| |
| |||||||
Log-Analyse und Auswertung: Virusbefahl! Laptop überhitzt und ist sehr langsam Samsung RC730Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
16.03.2015, 18:33
| #1 |
| |  Virusbefahl! Laptop überhitzt und ist sehr langsam Samsung RC730 Hallo liebes Trojaner Team! PC ist wiedermal extremst langsam! Selbst nach einem Zurückstellen auf Werkseinstellungen! Der Lüfter läuft auch immer auf Hochtouren und der PC hat bis zu 85°C im Ruhezustand! Spiele die vorher ohne Probleme liefen, gehen nun nur noch sehr stark ruckelnd! Bei dem FRST Scan sieht man denke ich auch schon sehr schön, dass da ein paar schinesische und russische Software oben ist :P Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-16 18:18:55
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD75 rev.01.0 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\THOMAS~1\AppData\Local\Temp\uwrcyfob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\kernel32.dll!RegSetValueExA 0000000076001409 7 bytes JMP 00000001725f1e90
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007601b21b 5 bytes JMP 00000001725f1da0
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000076098e24 7 bytes JMP 00000001725f1d90
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000076098ea9 5 bytes JMP 00000001725f1e80
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000760991ff 5 bytes JMP 00000001725f1e10
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000075891d29 5 bytes JMP 00000001725f2450
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000075891dd7 5 bytes JMP 00000001725f24b0
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075892ab1 5 bytes JMP 00000001725f2520
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000075892d17 5 bytes JMP 00000001725f2620
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 00000000768ae96b 5 bytes JMP 00000001725f1a00
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 00000000768aeba5 5 bytes JMP 00000001725f1a90
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076925ea5 5 bytes JMP 00000001725f1ce0
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\ole32.dll!CoCreateInstance 0000000076959d0b 5 bytes JMP 00000001725f1c70
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\Steam.exe[2748] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3412] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Steam\bin\steamwebhelper.exe[3096] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Common Files\Steam\SteamService.exe[3536] C:\windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4244] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\kernel32.dll!FreeLibrary + 8 0000000075ff3490 7 bytes JMP 0000000102e3020c
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\KERNELBASE.dll!CreateRemoteThreadEx 0000000075893e78 5 bytes JMP 0000000102e302ee
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\ole32.dll!CoCreateInstance + 62 0000000076959d49 7 bytes JMP 0000000102e30594
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5312] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\windows\SysWOW64\Macromed\Flash\FlashUtil10h_ActiveX.exe[5736] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\kernel32.dll!FreeLibrary + 8 0000000075ff3490 7 bytes JMP 00000001029702f0
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\KERNELBASE.dll!CreateRemoteThreadEx 0000000075893e78 5 bytes JMP 00000001029703d2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\ole32.dll!CoCreateInstance + 62 0000000076959d49 7 bytes JMP 0000000102970678
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1328] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\kernel32.dll!FreeLibrary + 8 0000000075ff3490 7 bytes JMP 0000000102ba02f0
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\KERNELBASE.dll!CreateRemoteThreadEx 0000000075893e78 5 bytes JMP 0000000102ba03d2
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\ole32.dll!CoCreateInstance + 62 0000000076959d49 7 bytes JMP 0000000102ba0678
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4660] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe[6844] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\TcpService\2.3.3.0\LavasoftTcpService.exe[6448] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\KERNEL32.dll!SetFileCompletionNotificationModes 000000007606b2fe 5 bytes JMP 00000001051f8f50
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075871401 2 bytes JMP 7601b21b C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075871419 2 bytes JMP 7601b346 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075871431 2 bytes JMP 76098ea9 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007587144a 2 bytes CALL 75ff48ad C:\windows\syswow64\KERNEL32.dll
.text ... * 9
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758714dd 2 bytes JMP 760987a2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758714f5 2 bytes JMP 76098978 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007587150d 2 bytes JMP 76098698 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075871525 2 bytes JMP 76098a62 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007587153d 2 bytes JMP 7600fca8 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075871555 2 bytes JMP 760168ef C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007587156d 2 bytes JMP 76098f61 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075871585 2 bytes JMP 76098ac2 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007587159d 2 bytes JMP 7609865c C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758715b5 2 bytes JMP 7600fd41 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758715cd 2 bytes JMP 7601b2dc C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758716b2 2 bytes JMP 76098e24 C:\windows\syswow64\KERNEL32.dll
.text C:\Program Files (x86)\Lavasoft\Web Companion\Application\WebCompanion.exe[5852] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758716bd 2 bytes JMP 760985f1 C:\windows\syswow64\KERNEL32.dll
---- Threads - GMER 2.1 ----
Thread C:\windows\system32\svchost.exe [788:5876] 0000000000a90100
Thread C:\windows\system32\svchost.exe [788:6012] 0000000000a90100
Thread C:\windows\system32\svchost.exe [788:4900] 0000000000a90100
Thread C:\windows\system32\svchost.exe [788:6156] 0000000000a90100
Thread C:\windows\system32\svchost.exe [788:3932] 0000000000a90100
Thread C:\windows\system32\svchost.exe [788:6268] 0000000000a90100
Thread C:\windows\system32\svchost.exe [788:6504] 0000000000a90100
Thread C:\windows\system32\svchost.exe [788:6608] 0000000000a90100
Thread C:\windows\system32\svchost.exe [1624:3780] 0000000000b80100
Thread C:\windows\system32\svchost.exe [1624:3556] 0000000000b80100
Thread C:\windows\system32\svchost.exe [1624:5928] 0000000000b80100
Thread C:\windows\system32\svchost.exe [1624:6872] 0000000000b80100
Thread C:\windows\system32\svchost.exe [1624:6748] 0000000000b80100
Thread C:\windows\system32\svchost.exe [1624:4856] 0000000000b80100
Thread C:\windows\system32\svchost.exe [1624:4744] 0000000000b80100
Thread C:\windows\system32\svchost.exe [1624:7024] 0000000000b80100
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3588:4100] 0000000075cd7587
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3588:4108] 000000006bac0cb3
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3588:4136] 0000000076fd2e65
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3588:3208] 0000000076fd3e85
Thread C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3588:6216] 0000000076fd3e85
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:5912] 0000000180010100
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:6272] 0000000180010100
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:3996] 0000000180010100
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:6276] 0000000180010100
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:6308] 0000000180010100
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:4428] 0000000180010100
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:6304] 0000000180010100
Thread C:\Program Files\Internet Explorer\iexplore.exe [5984:4208] 0000000180010100
Thread C:\windows\system32\taskhost.exe [3592:568] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:5296] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:5764] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:6596] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:1068] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:3332] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:7120] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:796] 0000000001fe0100
Thread C:\windows\system32\taskhost.exe [3592:3472] 0000000001ffebb0
Thread C:\windows\system32\taskhost.exe [3592:6780] 0000000001ffebb0
---- Processes - GMER 2.1 ----
Process C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe (*** suspicious ***) @ C:\Users\THOMAS~1\AppData\Local\Temp\nsv7002.tmp\nsissetup.exe [6844](2015-03-16 16:54:44) 0000000001150000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\dca97104e466
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\dca97104e65f
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\dca9716574c5
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\dca97104e466 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\dca97104e65f (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\dca9716574c5 (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Thomas xxx at 2015-03-16 18:26:58
Running from C:\Users\Thomas xxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EJE5ZV0S
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Norton Internet Security (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
„Windows Live Essentials“ (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
„Windows Live Mail“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live Messenger“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Ad-Aware Web Companion (x32 Version: 1.1.922.1860 - Lavasoft) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\{FFB768E4-E427-4553-BC36-A11F5E62A94D}) (Version: 10.1.53.64 - Adobe Systems Incorporated)
Adobe Reader 9.1 - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.82 - WildTangent) Hidden
AVG PC TuneUp 2015 (de-DE) (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
AVG PC TuneUp 2015 (HKLM-x32\...\AVG PC TuneUp) (Version: 15.0.1001.238 - AVG Technologies)
AVG PC TuneUp 2015 (x32 Version: 15.0.1001.238 - AVG Technologies) Hidden
BatteryLifeExtender (HKLM-x32\...\{FFD0E594-823B-4E2B-B680-720B3C852588}) (Version: 1.0.11 - Samsung)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{1E03DB52-D5CB-4338-A338-E526DD4D4DB1}) (Version: 7.0.610.0 - Microsoft Corporation)
Build-a-lot (x32 Version: 2.2.0.82 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
ChargeableUSB (HKLM-x32\...\{92D50865-FC60-4EA8-BA7A-5581B0D13EFB}) (Version: 1.0.0.0 - SAMSUNG)
Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
Cities: Skylines (HKLM-x32\...\Steam App 255710) (Version: - Colossal Order Ltd.)
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2227 - CyberLink Corp.)
CyberLink Media+ Player10 (HKLM-x32\...\InstallShield_{34FBC7C4-CD31-4D93-A428-0E524EAC4586}) (Version: 10.0.1110.00 - CyberLink Corp.)
CyberLink MediaShow (HKLM-x32\...\InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}) (Version: 5.0.1130a - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3802 - CyberLink Corp.)
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3306 - CyberLink Corp.)
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3509 - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden
Easy Content Share (HKLM-x32\...\{2DDC70C1-C77A-4D08-89D2-9AB648504533}) (Version: 1.0 - Samsung Electronics Co., LTD)
Easy Display Manager (HKLM-x32\...\{17283B95-21A8-4996-97DA-547A48DB266F}) (Version: 3.2 - Samsung Electronics Co., Ltd.)
Easy Migration (HKLM-x32\...\{AD86049C-3D9C-43E1-BE73-643F57D83D50}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (HKLM-x32\...\{8732818E-CA78-4ACB-B077-22311BF4C0E4}) (Version: 4.4.7 - Samsung)
Easy SpeedUp Manager (HKLM-x32\...\{EF367AA4-070B-493C-9575-85BE59D789C9}) (Version: 2.1.1.1 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (HKLM-x32\...\{4A331D24-A9E8-484F-835E-1BA7B139689C}) (Version: 4.0.0.4 - Samsung)
EasyFileShare (HKLM-x32\...\{EA76E65F-6679-495A-A8A6-42AD6602ED4C}) (Version: 1.0.11 - Samsung)
ETDWare PS/2-X64 8.0.7.2_WHQL (HKLM\...\Elantech) (Version: 8.0.7.2 - ELAN Microelectronic Corp.)
Farm Frenzy (x32 Version: 2.2.0.82 - WildTangent) Hidden
Fast Start (HKLM-x32\...\{77F45ECD-FAFC-45A8-8896-CFFB139DAAA3}) (Version: 2.2.0.0 - SAMSUNG)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Insaniquarium Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
Intel PROSet Wireless (x32 Version: - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2266 - Intel Corporation)
Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed (HKLM\...\{A0E106D2-4815-4B7A-BAA7-7E21B530CFB4}) (Version: 1.1.0.0157 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{006B5C65-3938-4246-B182-994A7E415EDE}) (Version: 1.1.0.0537 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.0.0.1046 - Intel Corporation)
John Deere Drive Green (x32 Version: 2.2.0.82 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LavasoftTcpService (x32 Version: 2.3.3.0 - Lavasoft) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM-x32\...\{90120000-00A4-0409-0000-0000000FF1CE}) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU (HKLM\...\Microsoft Visual Studio 2005 Remote Debugger Light (x64) - ENU) (Version: - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Applications - ENU (HKLM-x32\...\Microsoft Visual Studio 2005 Tools for Applications - ENU) (Version: - Microsoft Corporation)
Movie Color Enhancer (HKLM-x32\...\{7F6F62F0-7884-4CFB-B86C-597A4A6D9C4D}) (Version: 1.0 - Samsung Electronics Co., Ltd.)
Multimedia POP (HKLM-x32\...\{331ECF61-69AF-4F57-AC35-AFED610231C3}) (Version: 1.0 - )
Norton Internet Security (HKLM-x32\...\NIS) (Version: 18.7.2.3 - Symantec Corporation)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
NVIDIA Graphics Driver 266.72 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 266.72 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Peggle (x32 Version: 2.2.0.82 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden
PhoneShare (HKLM-x32\...\{3F50512F-53DF-46B1-8CCB-6C7E638CADD6}) (Version: 9.1.4 - Samsung)
Plants vs. Zombies (x32 Version: 2.2.0.82 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Golfer (x32 Version: 2.2.0.82 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.44.421.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6400 - Realtek Semiconductor Corp.)
Samsung AnyWeb Print (HKLM-x32\...\{318DBE01-1E6B-4243-84B0-210391FE789A}) (Version: 2.0.67.1 - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (HKLM-x32\...\Samsung Printer Live Update) (Version: - Samsung Electronics Co., Ltd.)
Samsung Recovery Solution 5 (HKLM-x32\...\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}) (Version: 5.0.0.9 - Samsung)
Samsung Support Center (HKLM-x32\...\{F687E657-F636-44DF-8125-9FEEA2C362F5}) (Version: 1.1.24 - Samsung)
Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version: 2.02.05.00:27 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (HKLM-x32\...\Samsung Universal Scan Driver) (Version: 1.2.5.0 - Samsung Electronics Co., Ltd.)
Samsung Update Plus (HKLM-x32\...\{142D8CA7-2C6F-45A7-83E3-099AAFD99133}) (Version: 3.0.0.17 - Samsung Electronics Co., Ltd.)
Skype™ 4.2 (HKLM-x32\...\{D103C4BA-F905-437A-8049-DB24763BBE36}) (Version: 4.2.169 - Skype Technologies S.A.)
SolidWorks 2012 x64 Edition SP0 (HKLM\...\{4C66F076-D3AB-49C8-85D4-BAA6D82FCAE2}) (Version: 20.100.5022 - SolidWorks)
SpeedFan (remove only) (HKLM-x32\...\SpeedFan) (Version: - )
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.0.82.0 - Intel)
User Guide (HKLM-x32\...\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}) (Version: 1.5 - )
Web Companion (HKLM-x32\...\{902C3D36-9254-437D-98AC-913B78E60864}_WebCompanion) (Version: 1.1.922.1860 - Lavasoft)
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.1.5 - WildTangent)
WildTangent ORB Game Console (x32 Version: - WildTangent) Hidden
Windows Live 程式集 (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
WordCaptureX Pro (HKLM-x32\...\{139C1D95-9037-3AB3-F5F4-4A79BF6831EC}) (Version: 4.0.0 - Deskperience)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
15-03-2015 18:08:12 Windows Update
15-03-2015 20:22:59 Windows Update
15-03-2015 22:44:37 Windows Update
16-03-2015 11:10:05 Windows Update
16-03-2015 16:31:49 Windows Update
16-03-2015 17:57:04 LavasoftWeCompanion
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {01D4A7F9-5150-4EC5-B7F8-30C2AADE48CB} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-23] (Samsung Electronics Co., Ltd.)
Task: {29016D0D-D292-412E-8711-87920D3702FE} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2011-01-04] (Samsung Electronics Co., Ltd.)
Task: {610322BD-41E1-4C1D-BBE9-7543E6378176} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-02-07] (SAMSUNG Electronics)
Task: {9138CA60-AB53-4E05-AE37-2EED1D8EF46B} - System32\Tasks\Symantec\Norton Error Analyzer 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {A363F639-9E4A-496B-8BC4-6916AA3AF700} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {A9E4B88B-2EC3-4B05-8164-F8448E8D66F6} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)
Task: {B6B50111-1686-4C25-AC66-87D4B2986407} - System32\Tasks\{9AB9F414-474B-4432-9F04-2C3EF2BACC2A} => pcalua.exe -a E:\prereqs\VCRedist9\vcredist_x64.exe -d E:\prereqs\VCRedist9
Task: {BB65E2A9-AB09-4CE6-869B-5D3163D9673C} - System32\Tasks\Symantec\Norton Error Processor 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {C304D9BA-DD1E-4728-AF0A-786A137D404A} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {E64E75B9-3AAF-455E-9684-D3FB4A9791B0} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {E7110FB6-91D1-4C30-99AC-E10225F61CAD} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {E87DA5B9-4D35-4893-BCE2-C8014991C057} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2011-01-11] (Samsung Electronics)
Task: {EC0654ED-D944-4CA6-B922-16CA8F505861} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-12-23] (Samsung Electronics)
Task: {F81D95CE-5867-40B4-9F60-C6E6CF80EA1A} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: {FEE2F150-F394-4963-83B3-DAD1AA3FB459} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)
Task: {FEE5FD02-7BAB-43CF-ADDC-46E1A5F867E1} - System32\Tasks\{196C6AE7-7C0B-4A1C-8123-9BDAB93C977A} => pcalua.exe -a E:\prereqs\dotNetFx\dotnetfx35.exe -d E:\prereqs\dotNetFx
==================== Loaded Modules (whitelisted) ==============
2011-09-06 05:52 - 2008-06-05 00:53 - 00027648 _____ () C:\windows\System32\spd__l.dll
2011-09-06 01:44 - 2009-12-01 08:21 - 00244904 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2011-09-06 05:48 - 2010-12-17 02:37 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-09-06 05:52 - 2010-10-21 19:22 - 00709632 _____ () C:\windows\system32\SnMinDrv.dll
2015-02-19 22:40 - 2015-02-19 22:40 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-11-24 12:48 - 2014-11-24 12:48 - 00713528 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\avgrepliba.dll
2014-11-24 12:49 - 2014-11-24 12:49 - 00856888 _____ () C:\Program Files (x86)\AVG\AVG PC TuneUp\tulnga.dll
2015-03-12 11:57 - 2015-03-12 11:57 - 00017768 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WinService.exe
2015-03-12 11:57 - 2015-03-12 11:57 - 00012144 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Service.Logger.dll
2015-03-12 11:57 - 2015-03-12 11:57 - 00034152 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.WcfService.dll
2011-09-06 01:27 - 2011-05-04 22:01 - 00004096 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2015-03-13 19:49 - 2014-11-11 19:47 - 00774656 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2015-03-13 19:49 - 2014-12-02 01:29 - 05002752 _____ () C:\Program Files (x86)\Steam\v8.dll
2015-03-13 19:49 - 2014-12-02 01:29 - 01612800 _____ () C:\Program Files (x86)\Steam\icui18n.dll
2015-03-13 19:49 - 2014-12-02 01:29 - 01210368 _____ () C:\Program Files (x86)\Steam\icuuc.dll
2015-03-13 19:49 - 2015-02-19 00:51 - 02360000 _____ () C:\Program Files (x86)\Steam\video.dll
2015-03-13 19:48 - 2014-12-01 22:31 - 02396672 _____ () C:\Program Files (x86)\Steam\libavcodec-56.dll
2015-03-13 19:48 - 2014-12-01 22:31 - 00442880 _____ () C:\Program Files (x86)\Steam\libavutil-54.dll
2015-03-13 19:48 - 2014-12-01 22:31 - 00479744 _____ () C:\Program Files (x86)\Steam\libavformat-56.dll
2015-03-13 19:48 - 2014-12-01 22:31 - 00332800 _____ () C:\Program Files (x86)\Steam\libavresample-2.dll
2015-03-13 19:48 - 2014-12-01 22:31 - 00485888 _____ () C:\Program Files (x86)\Steam\libswscale-3.dll
2015-03-13 19:49 - 2015-02-19 00:51 - 00702656 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2011-09-06 01:38 - 2010-07-05 11:42 - 00203776 _____ () C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll
2009-11-02 06:20 - 2009-11-02 06:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 06:23 - 2009-11-02 06:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2011-09-06 01:54 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2015-03-13 19:48 - 2015-01-28 02:30 - 34641288 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2011-09-06 01:52 - 2010-05-07 15:22 - 01636864 _____ () C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll
2011-09-06 01:54 - 2010-10-25 13:44 - 01973760 _____ () C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll
2015-03-12 11:57 - 2015-03-12 11:57 - 00077632 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.dll
2015-03-12 11:57 - 2015-03-12 11:57 - 00179560 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SearchProtect.Business.dll
2015-03-12 11:57 - 2015-03-12 11:57 - 00046920 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.adblocker.dll
2015-03-12 11:58 - 2015-03-12 11:58 - 00123224 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.PUP.Management.dll
2015-03-12 11:57 - 2015-03-12 11:57 - 00015696 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.Utils.SqlLite.dll
2015-03-12 11:58 - 2015-03-12 11:58 - 00073544 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.SysInfo.dll
2015-03-12 11:57 - 2015-03-12 11:57 - 00039256 _____ () C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.CSharp.Utilities.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-1739335617-45622530-1743251556-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Thomas xxx\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 10.0.0.138
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
==================== Accounts: =============================
Administrator (S-1-5-21-1739335617-45622530-1743251556-500 - Administrator - Disabled)
Gast (S-1-5-21-1739335617-45622530-1743251556-501 - Limited - Disabled)
Thomas xxx (S-1-5-21-1739335617-45622530-1743251556-1001 - Administrator - Enabled) => C:\Users\Thomas xxx
UpdatusUser (S-1-5-21-1739335617-45622530-1743251556-1000 - Limited - Enabled) => C:\Users\UpdatusUser
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/16/2015 05:50:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011aa
ID des fehlerhaften Prozesses: 0x17b0
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3
Error: (03/16/2015 05:50:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011aa
ID des fehlerhaften Prozesses: 0x1380
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3
Error: (03/16/2015 05:49:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011aa
ID des fehlerhaften Prozesses: 0xab0
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3
Error: (03/16/2015 05:49:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Name des fehlerhaften Moduls: Gmer-19357.exe, Version: 2.1.19357.0, Zeitstempel: 0x52e7ea83
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000011aa
ID des fehlerhaften Prozesses: 0x1440
Startzeit der fehlerhaften Anwendung: 0xGmer-19357.exe0
Pfad der fehlerhaften Anwendung: Gmer-19357.exe1
Pfad des fehlerhaften Moduls: Gmer-19357.exe2
Berichtskennung: Gmer-19357.exe3
Error: (03/16/2015 05:27:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 01:55:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 01:45:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 01:28:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 11:05:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/15/2015 11:01:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: UNS.exe, Version: 7.1.13.1088, Zeitstempel: 0x4dc1a981
Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0, Zeitstempel: 0x00000000
Ausnahmecode: 0xc0000005
Fehleroffset: 0x754771fc
ID des fehlerhaften Prozesses: 0x5cc
Startzeit der fehlerhaften Anwendung: 0xUNS.exe0
Pfad der fehlerhaften Anwendung: UNS.exe1
Pfad des fehlerhaften Moduls: UNS.exe2
Berichtskennung: UNS.exe3
System errors:
=============
Error: (03/16/2015 05:54:04 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (03/16/2015 05:54:00 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.
Error: (03/16/2015 05:26:16 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am 16.03.2015 um 16:33:12 unerwartet heruntergefahren.
Error: (03/16/2015 01:31:27 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (03/16/2015 01:31:27 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht.
Error: (03/16/2015 11:09:41 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80242016 fehlgeschlagen: Kumulatives Sicherheitsupdate für Internet Explorer 9 für Windows 7 für x64-Systeme (KB3032359)
Error: (03/16/2015 11:06:46 AM) (Source: Microsoft-Windows-LanguagePackSetup) (EventID: 1000) (User: NT-AUTORITÄT)
Description: Fehler bei der CBS-Clientinitialisierung. Letzter Fehler: 0x80080005
Error: (03/16/2015 11:06:46 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}
Error: (03/15/2015 11:01:20 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Intel(R) Management and Security Application Local Management Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%109
Error: (03/15/2015 11:01:11 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Cyberlink RichVideo Service(CRVS)" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Microsoft Office Sessions:
=========================
Error: (03/16/2015 05:50:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000005000011aa17b001d060094d6c1d6bC:\Users\Thomas xxx\Downloads\Gmer-19357.exeC:\Users\Thomas xxx\Downloads\Gmer-19357.exe8ee7fc80-cbfc-11e4-bb87-dca9716574c5
Error: (03/16/2015 05:50:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000005000011aa138001d060093d901c75C:\Users\Thomas xxx\Downloads\Gmer-19357.exeC:\Users\Thomas xxx\Downloads\Gmer-19357.exe7f559e7f-cbfc-11e4-bb87-dca9716574c5
Error: (03/16/2015 05:49:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000005000011aaab001d0600933abe2fdC:\Users\Thomas xxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EJE5ZV0S\Gmer-19357.exeC:\Users\Thomas xxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EJE5ZV0S\Gmer-19357.exe75bed367-cbfc-11e4-bb87-dca9716574c5
Error: (03/16/2015 05:49:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Gmer-19357.exe2.1.19357.052e7ea83Gmer-19357.exe2.1.19357.052e7ea83c0000005000011aa144001d060091cdc4fa9C:\Users\Thomas xxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\549MH0D7\Gmer-19357.exeC:\Users\Thomas xxx\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\549MH0D7\Gmer-19357.exe5fd0516c-cbfc-11e4-bb87-dca9716574c5
Error: (03/16/2015 05:27:51 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 01:55:45 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 01:45:27 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 01:28:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/16/2015 11:05:07 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (03/15/2015 11:01:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: UNS.exe7.1.13.10884dc1a981unknown0.0.0.000000000c0000005754771fc5cc01d05f537f0692efC:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exeunknownc720d3de-cb5e-11e4-bede-dca9716574c5
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2670QM CPU @ 2.20GHz
Percentage of memory in use: 43%
Total physical RAM: 8104.19 MB
Available physical RAM: 4599.42 MB
Total Pagefile: 16206.57 MB
Available Pagefile: 13050.13 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:271 GB) (Free:202.79 GB) NTFS
Drive d: () (Fixed) (Total:403.87 GB) (Free:333.12 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: 817D105E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=271 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=403.9 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=23.7 GB) - (Type=27)
==================== End Of Log ============================
PS: Das letzte Mal als ihr mir geholfen habt, habe ich dann ganz vergessen mich zu bedanken!!! DANKE!!! |
| Themen zu Virusbefahl! Laptop überhitzt und ist sehr langsam Samsung RC730 |
| .dll, adware, cpu, defender, desktop, error, explorer, flash player, iexplore.exe, internet, internet explorer, langsam, nvidia, registry, scan, security, server, software, svchost.exe, symantec, system, temp, trojaner, updates, warnung, web companion, werkseinstellungen |
Baum-Darstellung