Win8: Internet langsam & zufälliges Ordner verschieben

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 21:14 on 07/03/2015 (Richard)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 07-03-2015 01
Ran by Richard (administrator) on PINKMAN on 07-03-2015 21:17:47
Running from C:\Users\Richard\Desktop
Loaded Profiles: Richard (Available profiles: Richard)
Platform: Windows 8.1 Pro (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Atheros Commnucations) C:\Windows\System32\AdminService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMEvent.exe
(Acer Incorporate) C:\Program Files\Acer\Acer Launch Manager\LMTray.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17477_none_fa2b7d3b9b36c7b4\TiWorker.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13651672 2013-09-03] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-30] (Realtek Semiconductor)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] => "C:\PROGRA~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2778352 2013-10-01] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2463552 2014-10-04] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [RadioRage EPM Support] => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jmedint.exe" T8EPMSUP.DLL,S
HKLM-x32\...\Run: [RadioRage Search Scope Monitor] => "C:\PROGRA~2\RADIOR~1\bar\1.bin\4jsrchmn.exe" /m=2 /w /h
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2099200 2014-04-13] (Dominik Reichl)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2014-01-10] ()
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [703280 2015-03-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [127792 2015-02-12] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: igfxdev.dll [X]
HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [2874048 2015-02-19] (Valve Corporation)
HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\...\Run: [Spotify Web Helper] => C:\Users\Richard\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2014-12-12] (Spotify Ltd)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [174856 2014-09-14] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [156840 2014-09-14] (NVIDIA Corporation)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt.25.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:Tabs
SearchScopes: HKLM-x32 -> DefaultScope value is missing.
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-27] (Oracle Corporation)
BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files (x86)\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-27] (Oracle Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL [2014-03-12] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-08] ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.0 -> C:\Program Files\VLC\npvlc.dll [2013-09-25] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-08] ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll [2014-05-22] (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll [2014-11-21] (DivX, LLC)
FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit Reader\plugins\npFoxitReaderPlugin.dll No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-04] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-27] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MIF5BA~1\Office15\NPSPWRAP.DLL [2014-01-22] (Microsoft Corporation)
FF Plugin-x32: @RadioRage_4j.com/Plugin -> C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-05] (Google Inc.)
FF SearchPlugin: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\searchplugins\dictcc.xml [2014-09-19]
FF SearchPlugin: C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\searchplugins\wolframalpha.xml [2014-09-08]
FF Extension: HTTPS-Everywhere - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\https-everywhere@eff.org [2015-01-24]
FF Extension: ChatZilla - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2} [2014-12-20]
FF Extension: SearchPreview - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\{EF522540-89F5-46b9-B6FE-1829E2B572C6} [2015-01-21]
FF Extension: Disconnect - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\2.0@disconnect.me.xpi [2014-09-12]
FF Extension: anonymoX - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\client@anonymox.net.xpi [2014-09-04]
FF Extension: Cahoots - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\jid1-mQ1GT2z5DSpT9g@jetpack.xpi [2014-11-15]
FF Extension: InstantFox - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\searchy@searchy.xpi [2014-09-04]
FF Extension: Adblock Edge - C:\Users\Richard\AppData\Roaming\Mozilla\Firefox\Profiles\mknq5ome.default-1409852487037\Extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi [2014-09-04]

Chrome: 
=======
CHR Profile: C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-02-05]
CHR Extension: (Google Docs) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-05]
CHR Extension: (Google Drive) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-05]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-02-05]
CHR Extension: (YouTube) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-05]
CHR Extension: (Adblock Plus) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-02-05]
CHR Extension: (Google Search) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-05]
CHR Extension: (Google Sheets) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-02-05]
CHR Extension: (Avira Browser Safety) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-02-05]
CHR Extension: (Google Wallet) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-05]
CHR Extension: (Gmail) - C:\Users\Richard\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-05]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-03] (Avira Operations GmbH & Co. KG)
R2 AtherosSvc; C:\Windows\system32\AdminService.exe [208384 2012-08-29] (Atheros Commnucations) [File not signed]
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [184056 2015-02-12] (Avira Operations GmbH & Co. KG)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-10-04] (NVIDIA Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [329104 2014-10-03] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-04] (Intel Corporation)
R2 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [457768 2013-08-02] (Acer Incorporate)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-10-04] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19440960 2014-10-04] (NVIDIA Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [368632 2014-09-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2014-09-22] (Microsoft Corporation)
S2 RadioRage_4jService; C:\PROGRA~2\RADIOR~1\bar\1.bin\4jbarsvc.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [132120 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2014-08-15] (Avira Operations GmbH & Co. KG)
S3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20288 2014-10-04] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38048 2014-09-04] (NVIDIA Corporation)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [427736 2013-08-09] (Realsil Semiconductor Corporation)
R3 SensorsSimulatorDriver; C:\Windows\system32\DRIVERS\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-10-01] (Synaptics Incorporated)
S3 taphss6; C:\Windows\system32\DRIVERS\taphss6.sys [42184 2014-01-14] (Anchorfree Inc.)
S3 tapoas; C:\Windows\system32\DRIVERS\tapoas.sys [30720 2012-07-15] (The OpenVPN Project)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2014-09-22] (Microsoft Corporation)
S3 EverestDriver; \??\C:\Users\Richard\AppData\Local\Temp\EverestDriver.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 21:17 - 2015-03-07 21:17 - 00019545 _____ () C:\Users\Richard\Desktop\FRST.txt
2015-03-07 21:17 - 2015-03-07 21:17 - 00000000 ____D () C:\FRST
2015-03-07 21:15 - 2015-03-07 21:15 - 02094592 _____ (Farbar) C:\Users\Richard\Desktop\FRST64.exe
2015-03-07 21:14 - 2015-03-07 21:14 - 00000476 _____ () C:\Users\Richard\Desktop\defogger_disable.log
2015-03-07 21:14 - 2015-03-07 21:14 - 00000000 _____ () C:\Users\Richard\defogger_reenable
2015-03-07 21:12 - 2015-03-07 21:12 - 00050477 _____ () C:\Users\Richard\Desktop\Defogger.exe
2015-03-07 20:41 - 2015-03-07 20:41 - 00002199 _____ () C:\Users\Richard\Desktop\Avira.lnk
2015-03-07 15:08 - 2015-03-07 15:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-06 13:17 - 2015-03-06 14:01 - 00000000 ____D () C:\Users\Richard\Documents\My Digital Editions
2015-03-06 13:16 - 2010-01-16 02:14 - 14020351 _____ (Adobe Systems, Inc.) C:\Users\Richard\Downloads\digitaleditions.exe
2015-03-06 13:12 - 2015-03-06 13:12 - 00001808 _____ () C:\Users\Richard\Downloads\URLLink.acsm
2015-03-02 17:21 - 2015-03-02 17:21 - 00001506 _____ () C:\Users\Richard\Desktop\Dropbox - GGET 3.lnk
2015-02-24 23:01 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-24 23:01 - 2014-12-13 22:28 - 00513488 _____ () C:\Windows\system32\locale.nls
2015-02-21 19:43 - 2015-02-21 19:43 - 00000000 ____D () C:\Users\Richard\AppData\Local\Steam
2015-02-18 18:52 - 2015-02-18 18:52 - 00000000 ____D () C:\Users\Richard\AppData\Local\Sync-my-L2P
2015-02-18 18:51 - 2015-02-18 18:51 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sync-my-L2P
2015-02-18 18:51 - 2015-02-18 18:51 - 00000000 ____D () C:\Program Files (x86)\SyncMyL2P-2.0
2015-02-12 09:38 - 2015-01-23 05:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-02-12 09:38 - 2015-01-23 04:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-02-11 19:20 - 2015-01-19 19:42 - 01487976 _____ (Microsoft Corporation) C:\Windows\system32\sppobjs.dll
2015-02-11 19:20 - 2014-12-19 09:57 - 00788680 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 19:20 - 2014-12-19 09:25 - 00602776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 19:20 - 2014-12-09 00:12 - 00391526 _____ () C:\Windows\system32\ApnDatabase.xml
2015-02-11 10:52 - 2015-01-15 23:43 - 00563504 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-02-11 10:52 - 2015-01-15 23:43 - 00177984 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-02-11 10:52 - 2015-01-14 05:22 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-02-11 10:52 - 2015-01-14 04:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-02-11 10:52 - 2015-01-13 23:11 - 01762840 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-02-11 10:52 - 2015-01-13 23:04 - 01489072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-02-11 10:52 - 2015-01-12 04:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-02-11 10:52 - 2015-01-12 03:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-02-11 10:52 - 2015-01-12 03:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-02-11 10:52 - 2015-01-12 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-02-11 10:52 - 2015-01-12 03:34 - 00816128 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-02-11 10:52 - 2015-01-12 03:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-02-11 10:52 - 2015-01-12 03:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-02-11 10:52 - 2015-01-12 03:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-02-11 10:52 - 2015-01-12 03:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-02-11 10:52 - 2015-01-12 03:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-02-11 10:52 - 2015-01-12 03:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-02-11 10:52 - 2015-01-12 02:58 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2015-02-11 10:52 - 2015-01-12 02:55 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-02-11 10:52 - 2015-01-12 02:51 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-02-11 10:52 - 2015-01-12 02:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-02-11 10:52 - 2015-01-12 02:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-02-11 10:52 - 2015-01-12 02:48 - 00374272 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-02-11 10:52 - 2015-01-12 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-02-11 10:52 - 2015-01-12 02:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-02-11 10:52 - 2015-01-12 02:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-02-11 10:52 - 2015-01-12 02:34 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2015-02-11 10:52 - 2015-01-12 02:30 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2015-02-11 10:52 - 2015-01-12 02:27 - 02865152 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2015-02-11 10:52 - 2015-01-12 02:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-02-11 10:52 - 2015-01-12 02:25 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2015-02-11 10:52 - 2015-01-12 02:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-02-11 10:52 - 2015-01-12 02:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-02-11 10:52 - 2015-01-12 02:23 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-02-11 10:52 - 2015-01-12 02:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-02-11 10:52 - 2015-01-12 02:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-02-11 10:52 - 2015-01-12 02:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-02-11 10:52 - 2015-01-12 01:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-02-11 10:52 - 2015-01-10 10:10 - 07472960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-02-11 10:52 - 2015-01-10 10:10 - 01733440 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-02-11 10:52 - 2015-01-10 09:28 - 01498360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-02-11 10:52 - 2015-01-10 08:00 - 00430080 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-02-11 10:52 - 2015-01-10 07:38 - 00359424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-02-11 10:52 - 2014-12-09 04:45 - 00393728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 10:52 - 2014-12-09 02:56 - 00538624 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 10:51 - 2015-01-12 02:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-02-11 10:51 - 2015-01-12 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-02-11 10:51 - 2015-01-10 09:22 - 04175872 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-02-08 12:02 - 2015-03-07 20:58 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-02-08 12:02 - 2015-02-08 12:02 - 00003772 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-02-05 15:11 - 2015-03-07 21:16 - 00001128 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-02-05 15:11 - 2015-03-07 21:07 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-02-05 15:11 - 2015-02-05 15:12 - 00000000 ____D () C:\Users\Richard\AppData\Local\Google
2015-02-05 15:11 - 2015-02-05 15:11 - 00004100 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-02-05 15:11 - 2015-02-05 15:11 - 00003864 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-02-05 15:11 - 2015-02-05 15:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2015-02-05 15:11 - 2015-02-05 15:11 - 00000000 ____D () C:\Program Files (x86)\Google

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-07 21:14 - 2013-10-21 04:48 - 00000000 ____D () C:\Users\Richard
2015-03-07 21:08 - 2014-03-22 20:41 - 00000000 __RDO () C:\Users\Richard\SkyDrive
2015-03-07 21:08 - 2013-10-24 15:26 - 00000566 _____ () C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job
2015-03-07 21:02 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\sru
2015-03-07 20:48 - 2013-08-22 15:46 - 00053329 _____ () C:\Windows\setupact.log
2015-03-07 20:48 - 2013-08-22 15:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-07 20:47 - 2013-11-03 22:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-07 20:47 - 2013-09-29 20:04 - 00322064 _____ () C:\Windows\PFRO.log
2015-03-07 20:47 - 2013-08-22 14:25 - 00262144 ___SH () C:\Windows\system32\config\BBI
2015-03-07 20:38 - 2013-10-21 04:52 - 00003934 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{DE9CE72B-422B-40B8-9CF2-FF8F3CD7386B}
2015-03-07 19:52 - 2013-10-21 03:51 - 01545182 _____ () C:\Windows\WindowsUpdate.log
2015-03-07 19:46 - 2014-01-26 00:32 - 00000000 ___RD () C:\Users\Richard\Dropbox
2015-03-07 19:36 - 2014-01-26 00:19 - 00000000 ____D () C:\Users\Richard\AppData\Roaming\Dropbox
2015-03-06 13:17 - 2013-10-21 04:50 - 00000000 ____D () C:\Users\Richard\AppData\Roaming\Adobe
2015-03-06 09:53 - 2013-10-22 00:21 - 00000000 ____D () C:\Users\Richard\AppData\Roaming\Spotify
2015-03-05 20:16 - 2013-10-21 15:29 - 00000000 ____D () C:\Program Files (x86)\Steam
2015-03-05 18:53 - 2013-10-22 00:21 - 00000000 ____D () C:\Users\Richard\AppData\Local\Spotify
2015-03-05 11:56 - 2013-10-21 04:56 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1753132999-2552881688-1999168385-1001
2015-03-05 11:42 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\AppReadiness
2015-03-05 10:56 - 2014-09-13 12:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-05 10:56 - 2014-09-13 12:24 - 00000000 ____D () C:\Program Files (x86)\Avira
2015-03-05 10:56 - 2013-10-22 17:26 - 00000000 ____D () C:\ProgramData\Package Cache
2015-03-05 00:00 - 2014-05-26 00:14 - 00000000 ____D () C:\Program Files\KeePass
2015-03-03 12:32 - 2014-09-13 12:28 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-03 12:32 - 2014-09-13 12:24 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-03 12:32 - 2014-09-13 12:24 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-02 14:53 - 2014-11-09 18:51 - 00000000 ____D () C:\Users\Richard\Desktop\GET3-CD
2015-02-25 23:07 - 2013-08-22 16:20 - 00000000 ____D () C:\Windows\CbsTemp
2015-02-25 09:29 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\system32\NDF
2015-02-22 22:14 - 2013-09-30 05:14 - 01776918 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-22 22:14 - 2013-09-30 04:56 - 00765582 _____ () C:\Windows\system32\perfh007.dat
2015-02-22 22:14 - 2013-09-30 04:56 - 00159366 _____ () C:\Windows\system32\perfc007.dat
2015-02-18 19:32 - 2014-01-26 00:21 - 00000000 ____D () C:\Users\Richard\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-02-18 01:23 - 2013-10-25 18:47 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-02-18 01:22 - 2013-12-18 19:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-02-17 13:01 - 2014-04-07 06:36 - 00000000 ____D () C:\Users\Richard\L2P
2015-02-17 12:07 - 2013-08-22 16:36 - 00000000 ____D () C:\Windows\rescache
2015-02-12 09:26 - 2013-11-19 17:06 - 00000000 ____D () C:\Windows\system32\MRT
2015-02-12 02:46 - 2013-11-19 17:06 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-02-11 23:50 - 2013-08-22 15:44 - 00427128 _____ () C:\Windows\system32\FNTCACHE.DAT

==================== Files in the root of some directories =======

2014-08-30 21:42 - 2014-08-30 21:42 - 0001862 _____ () C:\Users\Richard\AppData\Roaming\MyMicroBalanceConfig.ini
2014-05-02 00:00 - 2014-05-02 00:00 - 0000000 _____ () C:\Users\Richard\AppData\Roaming\Stardockfences_debug_snapshot.dat
2013-10-23 02:16 - 2013-10-23 02:16 - 0000000 ____H () C:\ProgramData\DP45977C.lfl

Some content of TEMP:
====================
C:\Users\Richard\AppData\Local\Temp\avgnt.exe
C:\Users\Richard\AppData\Local\Temp\bassmod.dll
C:\Users\Richard\AppData\Local\Temp\DivXSetup.exe
C:\Users\Richard\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpm_lvyq.dll
C:\Users\Richard\AppData\Local\Temp\Foxit Reader Updater.exe
C:\Users\Richard\AppData\Local\Temp\Foxit Updater.exe
C:\Users\Richard\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Richard\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Richard\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe
C:\Users\Richard\AppData\Local\Temp\jre-8u31-windows-au.exe
C:\Users\Richard\AppData\Local\Temp\ose00000.exe
C:\Users\Richard\AppData\Local\Temp\PidGenX.dll
C:\Users\Richard\AppData\Local\Temp\PrefJsonCpp.exe
C:\Users\Richard\AppData\Local\Temp\sqlite3.exe
C:\Users\Richard\AppData\Local\Temp\StartIsBack_update.exe
C:\Users\Richard\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Richard\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-02-23 20:51

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 07-03-2015 01
Ran by Richard at 2015-03-07 21:19:42
Running from C:\Users\Richard\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8101 - Acer Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Avira (HKLM-x32\...\{d9ed6dcf-6bfc-4fbb-802e-81dd5b767d6e}) (Version: 1.1.32.25147 - Avira Operations & Co. KG)
Avira (x32 Version: 1.1.32.25147 - Avira Operations & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.1 - Canon Inc.)
Canon MG5300 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5300_series) (Version:  - Canon Inc.)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Counter-Strike: Global Offensive (HKLM-x32\...\Steam App 730) (Version:  - Valve)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.7.0.31 - DivX, LLC)
Dota 2 (HKLM-x32\...\Steam App 570) (Version:  - Valve)
Dropbox (HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\...\Dropbox) (Version: 3.2.6 - Dropbox, Inc.)
Entity Framework Designer für Visual Studio 2012 - DEU (HKLM-x32\...\{4705DBFD-9D5E-4D23-817C-8CA7359B7BDE}) (Version: 11.1.20810.00 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{70D065C3-77E5-45E9-A75C-EEB2E84EA869}) (Version: 11.0.2100.60 - Microsoft Corporation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3960 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{72814a2c-2e03-4a50-b30a-43e7884b3934}) (Version: 16.5.1 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.38 - Irfan Skiljan)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
KeePass Password Safe 2.26 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.26 - Dominik Reichl)
MATLAB R2013a (HKLM\...\Matlab R2013a) (Version: 8.1 - The MathWorks, Inc.)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{5CBFF3F3-2D40-34EE-BCA5-A95BC19E400D}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{98B45D1C-6EB1-460D-A87D-2B60678DC105}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{1948E039-EC79-4591-951D-9867A8C14C90}) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Help Viewer 2.0 (HKLM-x32\...\Microsoft Help Viewer 2.0) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Help Viewer 2.0 Language Pack - DEU (HKLM-x32\...\Microsoft Help Viewer 2.0 Language Pack - DEU) (Version: 2.0.50727 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{AD49BD4B-6CEE-4EA2-B53E-8EB0606F1B11}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM\...\{36E619BC-A234-4EC3-849B-779A7C865A45}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{FBA6F90E-36EC-4FC9-9B25-3834E3BD46A8}) (Version: 11.0.2316.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{EF18EF0F-96D3-4A6B-9600-2197F1720A15}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{6B7B7E62-9F56-4C87-8664-0E20F2CAB03B}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{D4DA7C91-A59F-4C72-BAC4-DF7C76AB1CB8}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{8E4BA1E5-54E8-41F0-919B-CD875B83CFCE}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (HKLM\...\{55FABD1D-8BE6-4A1A-958D-52B15F1DFEF0}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{13C9CD03-A5FE-4F50-AC8A-17B77C38CC52}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL Language Service  (HKLM-x32\...\{28C7A4BB-3966-4373-8376-C11F38290630}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - DEU (11.1.20828.01) (HKLM-x32\...\{E511AE89-54BB-481D-BC4A-1B1F1E1B7693}) (Version: 11.1.20828.01 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - DEU (11.1.20828.01) (HKLM-x32\...\{00C84D22-DB8F-4159-BF70-682B8EA56A1E}) (Version: 11.1.20828.01 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio Express 2012 für Windows Desktop - DEU (HKLM-x32\...\{69ec32be-d994-44de-9eae-6d86ced6f352}) (Version: 11.0.50727.42 - Microsoft Corporation)
Microsoft Web Deploy dbSqlPackage Provider - DEU (HKLM-x32\...\{86756584-C41A-4CA3-B42D-4768C7720F56}) (Version: 10.3.20225.0 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{4C0B27C3-3E8F-4BD2-80FF-6E9E48EBD6D8}) (Version: 11.0.2100.60 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (HKLM\...\{64A5D39C-95CD-4B8B-B2FA-6C713133B57F}) (Version: 11.0.2100.60 - Microsoft Corporation)
Mozilla Firefox 37.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0 (x86 de)) (Version: 37.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
Mozilla Thunderbird 31.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.4.0 (x86 de)) (Version: 31.4.0 - Mozilla)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.5.3 - Notepad++ Team)
NVIDIA GeForce Experience 2.1.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.3 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.11 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.11 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
Oracle VM VirtualBox 4.3.16 (HKLM\...\{D7FAEA32-7CE3-4D9F-9139-F7B87BCC50AF}) (Version: 4.3.16 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
PeaZip 5.3.1 (WIN64) (HKLM\...\{5A2BC38A-406C-4A5B-BF45-6991F9A05325}_is1) (Version:  - Giorgio Tani)
PeaZip configuration (WIN64) (HKLM\...\{4F8D60A8-C53D-47BD-AE5C-31AE6566D638}_is1) (Version:  - Giorgio Tani)
PokerStars.eu (HKLM-x32\...\PokerStars.eu) (Version:  - PokerStars.eu)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 11.43 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.21238 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7032 - Realtek Semiconductor Corp.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (HKLM\...\{90150000-0011-0000-1000-0000000FF1CE}_Office15.PROPLUS_{D82063A8-7C8C-4C3B-A9BB-95138CA55D26}) (Version:  - Microsoft)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 64-Bit Edition (Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 3.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.56 - NVIDIA Corporation) Hidden
Spotify (HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB)
StartIsBack+ (HKLM-x32\...\StartIsBack) (Version: 1.7 - startisback.com)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.6.17 - Synaptics Incorporated)
Sync-my-L2P (HKLM-x32\...\Sync-my-L2P 2.0) (Version: 2.0 - Sync-my-L2P)
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
VLC media player 2.1.0 (HKLM\...\VLC media player) (Version: 2.1.0 - VideoLAN)
WCF RIA Services V1.0 SP2 (HKLM-x32\...\{3A523AF9-D32F-4C85-8388-0335731F3405}) (Version: 4.1.61829.0 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-1753132999-2552881688-1999168385-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Richard\AppData\Roaming\Dropbox\bin\DropboxExt64.25.dll (Dropbox, Inc.)

==================== Restore Points  =========================

18-02-2015 01:18:41 Windows Update
25-02-2015 23:06:06 Windows Update
07-03-2015 20:59:23 Geplanter Prüfpunkt

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 14:25 - 2013-08-22 14:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0AE737CB-F2EF-4499-B191-AB1CFBCA1B48} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2013-08-02] (Acer Incorporate)
Task: {1FA14376-E6D3-4087-B105-D7D11F3A1D2B} - System32\Tasks\fsupdate => C:\PROGRA~2\Flowsurf\fsupd.exe <==== ATTENTION
Task: {1FF93E73-52F2-4E42-AEDD-05160E2E8B8A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-08] (Adobe Systems Incorporated)
Task: {3B083D59-2182-4213-9542-18A32CDB1009} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2014-01-23] (Microsoft Corporation)
Task: {6BB55C71-D2DC-496C-ACA1-6DB4AC2B7CA6} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {B5AF33D7-4959-4B8C-BC81-A64995FF3CA3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-05] (Google Inc.)
Task: {D694CB45-C559-417A-AA33-778FCFD4F1CC} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-23] (Microsoft Corporation)
Task: {DC1D9A55-770B-4D19-B194-6AB6A64E02C9} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-05] (Google Inc.)
Task: {FA768F74-FC70-491B-B632-931A7D47FA6F} - System32\Tasks\AutoPico Daily Restart => C:\Users\Richard\Documents\MS
Task: {FFC609AB-B55A-47C0-A031-A8588066B00D} - System32\Tasks\MATLAB R2013a Startup Accelerator => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe [2013-01-16] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\MATLAB R2013a Startup Accelerator.job => C:\Program Files\MATLAB\R2013a\bin\win64\MATLABStartupAccelerator.exe

==================== Loaded Modules (whitelisted) ==============

2014-10-16 16:00 - 2014-09-14 00:48 - 00013120 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-10-16 16:34 - 2014-09-13 22:53 - 00116880 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-01-25 02:22 - 2014-10-03 17:36 - 00457616 _____ () C:\Windows\system32\igfxTray.exe
2014-01-10 06:26 - 2014-01-10 06:26 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2011-03-04 11:49 - 2011-03-04 11:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2014-02-26 01:14 - 2013-09-04 07:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-01-10 06:28 - 2014-01-10 06:28 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-10-16 16:00 - 2014-09-14 00:48 - 00012104 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Richard\SkyDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Richard\Pictures\Wallpaper\black cat.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

HKLM\...\StartupApproved\StartupFolder: => "PrivateTunnel.lnk"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run32: => "IJNetworkScannerSelectorEX"
HKLM\...\StartupApproved\Run32: => "RadioRage EPM Support"
HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\...\StartupApproved\Run: => "Spotify Web Helper"
HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\...\StartupApproved\Run: => "Steam"
HKU\S-1-5-21-1753132999-2552881688-1999168385-1001\...\StartupApproved\Run: => "SandboxieControl"

==================== Accounts: =============================

Administrator (S-1-5-21-1753132999-2552881688-1999168385-500 - Administrator - Disabled)
Gast (S-1-5-21-1753132999-2552881688-1999168385-501 - Limited - Disabled)
Richard (S-1-5-21-1753132999-2552881688-1999168385-1001 - Administrator - Enabled) => C:\Users\Richard

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/07/2015 09:06:17 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/07/2015 08:59:23 PM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "ConvertStringSidToSid(S-1-5-21-1753132999-2552881688-1999168385-1007.bak)" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.
.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {56cd97ad-6ad2-49ab-a68b-c10ad9b27b9e}

Error: (03/07/2015 08:47:09 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [1008]

Error: (03/07/2015 07:47:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Sync-my-L2P.exe, Version: 0.0.0.0, Zeitstempel: 0x54e3bfd5
Name des fehlerhaften Moduls: Qt5Core.dll, Version: 5.4.0.0, Zeitstempel: 0x5481ebdf
Ausnahmecode: 0xc000041d
Fehleroffset: 0x0012ae72
ID des fehlerhaften Prozesses: 0x11b0
Startzeit der fehlerhaften Anwendung: 0xSync-my-L2P.exe0
Pfad der fehlerhaften Anwendung: Sync-my-L2P.exe1
Pfad des fehlerhaften Moduls: Sync-my-L2P.exe2
Berichtskennung: Sync-my-L2P.exe3
Vollständiger Name des fehlerhaften Pakets: Sync-my-L2P.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Sync-my-L2P.exe5

Error: (03/07/2015 07:47:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Sync-my-L2P.exe, Version: 0.0.0.0, Zeitstempel: 0x54e3bfd5
Name des fehlerhaften Moduls: Qt5Core.dll, Version: 5.4.0.0, Zeitstempel: 0x5481ebdf
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0012ae72
ID des fehlerhaften Prozesses: 0x11b0
Startzeit der fehlerhaften Anwendung: 0xSync-my-L2P.exe0
Pfad der fehlerhaften Anwendung: Sync-my-L2P.exe1
Pfad des fehlerhaften Moduls: Sync-my-L2P.exe2
Berichtskennung: Sync-my-L2P.exe3
Vollständiger Name des fehlerhaften Pakets: Sync-my-L2P.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Sync-my-L2P.exe5

Error: (03/03/2015 04:49:44 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Axinom.Win8.Arte.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1f6c

Startzeit: 01d055c670062d40

Endzeit: 4294967295

Anwendungspfad: C:\Program Files\WindowsApps\ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6\Axinom.Win8.Arte.exe

Berichts-ID: bc5126da-c1bc-11e4-833e-089e01c09692

Vollständiger Name des fehlerhaften Pakets: ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (03/03/2015 04:48:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: PINKMAN)
Description: Das Paket „ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6+App“ wurde beendet, da das Anhalten zu lange dauerte.

Error: (03/03/2015 04:26:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Axinom.Win8.Arte.exe, Version 1.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 12a4

Startzeit: 01d055c6519e4687

Endzeit: 25

Anwendungspfad: C:\Program Files\WindowsApps\ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6\Axinom.Win8.Arte.exe

Berichts-ID: ab0fe389-c1b9-11e4-833e-089e01c09692

Vollständiger Name des fehlerhaften Pakets: ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: App

Error: (03/02/2015 01:21:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: skydrive.exe, Version: 6.3.9600.17484, Zeitstempel: 0x545d76bd
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0x00000000
Fehleroffset: 0x0000000000000000
ID des fehlerhaften Prozesses: 0x197c
Startzeit der fehlerhaften Anwendung: 0xskydrive.exe0
Pfad der fehlerhaften Anwendung: skydrive.exe1
Pfad des fehlerhaften Moduls: skydrive.exe2
Berichtskennung: skydrive.exe3
Vollständiger Name des fehlerhaften Pakets: skydrive.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: skydrive.exe5

Error: (03/02/2015 01:20:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Sync-my-L2P.exe, Version: 0.0.0.0, Zeitstempel: 0x54e3bfd5
Name des fehlerhaften Moduls: Qt5Core.dll, Version: 5.4.0.0, Zeitstempel: 0x5481ebdf
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0012ae72
ID des fehlerhaften Prozesses: 0x149c
Startzeit der fehlerhaften Anwendung: 0xSync-my-L2P.exe0
Pfad der fehlerhaften Anwendung: Sync-my-L2P.exe1
Pfad des fehlerhaften Moduls: Sync-my-L2P.exe2
Berichtskennung: Sync-my-L2P.exe3
Vollständiger Name des fehlerhaften Pakets: Sync-my-L2P.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: Sync-my-L2P.exe5


System errors:
=============
Error: (03/07/2015 08:48:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "RadioRageService" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (03/07/2015 07:10:13 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (03/07/2015 02:48:35 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (03/06/2015 08:34:12 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (03/06/2015 05:11:47 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (03/06/2015 01:48:40 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "LUKAS-PC",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{359A11B8-B350-4C93-9162-0B0EA9547FD5}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (03/06/2015 01:11:08 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (03/06/2015 10:06:54 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (03/06/2015 04:40:37 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (03/05/2015 07:50:32 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.


Microsoft Office Sessions:
=========================
Error: (03/07/2015 09:06:17 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.762"C:\Program Files\MATLAB\R2013a\toolbox\rtw\targets\xpc\xpc\bin\RecordISO.exe

Error: (03/07/2015 08:59:23 PM) (Source: VSS) (EventID: 8193) (User: )
Description: ConvertStringSidToSid(S-1-5-21-1753132999-2552881688-1999168385-1007.bak)0x80070539, Die Struktur der Sicherheitskennung ist unzulässig.


Vorgang:
   OnIdentify-Ereignis
   Generatordaten werden gesammelt

Kontext:
   Ausführungskontext: Shadow Copy Optimization Writer
   Generatorklassen-ID: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
   Generatorname: Shadow Copy Optimization Writer
   Generatorinstanz-ID: {56cd97ad-6ad2-49ab-a68b-c10ad9b27b9e}

Error: (03/07/2015 08:47:09 PM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcNetworkStreamService did not shut down when asked, terminating. [1008]

Error: (03/07/2015 07:47:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Sync-my-L2P.exe0.0.0.054e3bfd5Qt5Core.dll5.4.0.05481ebdfc000041d0012ae7211b001d059072426cfedC:\Program Files (x86)\SyncMyL2P-2.0\Sync-my-L2P.exeC:\Program Files (x86)\SyncMyL2P-2.0\Qt5Core.dll6ec2030d-c4fa-11e4-833e-089e01c09692

Error: (03/07/2015 07:47:36 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Sync-my-L2P.exe0.0.0.054e3bfd5Qt5Core.dll5.4.0.05481ebdfc00000050012ae7211b001d059072426cfedC:\Program Files (x86)\SyncMyL2P-2.0\Sync-my-L2P.exeC:\Program Files (x86)\SyncMyL2P-2.0\Qt5Core.dll6bdc9f0e-c4fa-11e4-833e-089e01c09692

Error: (03/03/2015 04:49:44 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Axinom.Win8.Arte.exe1.0.0.01f6c01d055c670062d404294967295C:\Program Files\WindowsApps\ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6\Axinom.Win8.Arte.exebc5126da-c1bc-11e4-833e-089e01c09692ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6App

Error: (03/03/2015 04:48:29 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2484) (User: PINKMAN)
Description: ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6+App

Error: (03/03/2015 04:26:35 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Axinom.Win8.Arte.exe1.0.0.012a401d055c6519e468725C:\Program Files\WindowsApps\ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6\Axinom.Win8.Arte.exeab0fe389-c1b9-11e4-833e-089e01c09692ARTE.ARTETV_1.1.0.61_x64__m1e0m10bvmah6App

Error: (03/02/2015 01:21:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: skydrive.exe6.3.9600.17484545d76bdunknown0.0.0.000000000000000000000000000000000197c01d054e2e161b479C:\Windows\System32\skydrive.exeunknownab9b0167-c0d6-11e4-833e-089e01c09692

Error: (03/02/2015 01:20:35 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Sync-my-L2P.exe0.0.0.054e3bfd5Qt5Core.dll5.4.0.05481ebdfc00000050012ae72149c01d054e33a033456C:\Program Files (x86)\SyncMyL2P-2.0\Sync-my-L2P.exeC:\Program Files (x86)\SyncMyL2P-2.0\Qt5Core.dll86f075e0-c0d6-11e4-833e-089e01c09692


CodeIntegrity Errors:
===================================
  Date: 2014-09-12 14:57:00.749
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:57:00.671
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:57:00.499
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:57:00.405
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:57:00.280
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:56:59.990
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:56:59.865
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:56:59.661
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:56:59.552
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.

  Date: 2014-09-12 14:56:59.427
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
Percentage of memory in use: 39%
Total physical RAM: 3976.27 MB
Available physical RAM: 2387.97 MB
Total Pagefile: 4936.27 MB
Available Pagefile: 3062.63 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.25 GB) (Free:328.5 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 465.8 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-07 21:31:48
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003a ST500LT012-9WS142 rev.0001SDM1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Richard\AppData\Local\Temp\awddapoc.sys


---- User code sections - GMER 2.1 ----

.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation    00007ffcec8e3e10 7 bytes JMP 00007ffdea250260
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW           00007ffcec8e3e20 7 bytes JMP 00007ffdea250298
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW             00007ffcec9939b0 7 bytes JMP 00007ffdea250340
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW            00007ffcec993ef0 7 bytes JMP 00007ffdea2502d0
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA             00007ffcec993fe0 7 bytes JMP 00007ffdea250308
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx    00007ffcec9c06c0 7 bytes JMP 00007ffdea2501f0
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW      00007ffcec9c0730 7 bytes JMP 00007ffdea250228
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNELBASE.dll!FreeLibrary              00007ffcea2621d0 5 bytes JMP 00007ffdea250180
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW         00007ffcea2629d0 7 bytes JMP 00007ffdea2500d8
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW       00007ffcea264310 5 bytes JMP 00007ffdea250110
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW           00007ffcea268d80 5 bytes JMP 00007ffdea250148
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\KERNELBASE.dll!GetModuleFileNameExW     00007ffcea2df0b0 5 bytes JMP 00007ffdea2501b8
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\USER32.dll!CreateWindowExW              00007ffcec116d90 1 byte JMP 00007ffdea250420
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\USER32.dll!CreateWindowExW + 2          00007ffcec116d92 8 bytes {JMP 0xfffffffffe139690}
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW          00007ffcec1274a0 5 bytes JMP 00007ffdea2503e8
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo   00007ffcec127560 9 bytes JMP 00007ffdea250378
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\USER32.dll!ChangeDisplaySettingsExW     00007ffcec127730 5 bytes JMP 00007ffdea250458
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA          00007ffcec136b10 5 bytes JMP 00007ffdea2503b0
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList      00007ffcec471500 1 byte JMP 00007ffdea250490
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList + 2  00007ffcec471502 6 bytes {JMP 0xfffffffffdddef90}
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo        00007ffcec471750 8 bytes JMP 00007ffdea2504c8
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\dxgi.dll!CreateDXGIFactory              00007ffce7d77750 5 bytes JMP 00007ffde7c600d8
.text   C:\Windows\system32\dwm.exe[936] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1             00007ffce7d78ee0 5 bytes JMP 00007ffde7c60110

---- Threads - GMER 2.1 ----

Thread  C:\Windows\system32\csrss.exe [612:636]                                                      fffff960009892d0
Thread  C:\Windows\system32\svchost.exe [616:4172]                                                   00007ffce1f039b0
Thread  C:\Windows\SYSTEM32\ntdll.dll [2120:2124]                                                    0000000000e56fde
Thread  C:\Windows\SYSTEM32\ntdll.dll [2120:2724]                                                    0000000074f53730
Thread  C:\Windows\System32\SettingSyncHost.exe [5056:3136]                                          00007ffcdf2a7470

---- Disk sectors - GMER 2.1 ----

Disk    \Device\Harddisk0\DR0                                                                        unknown MBR code

---- EOF - GMER 2.1 ----