Windows 7 Home Pro: System langsam, Videos ruckeln

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-05-2015
Ran by Anne (administrator) on KINGSHO on 03-05-2015 14:35:43
Running from C:\Users\Anne\Desktop
Loaded Profiles: Anne (Available profiles: Anne)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Nitro PDF Software) C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe
(Realtek) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Rapoo\RpWireless\LedStatus.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(CyberGhost S.R.L) C:\Program Files\CyberGhost 5\Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Realtek Semiconductor Corp.) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe
(BitTorrent Inc.) C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11474024 2010-10-05] (Realtek Semiconductor)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [726320 2015-03-31] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [LedStatus] => C:\Program Files (x86)\Rapoo\RpWireless\LedStatus.exe [1709736 2013-01-05] ()
HKLM-x32\...\Run: [Launch] => C:\Program Files (x86)\Rapoo\RpWireless\Launch.exe [414008 2014-05-20] ()
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} =>  No File
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3487932388-2619483569-1009563589-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://localoem.msn.com
HKU\S-1-5-21-3487932388-2619483569-1009563589-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://localoem.msn.com
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000 -> DefaultScope {80E2732B-B775-4988-B2FA-66F8D6B416DA} URL = 
SearchScopes: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000 -> {80E2732B-B775-4988-B2FA-66F8D6B416DA} URL = 
SearchScopes: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000 -> {FFEBBF0A-C22C-4172-89FF-45215A135AC7} URL = hxxp://go.mail.ru/search?q={searchTerms}&utf8in=1&fr=ietb
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-04-20] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-20] (Oracle Corporation)

FireFox:
========
FF ProfilePath: C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default
FF DefaultSearchEngine: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*'))%20%7B%20return%20'PROXY%20us01.sq.proxmate.me%3A8000%3B%20PROXY%20us09.sq.proxmate.me%3A8000%3B%20PROXY%20us05.sq.proxmate.me%3A8000%3B%20PROXY%20us04.sq.proxmate.me%3A8000%3B%20PROXY%20us08.sq.proxmate.me%3A8000%3B%20PROXY%20us11.sq.proxmate.me%3A8000%3B%20PROXY%20us02.sq.proxmate.me%3A8000%3B%20PROXY%20us10.sq.proxmate.me%3A8000%3B%20PROXY%20us06.sq.proxmate.me%3A8000%3B%20PROXY%20us03.sq.proxmate.me%3A8000%3B%20PROXY%20us07.sq.proxmate.me%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-17] ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-10-10] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll [2012-10-10] (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.0.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll No File
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-17] ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-10-10] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-20] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nitropdf.com/NitroPDF -> C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll [2013-07-26] (Nitro PDF)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-10-10] (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-3487932388-2619483569-1009563589-1000: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll [2012-10-10] (Tracker Software Products (Canada) Ltd.)
FF user.js: detected! => C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\user.js [2014-01-19]
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npPDFXCviewNPPlugin.dll [2012-10-10] (Tracker Software Products (Canada) Ltd.)
FF Extension: Avira Browser Safety - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\abs@avira.com [2015-04-28]
FF Extension: Rikaichan Japanese-German Dictionary File - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\rikaichan-jpde@polarcloud.com [2013-07-17]
FF Extension: Rikaichan Japanese-English Dictionary File - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\rikaichan-jpen@polarcloud.com [2013-07-17]
FF Extension: Rikaichan Japanese Names Dictionary File - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\rikaichan-jpnames@polarcloud.com [2013-07-17]
FF Extension: Rikaichan - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2015-04-17]
FF Extension: ProxTube - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\ich@maltegoetz.de.xpi [2014-09-11]
FF Extension: convert2mp3.net YouTube2MP3 Converter - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\info@convert2mp3.net.xpi [2013-11-09]
FF Extension: ProxMate - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2012-12-02]
FF Extension: 1-Click YouTube Video Downloader - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\YoutubeDownloader@PeterOlayev.com.xpi [2013-07-16]
FF Extension: Adblock Plus - C:\Users\Anne\AppData\Roaming\Mozilla\Firefox\Profiles\dbf103hl.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-19]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [815920 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1004280 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64616 2014-11-03] (CyberGhost S.R.L)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 NitroReaderDriverReadSpool3; C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [230416 2013-07-26] (Nitro PDF Software)
R2 Realtek11nCU; C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtlService.exe [36864 2010-04-16] (Realtek) [File not signed]
S4 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-04] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MTsensor; C:\Windows\system32\drivers\ASACPI.sys [15680 2006-10-31] ()
S3 rpwkmdrv; C:\Windows\System32\drivers\rpwkmdrv.sys [22656 2014-04-28] ()
R3 RTL8192cu; C:\Windows\System32\DRIVERS\rtwlanu.sys [1045608 2011-07-13] (Realtek Semiconductor Corporation                           )
U5 UnlockerDriver5; C:\Program Files\Unlocker\UnlockerDriver5.sys [12352 2010-07-01] ()
S3 cpuz130; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz130\cpuz_x64.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-03 14:35 - 2015-05-03 14:36 - 00016898 _____ () C:\Users\Anne\Desktop\FRST.txt
2015-05-03 14:10 - 2015-05-03 14:10 - 00380416 _____ () C:\Users\Anne\Desktop\Gmer-19357.exe
2015-05-03 14:08 - 2015-05-03 14:35 - 00000000 ____D () C:\FRST
2015-05-03 14:07 - 2015-05-03 14:07 - 02101248 _____ (Farbar) C:\Users\Anne\Desktop\FRST64.exe
2015-05-03 14:06 - 2015-05-03 14:06 - 00000470 _____ () C:\Users\Anne\Desktop\defogger_disable.log
2015-05-03 14:06 - 2015-05-03 14:06 - 00000000 _____ () C:\Users\Anne\defogger_reenable
2015-05-03 14:03 - 2015-05-03 14:03 - 00050477 _____ () C:\Users\Anne\Desktop\Defogger.exe
2015-05-02 21:30 - 2015-05-02 21:31 - 00000000 ____D () C:\Program Files\Defraggler
2015-05-02 21:30 - 2015-05-02 21:30 - 00001730 _____ () C:\Users\Public\Desktop\Defraggler.lnk
2015-05-02 21:30 - 2015-05-02 21:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
2015-05-02 21:29 - 2015-05-02 21:29 - 04532776 _____ (Piriform Ltd) C:\Users\Anne\Desktop\dfsetup219.exe
2015-05-02 21:06 - 2015-05-02 21:07 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-02 21:06 - 2015-05-02 21:06 - 00001112 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-02 21:06 - 2015-05-02 21:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-02 21:06 - 2015-05-02 21:06 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-02 21:06 - 2015-05-02 21:06 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-02 21:06 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-02 21:06 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-02 21:06 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-02 21:05 - 2015-05-02 21:05 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Anne\Desktop\mbam-setup-2.1.6.1022.exe
2015-04-26 20:42 - 2015-05-03 12:16 - 00001260 _____ () C:\Windows\PFRO.log
2015-04-26 20:38 - 2015-04-26 20:38 - 00000000 ____D () C:\Users\Anne\AppData\Local\elfopatch
2015-04-24 15:42 - 2015-04-24 15:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-04-24 14:50 - 2015-05-03 14:21 - 00000840 _____ () C:\Windows\setupact.log
2015-04-24 14:50 - 2015-04-24 14:50 - 00000000 _____ () C:\Windows\setuperr.log
2015-04-23 19:42 - 2015-04-29 19:49 - 00000000 ____D () C:\Users\Anne\AppData\Roaming\vlc
2015-04-23 19:42 - 2015-04-23 19:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2015-04-17 21:04 - 2015-04-02 02:17 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-04-17 21:04 - 2015-04-02 01:49 - 00342704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 03298816 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 02553856 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 00191488 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-04-17 21:04 - 2015-03-25 05:24 - 00035328 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-04-17 21:04 - 2015-03-25 05:23 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-04-17 21:04 - 2015-03-25 05:23 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-04-17 21:04 - 2015-03-25 05:23 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-04-17 21:04 - 2015-03-25 05:00 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-04-17 21:04 - 2015-03-25 05:00 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-04-17 21:04 - 2015-03-25 05:00 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-04-17 21:04 - 2015-03-25 05:00 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-04-17 21:04 - 2015-03-25 05:00 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-04-17 21:04 - 2015-03-23 05:25 - 00769536 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-17 21:04 - 2015-03-23 05:25 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-17 21:04 - 2015-03-23 05:24 - 00957952 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-17 21:04 - 2015-03-23 05:24 - 00419840 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-17 21:04 - 2015-03-23 05:24 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-17 21:04 - 2015-03-23 05:24 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-04-17 21:04 - 2015-03-23 05:24 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-17 21:04 - 2015-03-23 05:17 - 01111552 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-17 21:04 - 2015-03-17 07:22 - 05557696 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-04-17 21:04 - 2015-03-17 07:22 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-04-17 21:04 - 2015-03-17 07:22 - 00095672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-04-17 21:04 - 2015-03-17 07:19 - 01727904 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-04-17 21:04 - 2015-03-17 07:17 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-04-17 21:04 - 2015-03-17 07:17 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-04-17 21:04 - 2015-03-17 07:17 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-04-17 21:04 - 2015-03-17 07:16 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-04-17 21:04 - 2015-03-17 07:16 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-04-17 21:04 - 2015-03-17 07:16 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-04-17 21:04 - 2015-03-17 07:15 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-04-17 21:04 - 2015-03-17 07:15 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-04-17 21:04 - 2015-03-17 07:15 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-04-17 21:04 - 2015-03-17 07:13 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-04-17 21:04 - 2015-03-17 07:13 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 07:01 - 03976632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-04-17 21:04 - 2015-03-17 07:01 - 03920824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-04-17 21:04 - 2015-03-17 06:59 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-04-17 21:04 - 2015-03-17 06:57 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-04-17 21:04 - 2015-03-17 06:56 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-04-17 21:04 - 2015-03-17 06:56 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-04-17 21:04 - 2015-03-17 06:56 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-04-17 21:04 - 2015-03-17 06:56 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-04-17 21:04 - 2015-03-17 06:56 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-04-17 21:04 - 2015-03-17 06:56 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-04-17 21:04 - 2015-03-17 06:56 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-04-17 21:04 - 2015-03-17 06:53 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-04-17 21:04 - 2015-03-17 06:53 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 06:50 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 05:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-04-17 21:04 - 2015-03-17 05:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-04-17 21:04 - 2015-03-17 05:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 05:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 05:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-04-17 21:04 - 2015-03-17 05:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-04-17 21:04 - 2015-03-13 06:32 - 24980480 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-04-17 21:04 - 2015-03-13 06:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-04-17 21:04 - 2015-03-13 06:25 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-04-17 21:04 - 2015-03-13 06:09 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-04-17 21:04 - 2015-03-13 06:08 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-04-17 21:04 - 2015-03-13 06:08 - 00417280 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-04-17 21:04 - 2015-03-13 06:08 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-04-17 21:04 - 2015-03-13 06:07 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-04-17 21:04 - 2015-03-13 06:06 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-04-17 21:04 - 2015-03-13 06:00 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-04-17 21:04 - 2015-03-13 05:59 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-04-17 21:04 - 2015-03-13 05:55 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-04-17 21:04 - 2015-03-13 05:54 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-04-17 21:04 - 2015-03-13 05:54 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-04-17 21:04 - 2015-03-13 05:53 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-04-17 21:04 - 2015-03-13 05:50 - 06025216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-04-17 21:04 - 2015-03-13 05:44 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-04-17 21:04 - 2015-03-13 05:42 - 19695616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-04-17 21:04 - 2015-03-13 05:42 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-04-17 21:04 - 2015-03-13 05:40 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-04-17 21:04 - 2015-03-13 05:32 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-04-17 21:04 - 2015-03-13 05:28 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-04-17 21:04 - 2015-03-13 05:28 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-04-17 21:04 - 2015-03-13 05:27 - 00340992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-04-17 21:04 - 2015-03-13 05:27 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-04-17 21:04 - 2015-03-13 05:27 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-04-17 21:04 - 2015-03-13 05:26 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-04-17 21:04 - 2015-03-13 05:26 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-04-17 21:04 - 2015-03-13 05:23 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-04-17 21:04 - 2015-03-13 05:22 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-04-17 21:04 - 2015-03-13 05:20 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-04-17 21:04 - 2015-03-13 05:20 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-04-17 21:04 - 2015-03-13 05:17 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-04-17 21:04 - 2015-03-13 05:16 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-04-17 21:04 - 2015-03-13 05:15 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-04-17 21:04 - 2015-03-13 05:08 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-04-17 21:04 - 2015-03-13 05:07 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-04-17 21:04 - 2015-03-13 05:06 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-04-17 21:04 - 2015-03-13 05:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-04-17 21:04 - 2015-03-13 05:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-04-17 21:04 - 2015-03-13 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-04-17 21:04 - 2015-03-13 05:00 - 14397440 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-04-17 21:04 - 2015-03-13 04:57 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-04-17 21:04 - 2015-03-13 04:56 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-04-17 21:04 - 2015-03-13 04:54 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-04-17 21:04 - 2015-03-13 04:49 - 04305408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-04-17 21:04 - 2015-03-13 04:45 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-04-17 21:04 - 2015-03-13 04:44 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-04-17 21:04 - 2015-03-13 04:43 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-04-17 21:04 - 2015-03-13 04:42 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-04-17 21:04 - 2015-03-13 04:34 - 12825600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-04-17 21:04 - 2015-03-13 04:33 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-04-17 21:04 - 2015-03-13 04:22 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-04-17 21:04 - 2015-03-13 04:20 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-04-17 21:04 - 2015-03-13 04:16 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-04-17 21:04 - 2015-03-13 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-04-17 21:04 - 2015-03-10 05:25 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-04-17 21:04 - 2015-03-10 05:21 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-04-17 21:04 - 2015-03-10 05:08 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-04-17 21:04 - 2015-03-10 05:05 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-04-17 21:04 - 2015-03-05 07:12 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-04-17 21:04 - 2015-03-05 06:05 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-04-17 21:04 - 2015-02-25 05:18 - 00754688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\http.sys
2015-04-17 21:03 - 2015-03-04 06:55 - 00367552 _____ (Microsoft Corporation) C:\Windows\system32\clfs.sys
2015-04-17 21:03 - 2015-03-04 06:41 - 00079360 _____ (Microsoft Corporation) C:\Windows\system32\clfsw32.dll
2015-04-17 21:03 - 2015-03-04 06:10 - 00058880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\clfsw32.dll
2015-04-04 22:42 - 2015-04-04 22:42 - 00000000 ___SD () C:\Windows\SysWOW64\GWX
2015-04-04 22:42 - 2015-04-04 22:42 - 00000000 ___SD () C:\Windows\system32\GWX

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-05-03 14:34 - 2012-10-25 15:37 - 00000000 ____D () C:\Users\Anne\AppData\Roaming\uTorrent
2015-05-03 14:30 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-03 14:30 - 2009-07-14 06:45 - 00028944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-03 14:29 - 2012-10-24 19:02 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-03 14:27 - 2012-10-24 18:17 - 00000000 ____D () C:\Users\Anne
2015-05-03 14:26 - 2011-04-12 09:43 - 00699884 _____ () C:\Windows\system32\perfh007.dat
2015-05-03 14:26 - 2011-04-12 09:43 - 00149766 _____ () C:\Windows\system32\perfc007.dat
2015-05-03 14:26 - 2009-07-14 07:13 - 01622300 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-03 14:25 - 2012-10-24 18:17 - 02003294 _____ () C:\Windows\WindowsUpdate.log
2015-05-03 14:21 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-02 22:19 - 2012-10-25 10:16 - 00000000 ____D () C:\Users\Anne\AppData\Roaming\SoftGrid Client
2015-05-02 21:20 - 2014-10-04 15:43 - 02087424 ___SH () C:\Users\Anne\Desktop\Thumbs.db
2015-05-02 20:51 - 2013-10-22 18:43 - 00000000 ____D () C:\Users\Anne\Documents\Serien
2015-05-02 19:51 - 2014-12-14 20:33 - 00000000 ____D () C:\Users\Anne\Documents\Scrivener Backups
2015-04-26 20:40 - 2013-08-10 11:10 - 00000000 ____D () C:\Program Files (x86)\ElsterFormular
2015-04-26 20:39 - 2013-08-10 11:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ElsterFormular
2015-04-26 16:43 - 2012-10-24 18:45 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-04-23 18:25 - 2015-03-30 16:34 - 00000000 ____D () C:\Users\Anne\AppData\Roaming\Media Player Classic
2015-04-22 13:35 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\AppCompat
2015-04-20 22:44 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-04-20 15:23 - 2013-11-24 12:20 - 00000000 ____D () C:\ProgramData\Oracle
2015-04-20 15:14 - 2014-01-22 20:14 - 00002465 _____ () C:\Users\Anne\Desktop\Sweet Home 3D.lnk
2015-04-20 15:14 - 2014-01-01 19:02 - 00000000 ____D () C:\Program Files (x86)\Java
2015-04-20 15:13 - 2014-01-22 20:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2015-04-20 15:13 - 2014-01-01 19:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-04-20 14:06 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-04-19 16:14 - 2015-03-21 17:55 - 00002770 _____ () C:\Windows\System32\Tasks\CCleanerSkipUAC
2015-04-19 15:04 - 2014-12-11 13:53 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-19 15:04 - 2014-05-07 09:38 - 00000000 ___SD () C:\Windows\system32\CompatTel
2015-04-19 15:04 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-04-17 22:42 - 2012-10-25 10:16 - 01595644 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2015-04-17 22:41 - 2014-11-03 09:47 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-04-17 22:41 - 2013-06-22 22:08 - 00000000 ____D () C:\ProgramData\Skype
2015-04-17 22:40 - 2013-07-13 11:32 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-17 22:39 - 2012-11-24 18:33 - 128913832 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-17 21:29 - 2012-10-24 19:02 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-04-17 21:29 - 2012-10-24 19:02 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-04-17 21:29 - 2012-10-24 19:02 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-04-17 20:57 - 2014-08-08 07:59 - 00000000 ____D () C:\ProgramData\Package Cache
2015-04-17 20:57 - 2013-01-21 21:52 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-17 20:57 - 2013-01-21 21:52 - 00000000 ____D () C:\Program Files (x86)\Avira

==================== Files in the root of some directories =======

2012-11-07 18:30 - 2014-02-16 13:44 - 0011776 _____ () C:\Users\Anne\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-10-24 18:19 - 2012-10-24 18:19 - 0017408 _____ () C:\Users\Anne\AppData\Local\WebpageIcons.db

Files to move or delete:
====================
C:\Users\Anne\mplayerc.exe


Some content of TEMP:
====================
C:\Users\Anne\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-24 17:30

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-05-2015
Ran by Anne at 2015-05-03 14:36:18
Running from C:\Users\Anne\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3487932388-2619483569-1009563589-500 - Administrator - Disabled)
Anne (S-1-5-21-3487932388-2619483569-1009563589-1000 - Administrator - Enabled) => C:\Users\Anne
Gast (S-1-5-21-3487932388-2619483569-1009563589-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3487932388-2619483569-1009563589-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKU\S-1-5-21-3487932388-2619483569-1009563589-1000\...\uTorrent) (Version: 3.4.2.32239 - BitTorrent Inc.)
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.9.504 - Avira Operations GmbH & Co. KG)
CCleaner (HKLM\...\CCleaner) (Version: 5.03 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
ComicRack v0.9.176 (HKLM\...\ComicRack) (Version: v0.9.176 - cYo Soft)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Defraggler (HKLM\...\Defraggler) (Version: 2.19 - Piriform)
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 16.1.16483 - Landesfinanzdirektion Thüringen)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Freemake Video Converter Version 4.1.5 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.5 - Ellora Assets Corporation)
Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 3.21.2.1 - Futuremark Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
K-Lite Mega Codec Pack 11.0.0 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 11.0.0 - )
LibreOffice 4.1.3.2 (HKLM-x32\...\{4F3722AD-197D-4DBB-BDFB-D2F0D6776354}) (Version: 4.1.3.2 - The Document Foundation)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3487932388-2619483569-1009563589-1000\...\OneDriveSetup.exe) (Version: 17.0.4035.0328 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 37.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 37.0.2 (x86 de)) (Version: 37.0.2 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MPC-HC 1.7.8 (HKLM-x32\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.7.8 - MPC-HC Team)
MyFreeCodec (HKU\S-1-5-21-3487932388-2619483569-1009563589-1000\...\MyFreeCodec) (Version:  - )
Nitro Reader 3 (HKLM\...\{4756C731-B54E-451A-9AF1-86E8AB1BEBBB}) (Version: 3.5.6.5 - Nitro)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
Opera 12.15 (HKLM-x32\...\Opera 12.15.1748) (Version: 12.15.1748 - Opera Software ASA)
PDF24 Creator 6.9.2 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.206.0 - Tracker Software Products Ltd)
Rapoo -Tastatur- und Maustreiber v1.7 (HKLM-x32\...\{7DED56EF-66D4-4F36-BC35-DC67B6277CC8}_is1) (Version:  - Rapoo Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6215 - Realtek Semiconductor Corp.)
REALTEK Wireless LAN Driver and Utility (HKLM-x32\...\{9C049499-055C-4a0c-A916-1D12314F45EB}) (Version: 1.00.0182 - REALTEK Semiconductor Corp.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.15.0 - SAMSUNG Electronics Co., Ltd.)
Scrivener Update (HKLM-x32\...\Scrivener 1800) (Version: 1860 - Literature and Latte)
Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.2.1 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
XMind 2013 (v3.4.0) (HKLM-x32\...\XMind_is1) (Version: 3.4.0.201311050558 - XMind Ltd.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Anne\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Anne\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Anne\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Anne\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3487932388-2619483569-1009563589-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Anne\AppData\Local\Microsoft\SkyDrive\17.0.4035.0328\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {5A5D4023-8427-4B2C-BB98-DA12146770D1} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxcontent => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {90839769-86F0-4D63-9503-7F4F9DD52DEA} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {9C817B49-43A2-45C9-8DCF-B493A4F4D08D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {A632DF07-5313-4A23-8479-5D644FA6C4FC} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {C0C209F8-66B1-44EB-B514-2063B1811DF6} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)
Task: {C506A3F4-37E4-4FAE-9ED7-57C9DB69742E} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {C92B3DBB-97AC-4E4A-B13C-BB6B7D0F4801} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-17] (Adobe Systems Incorporated)
Task: {D334175E-1408-439C-BCFE-0C61D2BEBF92} - System32\Tasks\Microsoft\Windows\Setup\gwx\runappraiser => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-03-25] (Microsoft Corporation)
Task: {DD5FA14D-90D1-4EAD-8413-5569182716FA} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-02-19] (Piriform Ltd)
Task: {FAD9D761-6E3A-46FC-9992-5EE09039DE5C} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-03-25] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) ==============

2009-12-04 10:48 - 2009-12-04 10:48 - 00022016 _____ () C:\Windows\System32\ml347Pl6.dll
2015-02-12 15:48 - 2013-01-05 11:05 - 01709736 _____ () C:\Program Files (x86)\Rapoo\RpWireless\LedStatus.exe
2015-02-12 15:48 - 2012-02-17 16:45 - 00042496 _____ () C:\Program Files (x86)\Rapoo\RpWireless\LedStatus.dll
2012-10-24 18:21 - 2009-12-09 21:20 - 00126976 _____ () C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\EnumDevLib.dll
2012-10-24 18:21 - 2011-07-07 01:46 - 00704000 _____ () C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\P2PLib.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3487932388-2619483569-1009563589-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Anne\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: CyberGhost => "C:\Program Files\CyberGhost 5\CyberGhost.EXE" /autostart
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\pdf24\pdf24.exe

==================== FirewallRules (whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

FirewallRules: [{CF30197D-24E5-4780-937E-2064D91B9F40}] => (Allow) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{635DDA53-37ED-4798-8698-47D5EABC5AD0}] => (Allow) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RtWLan.exe
FirewallRules: [{0FAB13D1-5CAB-431A-9451-0D7FD7F02F09}] => (Allow) LPort=1542
FirewallRules: [{6CFCA064-2C0F-4C0C-8ED2-24EF99E0E55D}] => (Allow) LPort=1542
FirewallRules: [{C0C11B13-3536-4799-A4EE-D11FC6E83757}] => (Allow) LPort=53
FirewallRules: [{A3D4A301-5E8B-4530-B9DF-305910751D59}] => (Allow) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RTLDHCP.exe
FirewallRules: [{BBFB429A-EC1F-447E-B39E-CED03DDD0BFC}] => (Allow) C:\Program Files (x86)\REALTEK\11n USB Wireless LAN Utility\RTLDHCP.exe
FirewallRules: [{B6FDBC0A-B747-4C2F-A6BB-6D4FA62169B6}] => (Allow) LPort=67
FirewallRules: [{AD557EC8-4F99-49C8-AF72-C0FAE0D41679}] => (Allow) LPort=68
FirewallRules: [{8EAE7ABA-3048-4A53-93EE-A0143D87F4AB}] => (Allow) LPort=53
FirewallRules: [{F61C4236-87B4-40B5-A128-51F8E8135772}] => (Allow) LPort=53
FirewallRules: [{F295CDA4-6B1C-4390-BF11-48FD27B947A1}] => (Allow) C:\Program Files (x86)\Opera\opera.exe
FirewallRules: [{D4C93ABA-1592-4281-8863-E6CB0D025AE3}] => (Allow) C:\Program Files (x86)\Opera\opera.exe
FirewallRules: [{E226A33D-BABF-4E50-BD71-F7FCD734CDB6}] => (Allow) C:\Users\Anne\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{7B672EA4-34A7-43FA-8ECF-00D30315BE13}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{E005D096-3F4D-4863-B46F-AAEE496A787B}] => (Allow) C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{A387CED4-308D-4FA0-8A24-2D842315EDCE}] => (Allow) C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe
FirewallRules: [{8643E953-7483-475A-A24E-75CC714E5879}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{03BD07E6-6563-4259-9797-39FD565E366F}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [TCP Query User{B01E47C1-CF6F-4572-ACA0-E14D8561EC4E}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [UDP Query User{DB0A45AD-3695-4638-9601-6DD0F42FBED9}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [{32072B49-86D8-40D1-8428-993C7079092A}] => (Allow) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
FirewallRules: [TCP Query User{0873C6BB-16A9-4F2C-932D-075D0DB7FD1B}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [UDP Query User{7AE7721F-AA76-4744-A493-44CBEFC33518}C:\program files (x86)\libreoffice 4\program\soffice.bin] => (Allow) C:\program files (x86)\libreoffice 4\program\soffice.bin
FirewallRules: [{42CF78AA-CEAC-459C-8CCB-1F690D9E0D7F}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{DC527C81-3729-4469-A3CA-9FEBB54CB7EC}] => (Allow) LPort=2869
FirewallRules: [{9E715A40-0A33-4477-9006-73AD9D9BEB59}] => (Allow) LPort=1900
FirewallRules: [{BC6D4E52-9EAC-4370-B5CE-6C8FAD0B3FD0}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [TCP Query User{129C72ED-01BD-4485-ADA3-11195DE2D378}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [UDP Query User{2C6CCEDA-627F-41F8-B642-6C7F9FC1A477}C:\program files\comicrack\comicrack.exe] => (Allow) C:\program files\comicrack\comicrack.exe
FirewallRules: [{4441DFDE-CA8E-4B08-808D-6D50E240BA93}] => (Block) C:\program files\comicrack\comicrack.exe
FirewallRules: [{C2722CEB-E261-433D-8065-14D0C8B95961}] => (Block) C:\program files\comicrack\comicrack.exe
FirewallRules: [{92CC9554-B441-4637-9D2D-F93F9523F654}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E7601775-4341-4F4E-BD5C-99D05F998AAE}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{161CACC8-9BCB-4A34-9E4C-BFB2871B44CF}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{A6CB770F-A5DF-4B90-9562-36D846AE8B93}C:\program files (x86)\mozilla firefox\firefox.exe] => (Block) C:\program files (x86)\mozilla firefox\firefox.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/03/2015 02:32:14 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.

Error: (05/03/2015 02:23:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2015 01:44:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2015 00:18:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/02/2015 08:29:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WINWORDC.EXE, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1248

Startzeit: 01d08505bf844278

Endzeit: 0

Anwendungspfad: Q:\140066.deu\Office14\WINWORDC.EXE

Berichts-ID: 0ed48e32-f0f9-11e4-9820-50465d06df3c

Error: (05/02/2015 08:18:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WINWORDC.EXE, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1238

Startzeit: 01d085044fe5d065

Endzeit: 0

Anwendungspfad: Q:\140066.deu\Office14\WINWORDC.EXE

Berichts-ID: 931c9247-f0f7-11e4-9820-50465d06df3c

Error: (05/02/2015 08:15:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (05/02/2015 08:15:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Error: (05/02/2015 11:28:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2015 01:10:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (05/03/2015 00:58:40 PM) (Source: volsnap) (EventID: 36) (User: )
Description: Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.

Error: (05/03/2015 00:17:39 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Realtek11nCU erreicht.

Error: (05/01/2015 01:08:42 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎30.‎04.‎2015 um 22:00:05 unerwartet heruntergefahren.

Error: (04/29/2015 01:48:45 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CyberGhost 5 Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (04/29/2015 01:48:45 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CyberGhost 5 Client Service erreicht.

Error: (04/24/2015 02:50:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CyberGhost 5 Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (04/24/2015 02:50:52 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CyberGhost 5 Client Service erreicht.

Error: (04/24/2015 02:50:49 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst Realtek11nCU erreicht.

Error: (04/23/2015 02:08:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CyberGhost 5 Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (04/23/2015 02:08:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CyberGhost 5 Client Service erreicht.


Microsoft Office Sessions:
=========================
Error: (05/03/2015 02:32:14 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Der Servername oder die Serveradresse konnte nicht verarbeitet werden.

Error: (05/03/2015 02:23:40 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2015 01:44:01 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/03/2015 00:18:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/02/2015 08:29:16 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: WINWORDC.EXE0.0.0.0124801d08505bf8442780Q:\140066.deu\Office14\WINWORDC.EXE0ed48e32-f0f9-11e4-9820-50465d06df3c

Error: (05/02/2015 08:18:13 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: WINWORDC.EXE0.0.0.0123801d085044fe5d0650Q:\140066.deu\Office14\WINWORDC.EXE931c9247-f0f7-11e4-9820-50465d06df3c

Error: (05/02/2015 08:15:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestG:\Programme\SoftonicDownloader_fuer_unlocker.exe

Error: (05/02/2015 08:15:31 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestG:\Programme\SoftonicDownloader_fuer_k-lite-codec-pack.exe

Error: (05/02/2015 11:28:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/01/2015 01:10:23 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info =========================== 

Processor: AMD FX(tm)-6100 Six-Core Processor 
Percentage of memory in use: 15%
Total physical RAM: 8174.12 MB
Available physical RAM: 6887.6 MB
Total Pagefile: 32172.31 MB
Available Pagefile: 30707.6 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:921.75 GB) (Free:821.88 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 6FA68A2B)
Partition 1: (Not Active) - (Size=9.8 GB) - (Type=27)
Partition 2: (Active) - (Size=921.7 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-03 14:43:33
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000066 Hitachi_ rev.JP4O 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Anne\AppData\Local\Temp\kfldqpod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                    0000000077211401 2 bytes JMP 757ab1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                      0000000077211419 2 bytes JMP 757ab31a C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                    0000000077211431 2 bytes JMP 75828f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                    000000007721144a 2 bytes CALL 75784885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                       * 9
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                       00000000772114dd 2 bytes JMP 75828802 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                00000000772114f5 2 bytes JMP 758289d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                       000000007721150d 2 bytes JMP 758286f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                0000000077211525 2 bytes JMP 75828ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                      000000007721153d 2 bytes JMP 7579fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                           0000000077211555 2 bytes JMP 757a68bf C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                    000000007721156d 2 bytes JMP 75828fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                      0000000077211585 2 bytes JMP 75828b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                         000000007721159d 2 bytes JMP 758286bc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                      00000000772115b5 2 bytes JMP 7579fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                    00000000772115cd 2 bytes JMP 757ab2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                00000000772116b2 2 bytes JMP 75828e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1652] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                00000000772116bd 2 bytes JMP 75828651 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                      0000000077211401 2 bytes JMP 757ab1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                        0000000077211419 2 bytes JMP 757ab31a C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                      0000000077211431 2 bytes JMP 75828f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                      000000007721144a 2 bytes CALL 75784885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                       * 9
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                         00000000772114dd 2 bytes JMP 75828802 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                  00000000772114f5 2 bytes JMP 758289d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                         000000007721150d 2 bytes JMP 758286f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                  0000000077211525 2 bytes JMP 75828ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                        000000007721153d 2 bytes JMP 7579fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                             0000000077211555 2 bytes JMP 757a68bf C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                      000000007721156d 2 bytes JMP 75828fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                        0000000077211585 2 bytes JMP 75828b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                           000000007721159d 2 bytes JMP 758286bc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                        00000000772115b5 2 bytes JMP 7579fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                      00000000772115cd 2 bytes JMP 757ab2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                  00000000772116b2 2 bytes JMP 75828e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[2996] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                  00000000772116bd 2 bytes JMP 75828651 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      0000000077211401 2 bytes JMP 757ab1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        0000000077211419 2 bytes JMP 757ab31a C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      0000000077211431 2 bytes JMP 75828f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      000000007721144a 2 bytes CALL 75784885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                       * 9
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000772114dd 2 bytes JMP 75828802 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000772114f5 2 bytes JMP 758289d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         000000007721150d 2 bytes JMP 758286f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  0000000077211525 2 bytes JMP 75828ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        000000007721153d 2 bytes JMP 7579fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             0000000077211555 2 bytes JMP 757a68bf C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      000000007721156d 2 bytes JMP 75828fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        0000000077211585 2 bytes JMP 75828b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           000000007721159d 2 bytes JMP 758286bc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000772115b5 2 bytes JMP 7579fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000772115cd 2 bytes JMP 757ab2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000772116b2 2 bytes JMP 75828e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2444] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000772116bd 2 bytes JMP 75828651 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                   0000000077211401 2 bytes JMP 757ab1ef C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                     0000000077211419 2 bytes JMP 757ab31a C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                   0000000077211431 2 bytes JMP 75828f09 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                   000000007721144a 2 bytes CALL 75784885 C:\Windows\syswow64\KERNEL32.dll
.text  ...                                                                                                                                                       * 9
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                      00000000772114dd 2 bytes JMP 75828802 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                               00000000772114f5 2 bytes JMP 758289d8 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                      000000007721150d 2 bytes JMP 758286f8 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                               0000000077211525 2 bytes JMP 75828ac2 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                     000000007721153d 2 bytes JMP 7579fc78 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                          0000000077211555 2 bytes JMP 757a68bf C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                   000000007721156d 2 bytes JMP 75828fc1 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                     0000000077211585 2 bytes JMP 75828b22 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                        000000007721159d 2 bytes JMP 758286bc C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                     00000000772115b5 2 bytes JMP 7579fd11 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                   00000000772115cd 2 bytes JMP 757ab2b0 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                               00000000772116b2 2 bytes JMP 75828e84 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Program Files\CyberGhost 5\Service.exe[2952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                               00000000772116bd 2 bytes JMP 75828651 C:\Windows\syswow64\KERNEL32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                         0000000077211401 2 bytes JMP 757ab1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                           0000000077211419 2 bytes JMP 757ab31a C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                         0000000077211431 2 bytes JMP 75828f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                         000000007721144a 2 bytes CALL 75784885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                                       * 9
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                            00000000772114dd 2 bytes JMP 75828802 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                     00000000772114f5 2 bytes JMP 758289d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                            000000007721150d 2 bytes JMP 758286f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                     0000000077211525 2 bytes JMP 75828ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                           000000007721153d 2 bytes JMP 7579fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                0000000077211555 2 bytes JMP 757a68bf C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                         000000007721156d 2 bytes JMP 75828fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                           0000000077211585 2 bytes JMP 75828b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                              000000007721159d 2 bytes JMP 758286bc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                           00000000772115b5 2 bytes JMP 7579fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                         00000000772115cd 2 bytes JMP 757ab2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                     00000000772116b2 2 bytes JMP 75828e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Anne\AppData\Roaming\uTorrent\uTorrent.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                     00000000772116bd 2 bytes JMP 75828651 C:\Windows\syswow64\kernel32.dll

---- EOF - GMER 2.1 ----