FindPositive.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{63C63464-1423-4FDB-BA5D-6F75F491C63E}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.FindPositive.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{30C85A3D-1D96-4589-B63F-91FB7EF45A41}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.FindPositive.A, HKU\S-1-5-21-2831150185-3866919313-2850936559-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{30C85A3D-1D96-4589-B63F-91FB7EF45A41}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.FindPositive.A, HKU\S-1-5-21-2831150185-3866919313-2850936559-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{30C85A3D-1D96-4589-B63F-91FB7EF45A41}, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Optional.PositiveFinds.A, HKLM\SOFTWARE\WOW6432NODE\PositiveFinds, In Quarantäne, [5abe9b862b5fe452878ff4a2e12211ef], PUP.Optional.FindPositive.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Service Mgr PositiveFinds, In Quarantäne, [9c7c3be60a808fa7d3c5534506fd49b7], PUP.Optional.FindPositive.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update Mgr PositiveFinds, In Quarantäne, [a77134edd8b2c96dd5c3efa97b88ad53], PUP.Optional.FindPositive.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\Positive Finds, In Quarantäne, [0a0e6ab77911fd39cb211d73fd06cd33], PUP.Optional.FindPositive.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{cfd32d46-7d3f-483f-bace-7172aec5592d}, In Quarantäne, [0a0e6ab77911fd39cb211d73fd06cd33], Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 13 PUP.Optional.FindPositive.A, C:\Program Files (x86)\Positive Finds, In Quarantäne, [0a0e6ab77911fd39cb211d73fd06cd33], PUP.Optional.FindPositive.A, C:\Program Files (x86)\Positive Finds\Extensions, In Quarantäne, [0a0e6ab77911fd39cb211d73fd06cd33], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3bak, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\4, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\5, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8bak, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602, Löschen bei Neustart, [f127fd240684b383c4fc5e34b64d23dd], PUP.Optional.PositiveFinds.A, C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater, In Quarantäne, [f127fd240684b383c4fc5e34b64d23dd], Dateien: 15 PUP.Optional.FindPositive.A, C:\Program Files (x86)\Positive Finds\Extensions\30c85a3d-1d96-4589-b63f-91fb7ef45a41.dll, In Quarantäne, [d93fed345c2ee84e8d2d5bac0df606fa], PUP.Adware.Agent, C:\Users\TJHHH\AppData\Local\Temp\PositiveFinds\Setup.exe, In Quarantäne, [a870bd643e4c290db2199e685ea29a66], PUP.Optional.FindPositive.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.exe, Löschen bei Neustart, [9c7c3be60a808fa7d3c5534506fd49b7], PUP.Optional.FindPositive.A, C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.exe, Löschen bei Neustart, [a77134edd8b2c96dd5c3efa97b88ad53], PUP.Optional.FindPositive.A, C:\Program Files (x86)\Positive Finds\7za.exe, In Quarantäne, [0a0e6ab77911fd39cb211d73fd06cd33], PUP.Optional.FindPositive.A, C:\Program Files (x86)\Positive Finds\Uninstaller.exe, In Quarantäne, [0a0e6ab77911fd39cb211d73fd06cd33], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugincontainer.bak, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\temp, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\6cb02ea3-fa70-47b5-9d54-6b6876f84698.dll, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3\Plugin.exe, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3bak\6cb02ea3-fa70-47b5-9d54-6b6876f84698.dll, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\3bak\Plugin.exe, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8\Plugin.exe, Löschen bei Neustart, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\ProgramData\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\plugins\8bak\Plugin.exe, In Quarantäne, [33e590916c1e39fd409b840d788b01ff], PUP.Optional.PositiveFinds.A, C:\Program Files (x86)\Common Files\d2d4a9d3-f3f1-4c52-8d3f-dddc91fe0602\updater.bak, In Quarantäne, [f127fd240684b383c4fc5e34b64d23dd], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) |
|
21.02.2015, 17:33
| #5 |
| /// the machine /// TB-Ausbilder    | Ads Positive Finds bei win7 - wie entfernen ? hi, Scan mit Combofix
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.02.2015, 20:32
| #6 |
| | Ads Positive Finds bei win7 - wie entfernen ?Code:
ATTFilter ComboFix 15-02-16.01 - TJHHH 21.02.2015 20:19:53.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8057.6020 [GMT 1:00]
ausgeführt von:: c:\users\TJHHH\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {179979E8-273D-D14E-0543-2861940E4886}
FW: Kaspersky Internet Security *Disabled* {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
SP: Kaspersky Internet Security *Disabled/Updated* {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\prefs.js
H:\Autorun.inf
.
.
((((((((((((((((((((((((((((((((((((((( Treiber/Dienste )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_ACEDRV11
-------\Service_acedrv11
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-01-21 bis 2015-02-21 ))))))))))))))))))))))))))))))
.
.
2015-02-22 09:40 . 2015-02-22 09:40 -------- d-----w- c:\program files\Microsoft Silverlight
2015-02-22 09:40 . 2015-02-22 09:40 -------- d-----w- c:\program files (x86)\Microsoft Silverlight
2015-02-22 09:10 . 2015-01-29 09:07 11910896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8B487952-D028-4461-A8AB-AC0E9C2446C2}\mpengine.dll
2015-02-21 13:55 . 2015-02-21 13:55 -------- d-----w- C:\FRST
2015-02-21 13:11 . 2015-02-21 19:22 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-02-21 13:11 . 2015-02-21 13:11 -------- d-----w- c:\program files (x86)\ Malwarebytes Anti-Malware
2015-02-21 13:11 . 2015-02-21 13:11 -------- d-----w- c:\programdata\Malwarebytes
2015-02-21 13:11 . 2014-11-21 05:14 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2015-02-21 13:11 . 2014-11-21 05:14 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-02-21 13:11 . 2014-11-21 05:14 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2015-02-19 19:57 . 2015-02-20 19:02 -------- d-----w- c:\users\TJHHH\AppData\Local\PokerStars.EU
2015-02-19 19:57 . 2015-02-19 19:59 -------- d-----w- c:\program files (x86)\PokerStars.EU
2015-02-19 18:53 . 2015-01-09 03:14 91136 ----a-w- c:\windows\system32\wdi.dll
2015-02-19 18:53 . 2015-01-09 03:14 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-02-19 18:53 . 2015-01-09 03:14 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-02-19 18:53 . 2015-01-09 02:48 76800 ----a-w- c:\windows\SysWow64\wdi.dll
2015-02-17 17:17 . 2015-02-17 17:21 -------- d-----w- c:\users\TJHHH\AppData\Local\WinZip
2015-02-17 17:17 . 2015-02-17 17:21 -------- d-----w- c:\programdata\WinZip
2015-02-17 17:16 . 2015-02-17 17:17 -------- d-----w- c:\program files\WinZip
2015-02-17 17:14 . 2015-02-17 17:14 -------- d-----w- c:\program files\File Association Helper
2015-02-13 14:35 . 2015-01-23 04:42 814080 ----a-w- c:\windows\system32\jscript9diag.dll
2015-02-13 14:35 . 2015-01-23 04:41 6041600 ----a-w- c:\windows\system32\jscript9.dll
2015-02-13 14:35 . 2015-01-23 03:43 620032 ----a-w- c:\windows\SysWow64\jscript9diag.dll
2015-02-13 14:35 . 2015-01-23 03:17 4300800 ----a-w- c:\windows\SysWow64\jscript9.dll
2015-02-12 17:58 . 2015-01-14 05:47 293040 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2015-02-12 17:58 . 2015-01-12 03:10 950784 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2015-02-12 17:58 . 2015-01-12 03:09 25056256 ----a-w- c:\windows\system32\mshtml.dll
2015-02-12 17:58 . 2015-01-12 02:59 10949120 ----a-w- c:\program files\Internet Explorer\F12Resources.dll
2015-02-12 17:58 . 2015-01-12 02:47 88064 ----a-w- c:\windows\system32\MshtmlDac.dll
2015-02-12 17:58 . 2015-01-12 02:08 199680 ----a-w- c:\windows\system32\msrating.dll
2015-02-12 17:58 . 2015-01-12 02:07 1016832 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2015-02-12 17:58 . 2015-01-12 01:27 2358272 ----a-w- c:\windows\system32\wininet.dll
2015-02-12 17:58 . 2015-01-12 01:08 382976 ----a-w- c:\program files\Internet Explorer\IEShims.dll
2015-02-04 19:21 . 2015-02-04 19:21 -------- d-----w- c:\users\TJHHH\AppData\Local\ElevatedDiagnostics
2015-02-02 14:08 . 2015-02-02 14:08 -------- d-----w- c:\program files (x86)\Microsoft
2015-02-02 13:50 . 2015-02-02 13:50 -------- d-----w- c:\users\TJHHH\AppData\Roaming\TuneUp Software
2015-02-02 13:50 . 2015-02-02 13:50 -------- d-----w- c:\users\TJHHH\AppData\Local\TuneUp Software
2015-02-02 13:49 . 2015-02-02 13:50 -------- d-----w- c:\programdata\TuneUp Software
2015-02-02 13:49 . 2015-02-02 13:49 -------- d-sh--w- c:\programdata\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2015-02-02 13:49 . 2015-02-02 13:49 -------- d--h--w- c:\programdata\Common Files
2015-02-02 13:36 . 2015-02-02 13:36 -------- d-----w- C:\searchplugins
2015-02-02 13:36 . 2015-01-23 05:39 378832 ----a-w- c:\windows\system32\LavasoftTcpService64.dll
2015-02-02 13:36 . 2015-01-23 05:39 332216 ----a-w- c:\windows\SysWow64\LavasoftTcpService.dll
2015-02-02 13:34 . 2015-02-02 14:15 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2015-02-02 13:34 . 2015-02-02 13:34 -------- d-----w- c:\users\TJHHH\AppData\Roaming\RHEng
2015-02-02 13:32 . 2015-02-02 14:15 -------- d-----w- c:\users\TJHHH\AppData\Roaming\DVDVideoSoft
2015-02-02 13:32 . 2015-02-02 13:32 -------- d-----w- c:\users\TJHHH\AppData\Local\Programs
2015-01-23 19:21 . 2015-01-23 19:21 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2015-01-23 19:21 . 2015-01-09 22:27 621200 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2015-01-23 19:20 . 2015-01-09 23:29 2558608 ----a-w- c:\windows\system32\nvsvcr.dll
2015-01-23 18:38 . 2014-11-22 10:46 38032 ----a-w- c:\windows\system32\drivers\nvvad64v.sys
2015-01-23 18:38 . 2014-11-22 10:46 32400 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll
2015-01-23 18:37 . 2015-02-19 20:07 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup-2\markup.dll
2015-01-23 18:37 . 2015-02-19 20:06 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM-2\StartResources.dll
2015-01-23 18:37 . 2015-02-15 10:57 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight-2\SpotlightResources.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-19 20:05 . 2015-01-14 21:00 1236816 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2015-02-15 10:58 . 2015-01-14 21:01 893552 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\UpdateableMarkup\markup.dll
2015-02-15 10:57 . 2015-01-14 21:01 42168 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCEClientUX\dSM\StartResources.dll
2015-02-13 02:00 . 2015-01-19 10:42 116773704 ----a-w- c:\windows\system32\MRT.exe
2015-01-16 06:41 . 2015-01-14 20:16 1316184 ----a-w- c:\windows\SysWow64\nvspbridge.dll
2015-01-16 06:41 . 2015-01-14 20:16 1278920 ----a-w- c:\windows\SysWow64\nvspcap.dll
2015-01-16 06:41 . 2015-01-14 20:16 1756424 ----a-w- c:\windows\system32\nvspbridge64.dll
2015-01-16 06:41 . 2015-01-14 20:16 1514528 ----a-w- c:\windows\system32\nvspcap64.dll
2015-01-15 06:35 . 2015-01-15 06:35 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2015-01-15 06:35 . 2015-01-15 06:35 942592 ----a-w- c:\windows\system32\jsIntl.dll
2015-01-15 06:35 . 2015-01-15 06:35 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2015-01-15 06:35 . 2015-01-15 06:35 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2015-01-15 06:35 . 2015-01-15 06:35 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2015-01-15 06:35 . 2015-01-15 06:35 81408 ----a-w- c:\windows\system32\icardie.dll
2015-01-15 06:35 . 2015-01-15 06:35 774144 ----a-w- c:\windows\system32\jscript.dll
2015-01-15 06:35 . 2015-01-15 06:35 77312 ----a-w- c:\windows\system32\tdc.ocx
2015-01-15 06:35 . 2015-01-15 06:35 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2015-01-15 06:35 . 2015-01-15 06:35 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2015-01-15 06:35 . 2015-01-15 06:35 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2015-01-15 06:35 . 2015-01-15 06:35 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2015-01-15 06:35 . 2015-01-15 06:35 62464 ----a-w- c:\windows\system32\pngfilt.dll
2015-01-15 06:35 . 2015-01-15 06:35 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2015-01-15 06:35 . 2015-01-15 06:35 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2015-01-15 06:35 . 2015-01-15 06:35 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2015-01-15 06:35 . 2015-01-15 06:35 48640 ----a-w- c:\windows\system32\mshtmler.dll
2015-01-15 06:35 . 2015-01-15 06:35 48128 ----a-w- c:\windows\system32\imgutil.dll
2015-01-15 06:35 . 2015-01-15 06:35 413696 ----a-w- c:\windows\system32\html.iec
2015-01-15 06:35 . 2015-01-15 06:35 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2015-01-15 06:35 . 2015-01-15 06:35 337408 ----a-w- c:\windows\SysWow64\html.iec
2015-01-15 06:35 . 2015-01-15 06:35 30208 ----a-w- c:\windows\system32\licmgr10.dll
2015-01-15 06:35 . 2015-01-15 06:35 247808 ----a-w- c:\windows\system32\msls31.dll
2015-01-15 06:35 . 2015-01-15 06:35 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2015-01-15 06:35 . 2015-01-15 06:35 243200 ----a-w- c:\windows\system32\webcheck.dll
2015-01-15 06:35 . 2015-01-15 06:35 235520 ----a-w- c:\windows\system32\url.dll
2015-01-15 06:35 . 2015-01-15 06:35 235008 ----a-w- c:\windows\system32\elshyph.dll
2015-01-15 06:35 . 2015-01-15 06:35 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2015-01-15 06:35 . 2015-01-15 06:35 167424 ----a-w- c:\windows\system32\iexpress.exe
2015-01-15 06:35 . 2015-01-15 06:35 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2015-01-15 06:35 . 2015-01-15 06:35 147968 ----a-w- c:\windows\system32\occache.dll
2015-01-15 06:35 . 2015-01-15 06:35 143872 ----a-w- c:\windows\system32\wextract.exe
2015-01-15 06:35 . 2015-01-15 06:35 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2015-01-15 06:35 . 2015-01-15 06:35 13824 ----a-w- c:\windows\system32\mshta.exe
2015-01-15 06:35 . 2015-01-15 06:35 135680 ----a-w- c:\windows\system32\iepeers.dll
2015-01-15 06:35 . 2015-01-15 06:35 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2015-01-15 06:35 . 2015-01-15 06:35 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2015-01-15 06:35 . 2015-01-15 06:35 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2015-01-15 06:35 . 2015-01-15 06:35 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2015-01-15 06:35 . 2015-01-15 06:35 105984 ----a-w- c:\windows\system32\iesysprep.dll
2015-01-15 06:35 . 2015-01-15 06:35 101376 ----a-w- c:\windows\system32\inseng.dll
2015-01-15 06:32 . 2015-01-15 06:32 9728 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 648192 ----a-w- c:\windows\system32\d3d10level9.dll
2015-01-15 06:32 . 2015-01-15 06:32 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2015-01-15 06:32 . 2015-01-15 06:32 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 5632 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2015-01-15 06:32 . 2015-01-15 06:32 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2015-01-15 06:32 . 2015-01-15 06:32 363008 ----a-w- c:\windows\system32\dxgi.dll
2015-01-15 06:32 . 2015-01-15 06:32 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 333312 ----a-w- c:\windows\system32\d3d10_1core.dll
2015-01-15 06:32 . 2015-01-15 06:32 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-version-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 296960 ----a-w- c:\windows\system32\d3d10core.dll
2015-01-15 06:32 . 2015-01-15 06:32 293376 ----a-w- c:\windows\SysWow64\dxgi.dll
2015-01-15 06:32 . 2015-01-15 06:32 2560 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 249856 ----a-w- c:\windows\SysWow64\d3d10_1core.dll
2015-01-15 06:32 . 2015-01-15 06:32 245248 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2015-01-15 06:32 . 2015-01-15 06:32 221184 ----a-w- c:\windows\system32\UIAnimation.dll
2015-01-15 06:32 . 2015-01-15 06:32 220160 ----a-w- c:\windows\SysWow64\d3d10core.dll
2015-01-15 06:32 . 2015-01-15 06:32 207872 ----a-w- c:\windows\SysWow64\WindowsCodecsExt.dll
2015-01-15 06:32 . 2015-01-15 06:32 194560 ----a-w- c:\windows\system32\d3d10_1.dll
2015-01-15 06:32 . 2015-01-15 06:32 187392 ----a-w- c:\windows\SysWow64\UIAnimation.dll
2015-01-15 06:32 . 2015-01-15 06:32 1682432 ----a-w- c:\windows\system32\XpsPrint.dll
2015-01-15 06:32 . 2015-01-15 06:32 1643520 ----a-w- c:\windows\system32\DWrite.dll
2015-01-15 06:32 . 2015-01-15 06:32 161792 ----a-w- c:\windows\SysWow64\d3d10_1.dll
2015-01-15 06:32 . 2015-01-15 06:32 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2015-01-15 06:32 . 2015-01-15 06:32 1238528 ----a-w- c:\windows\system32\d3d10.dll
2015-01-15 06:32 . 2015-01-15 06:32 1175552 ----a-w- c:\windows\system32\FntCache.dll
2015-01-15 06:32 . 2015-01-15 06:32 1158144 ----a-w- c:\windows\SysWow64\XpsPrint.dll
2015-01-15 06:32 . 2015-01-15 06:32 1080832 ----a-w- c:\windows\SysWow64\d3d10.dll
2015-01-15 06:32 . 2015-01-15 06:32 10752 ---ha-w- c:\windows\SysWow64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-01-15 06:32 . 2015-01-15 06:32 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2015-01-14 20:57 . 2014-08-13 18:34 77512 ----a-w- c:\windows\system32\drivers\klwtp.sys
2015-01-14 20:57 . 2015-01-14 20:54 818888 ----a-w- c:\windows\system32\drivers\klif.sys
2015-01-14 20:57 . 2015-01-14 20:54 150536 ----a-w- c:\windows\system32\drivers\klflt.sys
2015-01-14 20:17 . 2015-01-14 20:17 180 ----a-w- c:\windows\system32\{A6D608F0-0BDE-491A-97AE-5C4B05D86E01}.bat
2015-01-14 20:00 . 2015-01-14 20:00 451 ----a-w- c:\windows\system32\{F33C3B9B-72AF-418A-B3FD-560646F7CDA2}.bat
2015-01-13 04:15 . 2015-01-14 20:15 1540240 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2015-01-10 08:07 . 2015-01-14 20:15 3298816 ----a-w- c:\windows\system32\nvapi64.dll
2015-01-10 08:07 . 2015-01-14 20:15 2902456 ----a-w- c:\windows\SysWow64\nvapi.dll
2015-01-10 08:07 . 2015-01-14 20:15 18566296 ----a-w- c:\windows\system32\nvwgf2umx.dll
2015-01-10 08:07 . 2015-01-14 20:15 16009120 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2014-02-21 292848]
"SHIWebOnDiskManager"="c:\program files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe" [2012-08-08 245760]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 cm_km_w;Kaspersky Lab Crypto Module (FDE PDK);c:\windows\system32\DRIVERS\cm_km_w.sys;c:\windows\SYSNATIVE\DRIVERS\cm_km_w.sys [x]
S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S1 klhk;klhk;c:\windows\system32\DRIVERS\klhk.sys;c:\windows\SYSNATIVE\DRIVERS\klhk.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 klpd;klpd;c:\windows\system32\DRIVERS\klpd.sys;c:\windows\SYSNATIVE\DRIVERS\klpd.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 Klwtp;Klwtp;c:\windows\system32\DRIVERS\klwtp.sys;c:\windows\SYSNATIVE\DRIVERS\klwtp.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 AVP15.0.1;Kaspersky Anti-Virus Service 15.0.1;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 igfxCUIService1.0.0.0;Intel(R) HD Graphics Control Panel Service;c:\windows\system32\igfxCUIService.exe;c:\windows\SYSNATIVE\igfxCUIService.exe [x]
S2 Intel(R) PROSet Monitoring Service;Intel(R) PROSet Monitoring Service;c:\windows\system32\IProsetMonitor.exe;c:\windows\SYSNATIVE\IProsetMonitor.exe [x]
S2 kldisk;kldisk;c:\windows\system32\DRIVERS\kldisk.sys;c:\windows\SYSNATIVE\DRIVERS\kldisk.sys [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe;c:\program files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;c:\windows\system32\DRIVERS\e1d62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1d62x64.sys [x]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 klflt;Kaspersky Lab Kernel DLL;c:\windows\system32\DRIVERS\klflt.sys;c:\windows\SYSNATIVE\DRIVERS\klflt.sys [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - MBAMSWISSARMY
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-02-22 10:01 1084744 ----a-w- c:\program files (x86)\Google\Chrome\Application\40.0.2214.115\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14 19:43]
.
2015-02-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14 19:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2015-01-15 15:59 776520 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2014-05-27 7611608]
"IAStorIcon"="c:\program files\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2014-04-11 36352]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-01-16 2585928]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-01-16 1514528]
"FAHConsole"="c:\program files\File Association Helper\FAHConsole.exe" [2014-01-28 729272]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D1%26b%3D{browser}%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{09A10376-994C-4BBF-9121-F50CF7BA237E} - {F2A56BFE-7911-451A-BC74-A9C3C2E95126} - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll
TCP: DhcpNameServer = 192.168.2.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-Web Companion - c:\program files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\ Malwarebytes Anti-Malware \mbam.exe
c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2015-02-21 20:23:39 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2015-02-21 19:23
.
Vor Suchlauf: 10 Verzeichnis(se), 77.411.364.864 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 77.382.733.824 Bytes frei
.
- - End Of File - - 08A64B51D4EA2E59F4CA288E8D51599F
A36C5E4F47E84449FF07ED3517B43A31
|
|
22.02.2015, 09:14
| #7 |
| /// the machine /// TB-Ausbilder | Ads Positive Finds bei win7 - wie entfernen ? Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.02.2015, 21:30
| #8 |
| | Ads Positive Finds bei win7 - wie entfernen ?Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 22.02.2015 Suchlauf-Zeit: 21:03:00 Logdatei: mbam.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.02.22.06 Rootkit Datenbank: v2015.02.22.01 Lizenz: Testversion Malware Schutz: Aktiviert Bösartiger Webseiten Schutz: Aktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: TJHHH Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 340264 Verstrichene Zeit: 3 Min, 31 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Aktiviert PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 0 (Keine schädliche Elemente erkannt) Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 0 (Keine schädliche Elemente erkannt) Dateien: 0 (Keine schädliche Elemente erkannt) Physische Sektoren: 0 (Keine schädliche Elemente erkannt) (end) Code:
ATTFilter # AdwCleaner v4.111 - Bericht erstellt 22/02/2015 um 21:11:48
# Aktualisiert 18/02/2015 von Xplode
# Datenbank : 2015-02-18.3 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : TJHHH - TJHHH-PC
# Gestarted von : C:\Users\TJHHH\Desktop\AdwCleaner_4.111.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\TJHHH\AppData\Roaming\RHEng
Datei Gelöscht : C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage-journal
Datei Gelöscht : C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage
Datei Gelöscht : C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_www.superfish.com_0.localstorage-journal
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9C81D00A-3DAA-48AB-90C7-8252119ABB93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1DA17428-323D-48FF-857C-98CFEE48BFD5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17631
-\\ Google Chrome v40.0.2214.115
*************************
AdwCleaner[R0].txt - [2455 Bytes] - [22/02/2015 21:10:00]
AdwCleaner[S0].txt - [2341 Bytes] - [22/02/2015 21:11:48]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2400 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.2 (02.02.2015:1)
OS: Windows 7 Professional x64
Ran by TJHHH on 22.02.2015 at 21:17:33,85
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] "C:\Users\TJHHH\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage"
Successfully deleted: [File] "C:\Users\TJHHH\appdata\local\google\chrome\user data\default\local storage\http_www.superfish.com_0.localstorage-journal"
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 22.02.2015 at 21:18:59,99
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-02-2015
Ran by TJHHH at 2015-02-22 21:22:10
Running from C:\Users\TJHHH\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Disabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Disabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Disabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Canon MG4100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4100_series) (Version: - )
File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Drive (HKLM-x32\...\{65EACBB4-B0B8-4A5B-AE46-22DBE15C70B5}) (Version: 1.19.8406.6504 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1204 - Intel Corporation)
Intel(R) Network Connections 18.8.136.0 (HKLM\...\PROSetDX) (Version: 18.8.136.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3540 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.0.3.1001 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.16 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}) (Version: 15.0.1.415 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.1.415 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.25 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version: - PokerStars.eu)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7256 - Realtek Semiconductor Corp.)
Rudolf Müller Verlag Deutsches Dachdeckerhandwerk - Rege 5.5 (HKLM-x32\...\RUDOLF M_LLER VERLAG DEUTSCHES DACHDECKERHANDWERK _ REGE 5_5) (Version: 5.5 - Rudolf Müller Verlag)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
WinZip 19.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E7}) (Version: 19.0.11294 - WinZip Computing, S.L. )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
13-02-2015 03:00:24 Windows Update
14-02-2015 03:00:18 Windows Update
19-02-2015 19:53:55 Windows Update
19-02-2015 21:53:19 Windows Update
21-02-2015 20:19:18 ComboFix created restore point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2015-02-21 20:22 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {56B76397-198F-4B90-AB07-46D02E23BB89} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14] (Google Inc.)
Task: {925CCB8E-DC2B-412D-B860-481359CF0782} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C1752237-56B9-43E1-84C0-B80FAAA7F4B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-01-14 21:15 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 14965064 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\TJHHH\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-2831150185-3866919313-2850936559-500 - Administrator - Disabled)
Gast (S-1-5-21-2831150185-3866919313-2850936559-501 - Limited - Disabled)
TJHHH (S-1-5-21-2831150185-3866919313-2850936559-1000 - Administrator - Enabled) => C:\Users\TJHHH
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2015-02-21 20:21:38.306
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-02-21 20:21:38.291
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-02-14 03:01:26.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:01:26.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:00:41.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:00:41.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-23 19:37:08.733
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-23 19:37:08.655
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:15.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:15.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 21%
Total physical RAM: 8056.85 MB
Available physical RAM: 6288.31 MB
Total Pagefile: 16111.89 MB
Available Pagefile: 14035.09 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:117.38 GB) (Free:71.5 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.41 GB) (Free:931.07 GB) NTFS
Drive e: (ELS_Tobi) (CDROM) (Total:0.21 GB) (Free:0 GB) CDFS
Drive g: (INTENSO) (Fixed) (Total:465.65 GB) (Free:447.25 GB) FAT32
Drive h: () (Fixed) (Total:465.76 GB) (Free:450.66 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 7A1BDDB8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 117.4 GB) (Disk ID: 7A1BDDA0)
Partition 1: (Not Active) - (Size=117.4 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 44AEB7EB)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=0C)
========================================================
Disk: 4 (Size: 465.8 GB) (Disk ID: 3DF9EC21)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
 |
|
23.02.2015, 16:30
| #9 |
| /// the machine /// TB-Ausbilder | Ads Positive Finds bei win7 - wie entfernen ?ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
23.02.2015, 19:21
| #10 |
| | Ads Positive Finds bei win7 - wie entfernen ?Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=6c00eaa368227243ab892f49d055d06c
# engine=22608
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-02-23 05:54:24
# local_time=2015-02-23 06:54:24 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Kaspersky Internet Security'
# compatibility_mode=1299 16777213 100 100 5027 52285694 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 121461 176343914 0 0
# scanned=591125
# found=8
# cleaned=0
# scan_time=1361
sh=EE2D8A0C16CB4F60E07AD30BC8F4AF2D25E4FF62 ft=1 fh=c2a60ef126908cf5 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSS.exe"
sh=24A108C48173FDD9962F7CC3D4DB4B852D864838 ft=1 fh=0501d0dc4c9a869f vn="Variante von Win32/Systweak.N evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSHelper.dll"
sh=915239C2678EFCE5C2E45012595BEA0C050864B4 ft=1 fh=9ca6c4d86ffea4d8 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSPrivacyProtector.exe"
sh=67A75BAA7A5BBB2EEEBB99D490F00F82D0BB1E09 ft=1 fh=5d5a0ac2ab2c0a85 vn="Variante von Win32/Systweak evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSRegClean.exe"
sh=2C09414F7BCF16F3C9A358B5CCD4492EF7EEF08E ft=1 fh=5545a1a02bc092d6 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSRegistryOptimizer.exe"
sh=322DCE4CCA5EB266FFEDD900C6D628769AD18300 ft=1 fh=b3d66e50f9e4f6b1 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files\WinZip\Utils\WzSysScan\WINZIPSSSystemCleaner.exe"
sh=B41C311AE301AA25BDC81A91C01EE74C725E39C9 ft=1 fh=90f70608a2653fc5 vn="Variante von Win32/InstallCore.TL evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TJHHH\Downloads\wz19-dl.exe"
sh=483A33A8E46453C8E0E29712680759D0826CE340 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\1a16d9.msi"
Code:
ATTFilter Results of screen317's Security Check version 0.99.96
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Internet Security
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
Java 64-bit 8 Update 31
Adobe Reader XI
Google Chrome (40.0.2214.111)
Google Chrome (40.0.2214.115)
````````Process Check: objlist.exe by Laurent````````
Kaspersky Lab Kaspersky Internet Security 15.0.1 plugin-nm-server.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-02-2015
Ran by TJHHH at 2015-02-23 19:18:36
Running from C:\Users\TJHHH\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Disabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AS: Kaspersky Internet Security (Disabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Disabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
2007 Microsoft Office system (HKLM-x32\...\PROHYBRIDR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Canon MG4100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG4100_series) (Version: - )
File Association Helper (HKLM\...\{C168639F-5810-4EC8-B1E8-0251AA8A771C}) (Version: 1.2.225.65451 - WinZip Computing International, LLC)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Drive (HKLM-x32\...\{65EACBB4-B0B8-4A5B-AE46-22DBE15C70B5}) (Version: 1.19.8406.6504 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1204 - Intel Corporation)
Intel(R) Network Connections 18.8.136.0 (HKLM\...\PROSetDX) (Version: 18.8.136.0 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3540 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.0.3.1001 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 3.0.0.16 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{8ED07EBD-22AD-415A-B71E-C1AD86862C2E}) (Version: 15.0.1.415 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.1.415 - Kaspersky Lab) Hidden
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 347.09 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.25 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.2.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.2.2 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.25 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.25 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.33.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.33.0 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version: - PokerStars.eu)
ProtectDisc Driver, Version 11 (HKLM-x32\...\ProtectDisc Driver 11) (Version: 11.0.0.14 - ProtectDisc Software GmbH)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7256 - Realtek Semiconductor Corp.)
Rudolf Müller Verlag Deutsches Dachdeckerhandwerk - Rege 5.5 (HKLM-x32\...\RUDOLF M_LLER VERLAG DEUTSCHES DACHDECKERHANDWERK _ REGE 5_5) (Version: 5.5 - Rudolf Müller Verlag)
SHIELD Streaming (Version: 4.0.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 17.12.8 - NVIDIA Corporation) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_PROHYBRIDR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_PROHYBRIDR_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_PROHYBRIDR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_PROHYBRIDR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
WinZip 19.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240E7}) (Version: 19.0.11294 - WinZip Computing, S.L. )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
==================== Restore Points =========================
13-02-2015 03:00:24 Windows Update
14-02-2015 03:00:18 Windows Update
19-02-2015 19:53:55 Windows Update
19-02-2015 21:53:19 Windows Update
21-02-2015 20:19:18 ComboFix created restore point
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2015-02-21 20:22 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {56B76397-198F-4B90-AB07-46D02E23BB89} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14] (Google Inc.)
Task: {925CCB8E-DC2B-412D-B860-481359CF0782} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C1752237-56B9-43E1-84C0-B80FAAA7F4B7} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-01-14] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-01-14 21:15 - 2015-01-10 00:29 - 00117392 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 01117512 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libglesv2.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 00211272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\libegl.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 09171272 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll
2015-02-22 11:02 - 2015-02-17 23:44 - 14965064 _____ () C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\TJHHH\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-2831150185-3866919313-2850936559-500 - Administrator - Disabled)
Gast (S-1-5-21-2831150185-3866919313-2850936559-501 - Limited - Disabled)
TJHHH (S-1-5-21-2831150185-3866919313-2850936559-1000 - Administrator - Enabled) => C:\Users\TJHHH
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/23/2015 07:10:48 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/23/2015 06:26:58 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/23/2015 06:26:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/23/2015 06:26:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/23/2015 06:25:10 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/23/2015 06:25:10 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/23/2015 06:24:59 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error: (02/23/2015 05:32:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (02/22/2015 09:28:10 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2015-02-21 20:21:38.306
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-02-21 20:21:38.291
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2015-02-14 03:01:26.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:01:26.553
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:00:41.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-02-14 03:00:41.531
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-23 19:37:08.733
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-23 19:37:08.655
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:15.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2015-01-22 16:26:15.441
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 50%
Total physical RAM: 8056.85 MB
Available physical RAM: 3954.4 MB
Total Pagefile: 16111.89 MB
Available Pagefile: 11898.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:117.38 GB) (Free:71.24 GB) NTFS
Drive d: (Volume) (Fixed) (Total:931.41 GB) (Free:931.07 GB) NTFS
Drive e: (ELS_Tobi) (CDROM) (Total:0.21 GB) (Free:0 GB) CDFS
Drive g: (INTENSO) (Fixed) (Total:465.65 GB) (Free:447.25 GB) FAT32
Drive h: () (Fixed) (Total:465.76 GB) (Free:450.66 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 7A1BDDB8)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931.4 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 117.4 GB) (Disk ID: 7A1BDDA0)
Partition 1: (Not Active) - (Size=117.4 GB) - (Type=07 NTFS)
========================================================
Disk: 3 (MBR Code: Windows 7 or Vista) (Size: 465.8 GB) (Disk ID: 44AEB7EB)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=0C)
========================================================
Disk: 4 (Size: 465.8 GB) (Disk ID: 3DF9EC21)
Partition 1: (Not Active) - (Size=465.8 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
24.02.2015, 07:08
| #11 |
| /// the machine /// TB-Ausbilder | Ads Positive Finds bei win7 - wie entfernen ? Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Program Files\WinZip
C:\Users\TJHHH\Downloads\wz19-dl.exe
C:\Windows\Installer\1a16d9.msi
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Revo Uninstaller - Download - Filepony damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren. Dann: https://support.google.com/chrome/answer/3296214?hl=de Frisches FRST log bitte, keine Addition.txt.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
24.02.2015, 19:15
| #12 |
| | Ads Positive Finds bei win7 - wie entfernen ?Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-02-2015
Ran by TJHHH at 2015-02-24 18:41:45 Run:1
Running from C:\Users\TJHHH\Desktop
Loaded Profiles: TJHHH (Available profiles: TJHHH)
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Program Files\WinZip
C:\Users\TJHHH\Downloads\wz19-dl.exe
C:\Windows\Installer\1a16d9.msi
Emptytemp:
*****************
C:\Program Files\WinZip => Moved successfully.
C:\Users\TJHHH\Downloads\wz19-dl.exe => Moved successfully.
C:\Windows\Installer\1a16d9.msi => Moved successfully.
EmptyTemp: => Removed 498.6 MB temporary data.
The system needed a reboot.
==== End of Fixlog 18:41:54 ====
folge weiter der Anweisung FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2015 Ran by TJHHH (administrator) on TJHHH-PC on 24-02-2015 18:59:08 Running from C:\Users\TJHHH\Desktop Loaded Profiles: TJHHH (Available profiles: TJHHH) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: IE) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7611608 2014-05-27] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation) HKLM-x32\...\Run: [SHIWebOnDiskManager] => C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [245760 2012-08-08] (SHI Elektronische Medien GmbH) ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D1%26b%3D{browser}%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional SearchScopes: HKLM -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> DefaultScope {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = https://de.search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10048_swoc_campaign_150202__yaie&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com () FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com () FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2015-01-14] Chrome: ======= CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-09] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [494864 2013-08-29] (Intel Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2015-01-14] (Kaspersky Lab ZAO) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2015-01-14] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2015-01-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-24] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-24 18:50 - 2015-02-24 18:50 - 00001268 _____ () C:\Users\TJHHH\Desktop\Revo Uninstaller.lnk 2015-02-24 18:50 - 2015-02-24 18:50 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-02-24 18:50 - 2015-02-24 18:48 - 00140960 _____ () C:\Users\TJHHH\Desktop\3296214 - Kopie.htm 2015-02-24 18:49 - 2015-02-24 18:49 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TJHHH\Downloads\revosetup95.exe 2015-02-24 18:49 - 2015-02-24 18:49 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TJHHH\Desktop\revosetup95.exe 2015-02-24 18:48 - 2015-02-24 18:48 - 00140960 _____ () C:\Users\TJHHH\Desktop\3296214.htm 2015-02-23 19:12 - 2015-02-23 19:12 - 00852594 _____ () C:\Users\TJHHH\Downloads\SecurityCheck.exe 2015-02-23 19:12 - 2015-02-23 19:12 - 00852594 _____ () C:\Users\TJHHH\Desktop\SecurityCheck.exe 2015-02-23 18:25 - 2015-02-23 18:24 - 02347384 _____ (ESET) C:\Users\TJHHH\Desktop\esetsmartinstaller_deu.exe 2015-02-23 18:24 - 2015-02-23 18:24 - 02347384 _____ (ESET) C:\Users\TJHHH\Downloads\esetsmartinstaller_deu.exe 2015-02-22 21:21 - 2015-02-22 21:21 - 00000000 ____D () C:\Users\TJHHH\Desktop\FRST-OlderVersion 2015-02-22 21:19 - 2015-02-22 21:18 - 00000925 _____ () C:\Users\TJHHH\Desktop\JRT.txt 2015-02-22 21:15 - 2015-02-22 21:15 - 00002516 _____ () C:\Users\TJHHH\Desktop\AdwCleaner[S0].txt 2015-02-22 21:09 - 2015-02-22 21:11 - 00000000 ____D () C:\AdwCleaner 2015-02-22 21:07 - 2015-02-22 21:07 - 00001200 _____ () C:\Users\TJHHH\Desktop\mbam.txt 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2015-02-22 10:39 - 2015-02-22 10:40 - 13087456 _____ (Microsoft Corporation) C:\Users\TJHHH\Downloads\Silverlight_x64.exe 2015-02-21 20:23 - 2015-02-21 20:23 - 00027775 _____ () C:\ComboFix.txt 2015-02-21 20:19 - 2015-02-21 20:23 - 00000000 ____D () C:\Windows\erdnt 2015-02-21 20:19 - 2015-02-21 20:23 - 00000000 ____D () C:\Qoobox 2015-02-21 20:19 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-02-21 20:19 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-02-21 20:19 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-02-21 20:13 - 2015-02-21 20:11 - 05611903 ____R (Swearware) C:\Users\TJHHH\Desktop\ComboFix.exe 2015-02-21 20:10 - 2015-02-21 20:11 - 05611903 _____ (Swearware) C:\Users\TJHHH\Downloads\ComboFix.exe 2015-02-21 17:04 - 2015-02-21 17:04 - 01388274 _____ (Thisisu) C:\Users\TJHHH\Downloads\JRT.exe 2015-02-21 17:04 - 2015-02-21 17:04 - 01388274 _____ (Thisisu) C:\Users\TJHHH\Desktop\JRT.exe 2015-02-21 17:03 - 2015-02-21 17:03 - 02126848 _____ () C:\Users\TJHHH\Downloads\AdwCleaner_4.111.exe 2015-02-21 17:03 - 2015-02-21 17:03 - 02126848 _____ () C:\Users\TJHHH\Desktop\AdwCleaner_4.111.exe 2015-02-21 16:31 - 2015-02-21 16:32 - 00008720 _____ () C:\Users\TJHHH\Desktop\malwarebytes.txt 2015-02-21 15:16 - 2015-02-21 15:16 - 00179307 _____ () C:\Users\TJHHH\Desktop\Gmer.txt 2015-02-21 15:11 - 2015-02-21 15:11 - 00380416 _____ () C:\Users\TJHHH\Downloads\Gmer-19357.exe 2015-02-21 15:11 - 2015-02-21 15:11 - 00380416 _____ () C:\Users\TJHHH\Desktop\Gmer-19357.exe 2015-02-21 15:09 - 2015-02-21 15:09 - 00050477 _____ () C:\Users\TJHHH\Downloads\Defogger.exe 2015-02-21 15:09 - 2015-02-21 15:09 - 00050477 _____ () C:\Users\TJHHH\Desktop\Defogger.exe 2015-02-21 15:09 - 2015-02-21 15:09 - 00000472 _____ () C:\Users\TJHHH\Desktop\defogger_disable.log 2015-02-21 15:09 - 2015-02-21 15:09 - 00000000 _____ () C:\Users\TJHHH\defogger_reenable 2015-02-21 14:55 - 2015-02-24 18:59 - 00015571 _____ () C:\Users\TJHHH\Desktop\FRST.txt 2015-02-21 14:55 - 2015-02-24 18:59 - 00000000 ____D () C:\FRST 2015-02-21 14:55 - 2015-02-23 19:18 - 00023087 _____ () C:\Users\TJHHH\Desktop\Addition.txt 2015-02-21 14:32 - 2015-02-22 21:21 - 02087424 _____ (Farbar) C:\Users\TJHHH\Desktop\FRST64.exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64.exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64 (1).exe 2015-02-21 14:11 - 2015-02-24 18:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-21 14:11 - 2015-02-21 14:11 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-21 14:09 - 2015-02-21 14:11 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\TJHHH\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-19 20:57 - 2015-02-20 20:02 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:59 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:57 - 00001986 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00001980 _____ () C:\Users\Public\Desktop\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2015-02-19 20:47 - 2015-02-19 20:53 - 112861768 _____ (PokerStars) C:\Users\TJHHH\Downloads\PokerStarsInstallEU.exe 2015-02-19 19:53 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-19 19:53 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-17 18:23 - 2015-02-17 18:35 - 231012738 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\WinZip 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\WinZip 2015-02-17 18:17 - 2015-02-17 18:17 - 00002271 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00002265 _____ () C:\Users\Public\Desktop\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2015-02-17 18:14 - 2015-02-17 18:14 - 00000000 ____D () C:\Program Files\File Association Helper 2015-02-17 18:11 - 2015-02-17 18:15 - 34208634 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar.crdownload 2015-02-13 15:35 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-13 15:35 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-12 18:59 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-12 18:59 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-12 18:59 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-12 18:59 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-12 18:59 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-02-12 18:59 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-12 18:59 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-12 18:59 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-02-12 18:59 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-12 18:59 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-02-12 18:59 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-12 18:59 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-12 18:59 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-12 18:59 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-12 18:59 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-12 18:59 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-12 18:59 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-12 18:59 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-12 18:59 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-12 18:59 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-02-12 18:58 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-12 18:58 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-12 18:58 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-12 18:58 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-12 18:56 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-12 18:56 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-12 18:56 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-12 18:56 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-12 18:56 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-12 18:56 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-12 18:56 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-12 18:56 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-12 18:56 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-12 18:56 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-12 18:56 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-12 18:56 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-12 18:56 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-12 18:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-12 18:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-12 18:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-12 18:56 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-12 18:56 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-12 18:56 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-12 18:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-12 18:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-12 18:56 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-12 18:56 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-12 18:56 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-12 18:56 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-12 18:56 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-04 12:39 - 2015-02-04 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2015-02-02 15:08 - 2015-02-02 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\TuneUp Software 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:50 - 00000000 ____D () C:\ProgramData\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2015-02-02 14:46 - 2015-02-02 14:47 - 00105808 _____ (GreenTree Applications SRL) C:\Users\TJHHH\Downloads\YTDSetup.exe 2015-02-02 14:36 - 2015-02-02 14:36 - 00005056 _____ () C:\Windows\SysWOW64\LavasoftTcpService.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\system32\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00000000 ____D () C:\searchplugins 2015-02-02 14:36 - 2015-01-23 06:39 - 00378832 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll 2015-02-02 14:36 - 2015-01-23 06:39 - 00332216 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll 2015-02-02 14:32 - 2015-02-02 15:15 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\DVDVideoSoft 2015-02-02 14:31 - 2015-02-02 14:32 - 03533008 _____ (DVDVideoSoft Ltd. ) C:\Users\TJHHH\Downloads\FreeYouTubeDownload.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-24 18:57 - 2015-01-14 21:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2015-02-24 18:52 - 2015-01-14 20:43 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\Google 2015-02-24 18:52 - 2015-01-14 20:43 - 00000000 ____D () C:\Program Files (x86)\Google 2015-02-24 18:49 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-24 18:49 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-24 18:48 - 2011-04-12 08:43 - 00700128 _____ () C:\Windows\system32\perfh007.dat 2015-02-24 18:48 - 2011-04-12 08:43 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2015-02-24 18:48 - 2009-07-14 06:13 - 01622694 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-24 18:42 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-02-24 18:42 - 2015-01-14 20:35 - 01507283 _____ () C:\Windows\WindowsUpdate.log 2015-02-24 18:42 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-24 18:42 - 2009-07-14 05:51 - 00042864 _____ () C:\Windows\setupact.log 2015-02-23 20:42 - 2010-11-21 04:47 - 00016582 _____ () C:\Windows\PFRO.log 2015-02-21 20:23 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2015-02-21 20:22 - 2009-07-14 03:34 - 62128128 _____ () C:\Windows\system32\config\SOFTWARE.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 19398656 _____ () C:\Windows\system32\config\SYSTEM.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2015-02-21 15:09 - 2015-01-14 20:35 - 00000000 ____D () C:\Users\TJHHH 2015-02-20 13:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-19 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-14 20:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-13 03:19 - 2009-07-14 05:45 - 00411240 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-13 03:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-13 03:03 - 2015-01-19 13:19 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-13 03:02 - 2015-01-19 11:42 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-13 03:00 - 2015-01-19 11:42 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-02 15:08 - 2015-01-19 13:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2015-02-02 15:05 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD ==================== Files in the root of some directories ======= 2015-01-14 20:48 - 2015-01-14 20:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-13 03:00 ==================== End Of Log ============================ --- --- --- --- --- --- FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-02-2015 Ran by TJHHH (administrator) on TJHHH-PC on 24-02-2015 19:13:30 Running from C:\Users\TJHHH\Desktop Loaded Profiles: TJHHH (Available profiles: TJHHH) Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: Chrome) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Intel Corporation) C:\Windows\System32\igfxCUIService.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (Intel Corporation) C:\Windows\System32\IPROSetMonitor.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Nico Mak Computing) C:\Program Files\File Association Helper\FAHWindow.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avpui.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe (Microsoft Corporation) C:\Windows\System32\msiexec.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7611608 2014-05-27] (Realtek Semiconductor) HKLM\...\Run: [IAStorIcon] => C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [287592 2014-04-11] (Intel Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2585928 2015-01-16] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [FAHConsole] => C:\Program Files\File Association Helper\FAHConsole.exe [729272 2014-01-28] (Nico Mak Computing) HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2014-02-21] (Intel Corporation) HKLM-x32\...\Run: [SHIWebOnDiskManager] => C:\Program Files (x86)\SHIWebOnDiskManager\SHIWebOnDiskManager.exe [245760 2012-08-08] (SHI Elektronische Medien GmbH) ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-2831150185-3866919313-2850936559-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://de.search.yahoo.com/yhs/web?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D1%26b%3D{browser}%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional SearchScopes: HKLM -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> DefaultScope {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {8CDE19E6-71C2-4B46-89B7-35F6A18C571A} URL = https://de.search.yahoo.com/search?fr=vmn&type=vmn__webcompa__1_0__ya__ch_WCYID10048_swoc_campaign_150202__yaie&p={searchTerms} SearchScopes: HKU\S-1-5-21-2831150185-3866919313-2850936559-1000 -> {C0C3A6C6-03BC-4195-8FCB-AEA091301353} URL = https://de.search.yahoo.com/yhs/search?hspart=iry&hsimp=yhs-fullyhosted_003&type=wny_wnzp_15_08¶m1=1¶m2=f%253D4%26b%3DIE%26cc%3Dde%26pa%3DWinYahoo%26cd%3D2XzuyEtN2Y1L1QzuyByE0DyEtAyD0F0DzzyE0B0DyEyEtDtDtN0D0Tzu0StCtCyEtBtN1L2XzutAtFyBtFyCtFtCtN1L1CzutN1L1G1B1V1N2Y1L1Qzu2SyB0F0FyCyD0EtB0EtG0EtA0A0FtGtB0C0A0BtG0CtA0FzztGyD0BtC0FyE0DtD0CyByByB0D2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0E0C0EyCtD0A0FtG0C0CtC0DtGyEyByE0DtG0AyBzy0EtGyB0A0DyBzzyEtDtDzz0A0Bzy2Q%26cr%3D2073840315%26a%3Dwny_wnzp_15_08%26os%3DWindows 7 Professional&p={searchTerms} BHO: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\x64\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Content Blocker Plugin -> {03C04F0A-E2A3-4F7F-BA30-BFA06FFD1358} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {B5D5BB14-C8E2-478D-9C97-574AC10AF9E8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) BHO-x32: Safe Money Plugin -> {E3D96E85-529D-4269-AC6A-97CF9E2221E3} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\IEExt\ie_plugin.dll (Kaspersky Lab ZAO) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @kaspersky.com/content_blocker_6418E0D362104DADA084DC312DFA8ABC -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com () FF Plugin-x32: @kaspersky.com/online_banking_69A4E213815F42BD863D889007201D82 -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com () FF Plugin-x32: @kaspersky.com/virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF HKLM-x32\...\Firefox\Extensions: [content_blocker_6418E0D362104DADA084DC312DFA8ABC@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com FF Extension: Модуль блокування небезпечних веб-сайтів - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\content_blocker@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard_294FF26A1D5B455495946778FDE7CEDB@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com FF Extension: Віртуальна клавіатура - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\virtual_keyboard@kaspersky.com [2015-01-14] FF HKLM-x32\...\Firefox\Extensions: [online_banking_69A4E213815F42BD863D889007201D82@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com FF Extension: Безпечні платежі - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\FFExt\online_banking@kaspersky.com [2015-01-14] Chrome: ======= CHR Profile: C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-24] CHR Extension: (Google Docs) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-24] CHR Extension: (Google Drive) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-24] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-24] CHR Extension: (Adguard AdBlocker) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgnkhhnnamicmpeenaelnjfhikgbkllg [2015-02-24] CHR Extension: (YouTube) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-24] CHR Extension: (Adblock Plus) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-02-24] CHR Extension: (Google Search) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-24] CHR Extension: (Kaspersky Protection) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-02-24] CHR Extension: (Google Sheets) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-24] CHR Extension: (Google Wallet) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-24] CHR Extension: (Gmail) - C:\Users\TJHHH\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-24] CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho [Not Found] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AVP15.0.1; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.1\avp.exe [234520 2014-08-30] (Kaspersky Lab ZAO) R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148744 2015-01-16] (NVIDIA Corporation) R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [16232 2014-04-11] (Intel Corporation) R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [296432 2014-04-09] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1706312 2015-01-16] (NVIDIA Corporation) R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21833544 2015-01-16] (NVIDIA Corporation) R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R0 cm_km_w; C:\Windows\System32\DRIVERS\cm_km_w.sys [238288 2013-01-14] (Kaspersky Lab UK Ltd) R3 e1dexpress; C:\Windows\System32\DRIVERS\e1d62x64.sys [494864 2013-08-29] (Intel Corporation) R0 iaStorF; C:\Windows\System32\DRIVERS\iaStorF.sys [28008 2014-04-11] (Intel Corporation) R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [468576 2014-03-31] (Kaspersky Lab ZAO) R2 kldisk; C:\Windows\System32\DRIVERS\kldisk.sys [46144 2014-07-02] (Kaspersky Lab ZAO) R3 klflt; C:\Windows\System32\DRIVERS\klflt.sys [150536 2015-01-14] (Kaspersky Lab ZAO) R1 klhk; C:\Windows\System32\DRIVERS\klhk.sys [246456 2014-08-12] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [818888 2015-01-14] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [55872 2014-06-05] (Kaspersky Lab ZAO) R1 Klwtp; C:\Windows\System32\DRIVERS\klwtp.sys [77512 2015-01-14] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [179776 2014-07-09] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-24] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [118272 2014-03-20] (Intel Corporation) R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19784 2015-01-16] (NVIDIA Corporation) R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 gdrv; \??\C:\Windows\gdrv.sys [X] U4 klkbdflt2; system32\DRIVERS\klkbdflt2.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-24 19:08 - 2015-02-24 19:08 - 00002251 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2015-02-24 19:08 - 2015-02-24 19:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2015-02-24 19:06 - 2015-02-24 19:11 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-02-24 19:06 - 2015-02-24 19:11 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-02-24 19:06 - 2015-02-24 19:06 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2015-02-24 19:06 - 2015-02-24 19:06 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2015-02-24 19:05 - 2015-02-24 19:06 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\Deployment 2015-02-24 19:05 - 2015-02-24 19:05 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\Apps\2.0 2015-02-24 18:50 - 2015-02-24 18:50 - 00001268 _____ () C:\Users\TJHHH\Desktop\Revo Uninstaller.lnk 2015-02-24 18:50 - 2015-02-24 18:50 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group 2015-02-24 18:50 - 2015-02-24 18:48 - 00140960 _____ () C:\Users\TJHHH\Desktop\3296214 - Kopie.htm 2015-02-24 18:49 - 2015-02-24 18:49 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TJHHH\Downloads\revosetup95.exe 2015-02-24 18:49 - 2015-02-24 18:49 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\TJHHH\Desktop\revosetup95.exe 2015-02-24 18:48 - 2015-02-24 18:48 - 00140960 _____ () C:\Users\TJHHH\Desktop\3296214.htm 2015-02-23 19:12 - 2015-02-23 19:12 - 00852594 _____ () C:\Users\TJHHH\Downloads\SecurityCheck.exe 2015-02-23 19:12 - 2015-02-23 19:12 - 00852594 _____ () C:\Users\TJHHH\Desktop\SecurityCheck.exe 2015-02-23 18:25 - 2015-02-23 18:24 - 02347384 _____ (ESET) C:\Users\TJHHH\Desktop\esetsmartinstaller_deu.exe 2015-02-23 18:24 - 2015-02-23 18:24 - 02347384 _____ (ESET) C:\Users\TJHHH\Downloads\esetsmartinstaller_deu.exe 2015-02-22 21:21 - 2015-02-22 21:21 - 00000000 ____D () C:\Users\TJHHH\Desktop\FRST-OlderVersion 2015-02-22 21:19 - 2015-02-22 21:18 - 00000925 _____ () C:\Users\TJHHH\Desktop\JRT.txt 2015-02-22 21:15 - 2015-02-22 21:15 - 00002516 _____ () C:\Users\TJHHH\Desktop\AdwCleaner[S0].txt 2015-02-22 21:09 - 2015-02-22 21:11 - 00000000 ____D () C:\AdwCleaner 2015-02-22 21:07 - 2015-02-22 21:07 - 00001200 _____ () C:\Users\TJHHH\Desktop\mbam.txt 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2015-02-22 10:40 - 2015-02-22 10:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2015-02-22 10:39 - 2015-02-22 10:40 - 13087456 _____ (Microsoft Corporation) C:\Users\TJHHH\Downloads\Silverlight_x64.exe 2015-02-21 20:23 - 2015-02-21 20:23 - 00027775 _____ () C:\ComboFix.txt 2015-02-21 20:19 - 2015-02-21 20:23 - 00000000 ____D () C:\Windows\erdnt 2015-02-21 20:19 - 2015-02-21 20:23 - 00000000 ____D () C:\Qoobox 2015-02-21 20:19 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2015-02-21 20:19 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2015-02-21 20:19 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2015-02-21 20:19 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2015-02-21 20:13 - 2015-02-21 20:11 - 05611903 ____R (Swearware) C:\Users\TJHHH\Desktop\ComboFix.exe 2015-02-21 20:10 - 2015-02-21 20:11 - 05611903 _____ (Swearware) C:\Users\TJHHH\Downloads\ComboFix.exe 2015-02-21 17:04 - 2015-02-21 17:04 - 01388274 _____ (Thisisu) C:\Users\TJHHH\Downloads\JRT.exe 2015-02-21 17:04 - 2015-02-21 17:04 - 01388274 _____ (Thisisu) C:\Users\TJHHH\Desktop\JRT.exe 2015-02-21 17:03 - 2015-02-21 17:03 - 02126848 _____ () C:\Users\TJHHH\Downloads\AdwCleaner_4.111.exe 2015-02-21 17:03 - 2015-02-21 17:03 - 02126848 _____ () C:\Users\TJHHH\Desktop\AdwCleaner_4.111.exe 2015-02-21 16:31 - 2015-02-21 16:32 - 00008720 _____ () C:\Users\TJHHH\Desktop\malwarebytes.txt 2015-02-21 15:16 - 2015-02-21 15:16 - 00179307 _____ () C:\Users\TJHHH\Desktop\Gmer.txt 2015-02-21 15:11 - 2015-02-21 15:11 - 00380416 _____ () C:\Users\TJHHH\Downloads\Gmer-19357.exe 2015-02-21 15:11 - 2015-02-21 15:11 - 00380416 _____ () C:\Users\TJHHH\Desktop\Gmer-19357.exe 2015-02-21 15:09 - 2015-02-21 15:09 - 00050477 _____ () C:\Users\TJHHH\Downloads\Defogger.exe 2015-02-21 15:09 - 2015-02-21 15:09 - 00050477 _____ () C:\Users\TJHHH\Desktop\Defogger.exe 2015-02-21 15:09 - 2015-02-21 15:09 - 00000472 _____ () C:\Users\TJHHH\Desktop\defogger_disable.log 2015-02-21 15:09 - 2015-02-21 15:09 - 00000000 _____ () C:\Users\TJHHH\defogger_reenable 2015-02-21 14:55 - 2015-02-24 19:13 - 00017853 _____ () C:\Users\TJHHH\Desktop\FRST.txt 2015-02-21 14:55 - 2015-02-24 19:13 - 00000000 ____D () C:\FRST 2015-02-21 14:55 - 2015-02-23 19:18 - 00023087 _____ () C:\Users\TJHHH\Desktop\Addition.txt 2015-02-21 14:32 - 2015-02-22 21:21 - 02087424 _____ (Farbar) C:\Users\TJHHH\Desktop\FRST64.exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64.exe 2015-02-21 14:32 - 2015-02-21 14:32 - 02086912 _____ (Farbar) C:\Users\TJHHH\Downloads\FRST64 (1).exe 2015-02-21 14:11 - 2015-02-24 18:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-02-21 14:11 - 2015-02-21 14:11 - 00001106 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\ProgramData\Malwarebytes 2015-02-21 14:11 - 2015-02-21 14:11 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-02-21 14:11 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2015-02-21 14:11 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2015-02-21 14:09 - 2015-02-21 14:11 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\TJHHH\Downloads\mbam-setup-2.0.4.1028.exe 2015-02-19 20:57 - 2015-02-20 20:02 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:59 - 00000000 ____D () C:\Program Files (x86)\PokerStars.EU 2015-02-19 20:57 - 2015-02-19 20:57 - 00001986 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00001980 _____ () C:\Users\Public\Desktop\PokerStars.eu.lnk 2015-02-19 20:57 - 2015-02-19 20:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PokerStars.EU 2015-02-19 20:47 - 2015-02-19 20:53 - 112861768 _____ (PokerStars) C:\Users\TJHHH\Downloads\PokerStarsInstallEU.exe 2015-02-19 19:53 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll 2015-02-19 19:53 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll 2015-02-19 19:53 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll 2015-02-17 18:23 - 2015-02-17 18:35 - 231012738 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\WinZip 2015-02-17 18:17 - 2015-02-17 18:21 - 00000000 ____D () C:\ProgramData\WinZip 2015-02-17 18:17 - 2015-02-17 18:17 - 00002271 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00002265 _____ () C:\Users\Public\Desktop\WinZip.lnk 2015-02-17 18:17 - 2015-02-17 18:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZip 2015-02-17 18:14 - 2015-02-17 18:14 - 00000000 ____D () C:\Program Files\File Association Helper 2015-02-17 18:11 - 2015-02-17 18:15 - 34208634 _____ () C:\Users\TJHHH\Downloads\VA-Party_Schlager_Charts_Top_30_vom_16-02-2015-NoGroup.rar.crdownload 2015-02-13 15:35 - 2015-01-23 05:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-02-13 15:35 - 2015-01-23 04:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-02-13 15:35 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2015-02-12 18:59 - 2015-02-04 04:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2015-02-12 18:59 - 2015-02-04 04:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2015-02-12 18:59 - 2015-01-28 00:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2015-02-12 18:59 - 2015-01-14 06:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-02-12 18:59 - 2015-01-14 06:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-02-12 18:59 - 2015-01-12 04:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-02-12 18:59 - 2015-01-12 03:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 03:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-02-12 18:59 - 2015-01-12 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-02-12 18:59 - 2015-01-12 03:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 03:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-02-12 18:59 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-02-12 18:59 - 2015-01-12 03:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-02-12 18:59 - 2015-01-12 03:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-02-12 18:59 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-02-12 18:59 - 2015-01-12 03:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-02-12 18:59 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-02-12 18:59 - 2015-01-12 03:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-02-12 18:59 - 2015-01-12 03:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-02-12 18:59 - 2015-01-12 02:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-02-12 18:59 - 2015-01-12 02:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-02-12 18:59 - 2015-01-12 02:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-02-12 18:59 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-02-12 18:59 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-02-12 18:59 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-02-12 18:59 - 2015-01-12 02:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-02-12 18:59 - 2015-01-12 02:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-02-12 18:59 - 2015-01-12 02:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-02-12 18:59 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-02-12 18:59 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-02-12 18:59 - 2015-01-12 02:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-02-12 18:59 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-02-12 18:59 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-02-12 18:59 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-02-12 18:59 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-02-12 18:59 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-02-12 18:59 - 2015-01-10 07:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-02-12 18:58 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-02-12 18:58 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-02-12 18:58 - 2015-01-12 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-02-12 18:58 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-02-12 18:56 - 2015-01-15 09:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-02-12 18:56 - 2015-01-15 09:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-02-12 18:56 - 2015-01-15 09:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-02-12 18:56 - 2015-01-15 09:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-02-12 18:56 - 2015-01-15 09:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-02-12 18:56 - 2015-01-15 09:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-02-12 18:56 - 2015-01-15 09:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-02-12 18:56 - 2015-01-15 09:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-02-12 18:56 - 2015-01-15 09:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-02-12 18:56 - 2015-01-15 08:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-02-12 18:56 - 2015-01-15 08:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-02-12 18:56 - 2015-01-15 08:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-02-12 18:56 - 2015-01-15 08:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-02-12 18:56 - 2015-01-15 08:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-02-12 18:56 - 2015-01-15 05:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-02-12 18:56 - 2015-01-14 07:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 07:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-02-12 18:56 - 2015-01-14 07:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-02-12 18:56 - 2015-01-14 07:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-02-12 18:56 - 2015-01-14 06:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-02-12 18:56 - 2015-01-14 06:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-02-12 18:56 - 2015-01-13 04:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-13 03:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-02-12 18:56 - 2015-01-09 03:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-02-12 18:56 - 2014-12-12 06:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-02-12 18:56 - 2014-12-12 06:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-02-12 18:56 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll 2015-02-12 18:56 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll 2015-02-12 18:56 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll 2015-02-12 18:56 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll 2015-02-12 18:56 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2015-02-12 18:56 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2015-02-12 18:56 - 2014-07-07 03:07 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-02-12 18:56 - 2014-07-07 03:06 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-02-12 18:56 - 2014-07-07 02:40 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-02-04 12:39 - 2015-02-04 12:39 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2015-02-02 15:08 - 2015-02-02 15:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Live Add-in 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\TuneUp Software 2015-02-02 14:50 - 2015-02-02 14:50 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:50 - 00000000 ____D () C:\ProgramData\TuneUp Software 2015-02-02 14:49 - 2015-02-02 14:49 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C} 2015-02-02 14:46 - 2015-02-02 14:47 - 00105808 _____ (GreenTree Applications SRL) C:\Users\TJHHH\Downloads\YTDSetup.exe 2015-02-02 14:36 - 2015-02-02 14:36 - 00005056 _____ () C:\Windows\SysWOW64\LavasoftTcpService.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\SysWOW64\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00002752 _____ () C:\Windows\system32\LavasoftTcpServiceOff.ini 2015-02-02 14:36 - 2015-02-02 14:36 - 00000000 ____D () C:\searchplugins 2015-02-02 14:36 - 2015-01-23 06:39 - 00378832 _____ (Lavasoft Limited) C:\Windows\system32\LavasoftTcpService64.dll 2015-02-02 14:36 - 2015-01-23 06:39 - 00332216 _____ (Lavasoft Limited) C:\Windows\SysWOW64\LavasoftTcpService.dll 2015-02-02 14:32 - 2015-02-02 15:15 - 00000000 ____D () C:\Users\TJHHH\AppData\Roaming\DVDVideoSoft 2015-02-02 14:31 - 2015-02-02 14:32 - 03533008 _____ (DVDVideoSoft Ltd. ) C:\Users\TJHHH\Downloads\FreeYouTubeDownload.exe ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-02-24 19:08 - 2015-01-14 20:43 - 00000000 ____D () C:\Users\TJHHH\AppData\Local\Google 2015-02-24 19:08 - 2015-01-14 20:43 - 00000000 ____D () C:\Program Files (x86)\Google 2015-02-24 18:57 - 2015-01-14 21:54 - 00000000 ____D () C:\ProgramData\Kaspersky Lab 2015-02-24 18:49 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-02-24 18:49 - 2009-07-14 05:45 - 00021872 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-02-24 18:48 - 2011-04-12 08:43 - 00700128 _____ () C:\Windows\system32\perfh007.dat 2015-02-24 18:48 - 2011-04-12 08:43 - 00149766 _____ () C:\Windows\system32\perfc007.dat 2015-02-24 18:48 - 2009-07-14 06:13 - 01622694 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-02-24 18:46 - 2015-01-14 20:35 - 01507283 _____ () C:\Windows\WindowsUpdate.log 2015-02-24 18:42 - 2015-01-14 21:16 - 00000000 ____D () C:\ProgramData\NVIDIA 2015-02-24 18:42 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-02-24 18:42 - 2009-07-14 05:51 - 00042864 _____ () C:\Windows\setupact.log 2015-02-23 20:42 - 2010-11-21 04:47 - 00016582 _____ () C:\Windows\PFRO.log 2015-02-21 20:23 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2015-02-21 20:22 - 2009-07-14 03:34 - 62128128 _____ () C:\Windows\system32\config\SOFTWARE.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 19398656 _____ () C:\Windows\system32\config\SYSTEM.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00262144 _____ () C:\Windows\system32\config\DEFAULT.bak 2015-02-21 20:22 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2015-02-21 15:09 - 2015-01-14 20:35 - 00000000 ____D () C:\Users\TJHHH 2015-02-20 13:09 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing 2015-02-19 19:44 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-02-14 20:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2015-02-13 03:19 - 2009-07-14 05:45 - 00411240 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ___SD () C:\Windows\system32\CompatTel 2015-02-13 03:18 - 2015-01-19 11:35 - 00000000 ____D () C:\Windows\system32\appraiser 2015-02-13 03:18 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2015-02-13 03:03 - 2015-01-19 13:19 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-02-13 03:02 - 2015-01-19 11:42 - 00000000 ____D () C:\Windows\system32\MRT 2015-02-13 03:00 - 2015-01-19 11:42 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-02-02 15:08 - 2015-01-19 13:19 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office 2015-02-02 15:05 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD ==================== Files in the root of some directories ======= 2015-01-14 20:48 - 2015-01-14 20:48 - 0000000 ____H () C:\ProgramData\DP45977C.lfl ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-02-13 03:00 ==================== End Of Log ============================ --- --- --- ad guard blockt aber weiterhin 2x werbung ist das ok? |
|
25.02.2015, 07:12
| #13 |
| /// the machine /// TB-Ausbilder | Ads Positive Finds bei win7 - wie entfernen ? In welchem Browser? Auf welchen Seiten?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.02.2015, 19:58
| #14 |
| | Ads Positive Finds bei win7 - wie entfernen ? das ist aus crome mit google als startseite Code:
ATTFilter ! Global whitelists for ad tags etc.
@@||googlesyndication.com/pagead/images/mobile_unified_button_icon_black.png|$image
@@||googlesyndication.com/pagead/images/mobile_unified_button_icon_white.png|$image
@@||googlesyndication.com/pagead/images/ad_choices_*.png|$image
@@||googlesyndication.com/pagead/images/adchoices/*.png|$image
@@||googlesyndication.com/pagead/*_new_ico.gif|$image
@@||googlesyndication.com/pagead/images/nessie_icon_$image
@@||googlesyndication.com/pagead/abglogo/*.png|$image
@@||googlesyndication.com/pagead/images/google-logo.png|$image
@@||googlesyndication.com/pagead/images/x_button_$image
@@||googlesyndication.com/pagead/js/graphics.js$domain=g.doubleclick.net
@@||googlesyndication.com/bg/*.js|$domain=g.doubleclick.net
@@||googleads.g.doubleclick.net/aclk^$subdocument
@@||googleadservices.com/pagead/aclk^$subdocument
@@||g.doubleclick.net/aclk?*&adurl=$popup
g.doubleclick.net#@##ads
g.doubleclick.net#@##adunit
g.doubleclick.net#@##adunit > #ads
googlesyndication.com#@##adunit
! Combined element hinding whitelist for sites using AFC ads
hon30.org,thejournal.link,konevsky.net.ua,couchwives.de,my-personaltrainer.it,androidworld.it,netzwelt.de,stadtbranchenbuch-berlin.de,stadtbranchenbuch-hamburg.de,stadtbranchenbuch-muenchen.de,stadtbranchenbuch-koeln.de,stadtbranchenbuch-frankfurt.de,stadtbranchenbuch-duesseldorf.de,stadtbranchenbuch-stuttgart.de,stadtbranchenbuch-hannover.de,stadtbranchenbuch-bremen.de,stadtbranchenbuch-nuernberg.de,stadtbranchenbuch-essen.de,stadtbranchenbuch-dresden.de,stadtbranchenbuch-leipzig.de,stadtbranchenbuch-dortmund.de,stadtbranchenbuch-bonn.de,stadtbranchenbuch-karlsruhe.de,stadtbranchenbuch-wuppertal.de,stadtbranchenbuch-mannheim.de,stadtbranchenbuch-bielefeld.de,stadtbranchenbuch-wiesbaden.de,stadtbranchenbuch-duisburg.de,stadtbranchenbuch-bochum.de,stadtbranchenbuch-muenster.de,stadtbranchenbuch-freiburg.de,stadtbranchenbuch-augsburg.de,stadtbranchenbuch-aachen.de,stadtbranchenbuch-chemnitz.de,stadtbranchenbuch-braunschweig.de,stadtbranchenbuch-moenchengladbach.de,stadtbranchenbuch-kiel.de,stadtbranchenbuch-mainz.de,stadtbranchenbuch-saarbruecken.de,stadtbranchenbuch-kassel.de,stadtbranchenbuch-magdeburg.de,stadtbranchenbuch-erfurt.de,stadtbranchenbuch-krefeld.de,stadtbranchenbuch-luebeck.de,stadtbranchenbuch-halle.de,stadtbranchenbuch-oldenburg.de,stadtbranchenbuch-regensburg.de,stadtbranchenbuch-heidelberg.de,generadormemes.com,chroface.com,ufsin.com,wallpaperme.de,filedir.com,guterhut.de,campfyre.org,adhs-studien.info,rushtips.com,guterhut.de,rainbowdash.net,divertir.eu,urban-legend.net,theiapolis.com,hec.su,witnessmyrage.com,ellomedia.de,finanology.co,darkstoorm.pl,darkrealmgaming.com,gislounge.com,geolounge.com,wot-top.ru,mered.de,doorinworld.ru,cyfrowydoradca.pl,netdoktor.de,motojob.ru,01referencement.com,diary.anek.ws,mrkmg.com,thenoob.net,linuxrussia.com,allanekdot.ru,dartosphere.org,tablica-rejestracyjna.pl,nazwiska-polskie.pl,videoquality.pl,cylex.ch,cylex.be,cylex-bedrijvengids.be,cylex.de,cylex.ca,cylex.com.au,cylex-bedrijvengids.nl,cylex-branchenbuch.ch,cylex-oesterreich.at,cylex-uk.co.uk,cylex-usa.com,cylex.cl,cylex.co.nz,cylex.co.za,cylex.com.ar,cylex.com.br,cylex.com.co,cylex.com.mx,cylex.com.ng,cylex.com.pe,cylex.com.tr,cylex.com.ve,cylex.cz,cylex.dk,cylex.fi,cylex.gr,cylex.ie,cylex.in,cylex.it,cylex.no,cylex.pl,cylex.pt,cylex.se,cylex.sk,cylex-espana.es,cylex-florida.com,cylex-france.fr,cylex.ro,cylex.hu,opendi.at,opendi.de,opendi.ch,opendi.be,opendi.ca,opendi.cl,opendi.co,opendi.co.id,opendi.co.nz,opendi.co.uk,opendi.com.ar,opendi.com.au,opendi.com.br,opendi.com.pa,opendi.com.pr,opendi.com.tr,opendi.com.ve,opendi.dk,opendi.es,opendi.fi,opendi.fr,opendi.hu,opendi.hk,opendi.in,opendi.it,opendi.jp,opendi.lu,opendi.mx,opendi.nl,opendi.no,opendi.pe,opendi.pl,opendi.pt,opendi.ro,opendi.se,opendi.si,opendi.sg,opendi.us,stadtbranchenbuch.ch,stadtbranchenbuch.at,stadtbranchenbuch.com,uszip.com,ehow.com,linternaute.com,hayatouki.com,jeux-gratuits.com,hugolescargot.com,101sovet.ucoz.net,nakomputer.ru,ccnahub.com,senseyeesports.com,reviewsnewage.com,nikkomania.com,math1.ru,teneriffa-news.com,gdziezjesc.info,brainleg.com,similarsites.com,topsite.com,recycledmistakes.com,freenet.de,quoka.de,softconstructors.com,livestrong.com,wg-gesucht.de,gutefrage.net,autofrage.net,computerfrage.net,finanzfrage.net,gesundheitsfrage.net,motorradfrage.net,produktfrage.net,reisefrage.net,sportlerfrage.net,helpster.de,cosmiq.de,freenewhampshireblog.com,eyeonlinux.com,desktoplinuxreviews.com,jimlynch.com,catzware.com,pointoo.de,reawakens.net,winfuture.de,it-psycho.de,testsucher.de,lee.org,events12.com,tsvbodnegg.de,tools4free.eu,computerbase.de,kitor.pl,sspotsify.com,code-reference.com,blogginger.de,eaveselectrical.co.uk,minecraft.dlk.pl,innenaussen.com,tabletsbaratas.net,bancmoteur.com,cuisine-ultime.fr,blogdemigueldiaz.com,e-cougar.fr,olek.tk,yourlaws.ca,android-forum.hu,strickmuehle.com,edumagazin.de,spielewiki.de,udlun.com,animeblogreviews.com,energyauditorhq.com,eolienne.f4jr.org,ship.org.ua,pdasite.pl,yaberemenna.info,rex4.com,fastquake.com,autismoaba.org,onet.pl,hackthis.co.uk,etymonline.com,compactlaw.co.uk,gentlesimplicity.com,nachbarchat.de,futbolitis.com,mojdom.net.ua,pagewizz.com,homework.net.ua,youtuberepetir.com,omolody.ru,wikihoops.com,chip.de,jubiley.ru,inodroid.ru,and.ck.ua,tweakguides.com,fanorg.net,cornwallhoney.co.uk,rezepte-cocktails.de,ekant.ru,seoslim.ru,inside11.de,iforo.net,yak-zrobyty.pp.ua,wf.uzerbar.ru,chaype.ru,iconicphotos.ru,monsterreport.de,cardfight.ru,ostroykevse.ru,gold-cottage.ru,webdesigner-tutorials.de,anglissime.com,payzle.com,juramagazin.de,mijnkapitaal.be,kidsvod.net,fitnessuebungen-zuhause.de,homegym-exercises.com,booksshouldbefree.com,dogspot.de,dogspot.ch,dogspot.at,catspot.de,catspot.at,catspot.ch,horsespot.de,horsespot.at,horsespot.ch,alexfbp.atwebpages.com,norma.org.ua,ilovefreesoftware.com,vlvit.ru,t4mag.com,popculture-y.com,pkmn.net,flying-news.com,fwcalc.com,uninst.ru,for-androidos.com,100cards.ru,ried.cl,abbreviations.com,definitions.net,convert.net,kamus.net,lyrics.net,phrases.net,quotes.net,references.net,rhymes.net,synonyms.net,juradmin.com#@#iframe[id^="google_ads_frame"]
hon30.org,thejournal.link,konevsky.net.ua,couchwives.de,my-personaltrainer.it,androidworld.it,netzwelt.de,stadtbranchenbuch-berlin.de,stadtbranchenbuch-hamburg.de,stadtbranchenbuch-muenchen.de,stadtbranchenbuch-koeln.de,stadtbranchenbuch-frankfurt.de,stadtbranchenbuch-duesseldorf.de,stadtbranchenbuch-stuttgart.de,stadtbranchenbuch-hannover.de,stadtbranchenbuch-bremen.de,stadtbranchenbuch-nuernberg.de,stadtbranchenbuch-essen.de,stadtbranchenbuch-dresden.de,stadtbranchenbuch-leipzig.de,stadtbranchenbuch-dortmund.de,stadtbranchenbuch-bonn.de,stadtbranchenbuch-karlsruhe.de,stadtbranchenbuch-wuppertal.de,stadtbranchenbuch-mannheim.de,stadtbranchenbuch-bielefeld.de,stadtbranchenbuch-wiesbaden.de,stadtbranchenbuch-duisburg.de,stadtbranchenbuch-bochum.de,stadtbranchenbuch-muenster.de,stadtbranchenbuch-freiburg.de,stadtbranchenbuch-augsburg.de,stadtbranchenbuch-aachen.de,stadtbranchenbuch-chemnitz.de,stadtbranchenbuch-braunschweig.de,stadtbranchenbuch-moenchengladbach.de,stadtbranchenbuch-kiel.de,stadtbranchenbuch-mainz.de,stadtbranchenbuch-saarbruecken.de,stadtbranchenbuch-kassel.de,stadtbranchenbuch-magdeburg.de,stadtbranchenbuch-erfurt.de,stadtbranchenbuch-krefeld.de,stadtbranchenbuch-luebeck.de,stadtbranchenbuch-halle.de,stadtbranchenbuch-oldenburg.de,stadtbranchenbuch-regensburg.de,stadtbranchenbuch-heidelberg.de,generadormemes.com,chroface.com,ufsin.com,wallpaperme.de,filedir.com,guterhut.de,campfyre.org,adhs-studien.info,rushtips.com,guterhut.de,rainbowdash.net,divertir.eu,urban-legend.net,theiapolis.com,hec.su,witnessmyrage.com,ellomedia.de,finanology.co,darkstoorm.pl,darkrealmgaming.com,gislounge.com,geolounge.com,wot-top.ru,mered.de,doorinworld.ru,cyfrowydoradca.pl,netdoktor.de,motojob.ru,01referencement.com,diary.anek.ws,mrkmg.com,thenoob.net,linuxrussia.com,allanekdot.ru,dartosphere.org,tablica-rejestracyjna.pl,nazwiska-polskie.pl,videoquality.pl,cylex.ch,cylex.be,cylex-bedrijvengids.be,cylex.de,cylex.ca,cylex.com.au,cylex-bedrijvengids.nl,cylex-branchenbuch.ch,cylex-oesterreich.at,cylex-uk.co.uk,cylex-usa.com,cylex.cl,cylex.co.nz,cylex.co.za,cylex.com.ar,cylex.com.br,cylex.com.co,cylex.com.mx,cylex.com.ng,cylex.com.pe,cylex.com.tr,cylex.com.ve,cylex.cz,cylex.dk,cylex.fi,cylex.gr,cylex.ie,cylex.in,cylex.it,cylex.no,cylex.pl,cylex.pt,cylex.se,cylex.sk,cylex-espana.es,cylex-florida.com,cylex-france.fr,cylex.ro,cylex.hu,opendi.at,opendi.de,opendi.ch,opendi.be,opendi.ca,opendi.cl,opendi.co,opendi.co.id,opendi.co.nz,opendi.co.uk,opendi.com.ar,opendi.com.au,opendi.com.br,opendi.com.pa,opendi.com.pr,opendi.com.tr,opendi.com.ve,opendi.dk,opendi.es,opendi.fi,opendi.fr,opendi.hu,opendi.hk,opendi.in,opendi.it,opendi.jp,opendi.lu,opendi.mx,opendi.nl,opendi.no,opendi.pe,opendi.pl,opendi.pt,opendi.ro,opendi.se,opendi.si,opendi.sg,opendi.us,stadtbranchenbuch.ch,stadtbranchenbuch.at,stadtbranchenbuch.com,uszip.com,ehow.com,linternaute.com,hayatouki.com,jeux-gratuits.com,hugolescargot.com,101sovet.ucoz.net,nakomputer.ru,ccnahub.com,senseyeesports.com,reviewsnewage.com,nikkomania.com,math1.ru,teneriffa-news.com,gdziezjesc.info,brainleg.com,similarsites.com,topsite.com,recycledmistakes.com,freenet.de,quoka.de,softconstructors.com,livestrong.com,wg-gesucht.de,gutefrage.net,autofrage.net,computerfrage.net,finanzfrage.net,gesundheitsfrage.net,motorradfrage.net,produktfrage.net,reisefrage.net,sportlerfrage.net,helpster.de,cosmiq.de,freenewhampshireblog.com,eyeonlinux.com,desktoplinuxreviews.com,jimlynch.com,catzware.com,pointoo.de,reawakens.net,winfuture.de,it-psycho.de,testsucher.de,lee.org,events12.com,tsvbodnegg.de,tools4free.eu,computerbase.de,kitor.pl,sspotsify.com,code-reference.com,blogginger.de,eaveselectrical.co.uk,minecraft.dlk.pl,innenaussen.com,tabletsbaratas.net,bancmoteur.com,cuisine-ultime.fr,blogdemigueldiaz.com,e-cougar.fr,olek.tk,yourlaws.ca,android-forum.hu,strickmuehle.com,edumagazin.de,spielewiki.de,udlun.com,animeblogreviews.com,energyauditorhq.com,eolienne.f4jr.org,ship.org.ua,pdasite.pl,yaberemenna.info,rex4.com,fastquake.com,autismoaba.org,onet.pl,hackthis.co.uk,etymonline.com,compactlaw.co.uk,gentlesimplicity.com,nachbarchat.de,futbolitis.com,mojdom.net.ua,pagewizz.com,homework.net.ua,youtuberepetir.com,omolody.ru,wikihoops.com,chip.de,jubiley.ru,inodroid.ru,and.ck.ua,tweakguides.com,fanorg.net,cornwallhoney.co.uk,rezepte-cocktails.de,ekant.ru,seoslim.ru,inside11.de,iforo.net,yak-zrobyty.pp.ua,wf.uzerbar.ru,chaype.ru,iconicphotos.ru,monsterreport.de,cardfight.ru,ostroykevse.ru,gold-cottage.ru,webdesigner-tutorials.de,anglissime.com,payzle.com,juramagazin.de,mijnkapitaal.be,kidsvod.net,fitnessuebungen-zuhause.de,homegym-exercises.com,booksshouldbefree.com,dogspot.de,dogspot.ch,dogspot.at,catspot.de,catspot.at,catspot.ch,horsespot.de,horsespot.at,horsespot.ch,alexfbp.atwebpages.com,norma.org.ua,ilovefreesoftware.com,vlvit.ru,t4mag.com,popculture-y.com,pkmn.net,flying-news.com,fwcalc.com,uninst.ru,for-androidos.com,100cards.ru,ried.cl,abbreviations.com,definitions.net,convert.net,kamus.net,lyrics.net,phrases.net,quotes.net,references.net,rhymes.net,synonyms.net,juradmin.com#@#iframe[id^="google_ads_iframe"]
hon30.org,thejournal.link,konevsky.net.ua,couchwives.de,my-personaltrainer.it,androidworld.it,netzwelt.de,stadtbranchenbuch-berlin.de,stadtbranchenbuch-hamburg.de,stadtbranchenbuch-muenchen.de,stadtbranchenbuch-koeln.de,stadtbranchenbuch-frankfurt.de,stadtbranchenbuch-duesseldorf.de,stadtbranchenbuch-stuttgart.de,stadtbranchenbuch-hannover.de,stadtbranchenbuch-bremen.de,stadtbranchenbuch-nuernberg.de,stadtbranchenbuch-essen.de,stadtbranchenbuch-dresden.de,stadtbranchenbuch-leipzig.de,stadtbranchenbuch-dortmund.de,stadtbranchenbuch-bonn.de,stadtbranchenbuch-karlsruhe.de,stadtbranchenbuch-wuppertal.de,stadtbranchenbuch-mannheim.de,stadtbranchenbuch-bielefeld.de,stadtbranchenbuch-wiesbaden.de,stadtbranchenbuch-duisburg.de,stadtbranchenbuch-bochum.de,stadtbranchenbuch-muenster.de,stadtbranchenbuch-freiburg.de,stadtbranchenbuch-augsburg.de,stadtbranchenbuch-aachen.de,stadtbranchenbuch-chemnitz.de,stadtbranchenbuch-braunschweig.de,stadtbranchenbuch-moenchengladbach.de,stadtbranchenbuch-kiel.de,stadtbranchenbuch-mainz.de,stadtbranchenbuch-saarbruecken.de,stadtbranchenbuch-kassel.de,stadtbranchenbuch-magdeburg.de,stadtbranchenbuch-erfurt.de,stadtbranchenbuch-krefeld.de,stadtbranchenbuch-luebeck.de,stadtbranchenbuch-halle.de,stadtbranchenbuch-oldenburg.de,stadtbranchenbuch-regensburg.de,stadtbranchenbuch-heidelberg.de,generadormemes.com,chroface.com,ufsin.com,wallpaperme.de,filedir.com,guterhut.de,campfyre.org,adhs-studien.info,rushtips.com,guterhut.de,rainbowdash.net,divertir.eu,urban-legend.net,theiapolis.com,hec.su,witnessmyrage.com,ellomedia.de,finanology.co,darkstoorm.pl,darkrealmgaming.com,gislounge.com,geolounge.com,wot-top.ru,mered.de,doorinworld.ru,cyfrowydoradca.pl,netdoktor.de,motojob.ru,01referencement.com,diary.anek.ws,mrkmg.com,thenoob.net,linuxrussia.com,allanekdot.ru,dartosphere.org,tablica-rejestracyjna.pl,nazwiska-polskie.pl,videoquality.pl,cylex.ch,cylex.be,cylex-bedrijvengids.be,cylex.de,cylex.ca,cylex.com.au,cylex-bedrijvengids.nl,cylex-branchenbuch.ch,cylex-oesterreich.at,cylex-uk.co.uk,cylex-usa.com,cylex.cl,cylex.co.nz,cylex.co.za,cylex.com.ar,cylex.com.br,cylex.com.co,cylex.com.mx,cylex.com.ng,cylex.com.pe,cylex.com.tr,cylex.com.ve,cylex.cz,cylex.dk,cylex.fi,cylex.gr,cylex.ie,cylex.in,cylex.it,cylex.no,cylex.pl,cylex.pt,cylex.se,cylex.sk,cylex-espana.es,cylex-florida.com,cylex-france.fr,cylex.ro,cylex.hu,opendi.at,opendi.de,opendi.ch,opendi.be,opendi.ca,opendi.cl,opendi.co,opendi.co.id,opendi.co.nz,opendi.co.uk,opendi.com.ar,opendi.com.au,opendi.com.br,opendi.com.pa,opendi.com.pr,opendi.com.tr,opendi.com.ve,opendi.dk,opendi.es,opendi.fi,opendi.fr,opendi.hu,opendi.hk,opendi.in,opendi.it,opendi.jp,opendi.lu,opendi.mx,opendi.nl,opendi.no,opendi.pe,opendi.pl,opendi.pt,opendi.ro,opendi.se,opendi.si,opendi.sg,opendi.us,stadtbranchenbuch.ch,stadtbranchenbuch.at,stadtbranchenbuch.com,uszip.com,ehow.com,linternaute.com,hayatouki.com,jeux-gratuits.com,hugolescargot.com,101sovet.ucoz.net,nakomputer.ru,ccnahub.com,senseyeesports.com,reviewsnewage.com,nikkomania.com,math1.ru,teneriffa-news.com,gdziezjesc.info,brainleg.com,similarsites.com,topsite.com,recycledmistakes.com,freenet.de,quoka.de,softconstructors.com,livestrong.com,wg-gesucht.de,gutefrage.net,autofrage.net,computerfrage.net,finanzfrage.net,gesundheitsfrage.net,motorradfrage.net,produktfrage.net,reisefrage.net,sportlerfrage.net,helpster.de,cosmiq.de,freenewhampshireblog.com,eyeonlinux.com,desktoplinuxreviews.com,jimlynch.com,catzware.com,pointoo.de,reawakens.net,winfuture.de,it-psycho.de,testsucher.de,lee.org,events12.com,tsvbodnegg.de,tools4free.eu,computerbase.de,kitor.pl,sspotsify.com,code-reference.com,blogginger.de,eaveselectrical.co.uk,minecraft.dlk.pl,innenaussen.com,tabletsbaratas.net,bancmoteur.com,cuisine-ultime.fr,blogdemigueldiaz.com,e-cougar.fr,olek.tk,yourlaws.ca,android-forum.hu,strickmuehle.com,edumagazin.de,spielewiki.de,udlun.com,animeblogreviews.com,energyauditorhq.com,eolienne.f4jr.org,ship.org.ua,pdasite.pl,yaberemenna.info,rex4.com,fastquake.com,autismoaba.org,onet.pl,hackthis.co.uk,etymonline.com,compactlaw.co.uk,gentlesimplicity.com,nachbarchat.de,futbolitis.com,mojdom.net.ua,pagewizz.com,homework.net.ua,youtuberepetir.com,omolody.ru,wikihoops.com,chip.de,jubiley.ru,inodroid.ru,and.ck.ua,tweakguides.com,fanorg.net,cornwallhoney.co.uk,rezepte-cocktails.de,ekant.ru,seoslim.ru,inside11.de,iforo.net,yak-zrobyty.pp.ua,wf.uzerbar.ru,chaype.ru,iconicphotos.ru,monsterreport.de,cardfight.ru,ostroykevse.ru,gold-cottage.ru,webdesigner-tutorials.de,anglissime.com,payzle.com,juramagazin.de,mijnkapitaal.be,kidsvod.net,fitnessuebungen-zuhause.de,homegym-exercises.com,booksshouldbefree.com,dogspot.de,dogspot.ch,dogspot.at,catspot.de,catspot.at,catspot.ch,horsespot.de,horsespot.at,horsespot.ch,alexfbp.atwebpages.com,norma.org.ua,ilovefreesoftware.com,vlvit.ru,t4mag.com,popculture-y.com,pkmn.net,flying-news.com,fwcalc.com,uninst.ru,for-androidos.com,100cards.ru,ried.cl,abbreviations.com,definitions.net,convert.net,kamus.net,lyrics.net,phrases.net,quotes.net,references.net,rhymes.net,synonyms.net,juradmin.com##.adsbygoogle
! Experimental
@@##a[href*=".doubleclick.net/activity"]
@@||doubleclick.net/activity*$subdocument,image
@@||doubleclick.net/json
@@||doubleclick.net/pagead/conversion
@@||fls.doubleclick.net^$subdocument,image
@@||google.com/ads/conversion
@@||google.com/ads/user-lists/$image,subdocument,third-party
@@||google.com/gen_204
@@||googleads.g.doubleclick.net/aclk$subdocument
@@||googleads.g.doubleclick.net/pagead/conversion
@@||googleads.g.doubleclick.net/pagead/viewthroughconversion$subdocument,image
@@||googleadservices.com/pagead/conversion
@@||googleadservices.com/pagead/viewthroughconversion
@@||googletagmanager.com/gtm.js
@@||stats.g.doubleclick.net^$script,image
|
|
27.02.2015, 07:20
| #15 |
| /// the machine /// TB-Ausbilder | Ads Positive Finds bei win7 - wie entfernen ? Hast Du wie oben angegeben Chrome deinstalliert mit Revo?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Ads Positive Finds bei win7 - wie entfernen ? |
| .dll, administrator, adobe, browser, defender, dvdvideosoft ltd., entfernen, explorer, google, helper, iexplore.exe, kaspersky, nvidia, realtek, registry, rundll, scan, security, services.exe, software, svchost.exe, system, temp, usb, web companion, windows, winlogon.exe |
WARNUNG an die MITLESER: 
Linear-Darstellung
