| |
| |||||||
Log-Analyse und Auswertung: PC friert ein: Bild bleibt stehen, Maus nicht bewegbar.Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
13.06.2015, 17:31
| #1 |
| |  PC friert ein: Bild bleibt stehen, Maus nicht bewegbar. Hallo, seit ungefähr 3 Monaten friert mein PC in unterschiedlichen Abständen (meistens 30min, aber manchmal auch nach weniger oder erst nach paar Stunden) ein. Wenn es passiert laggt es kurz, dann Bleibt das Bild stehen, nach ca. 5sek friert auch der Mauszeiger ein und nach so 30sek geht auch der Ton aus, falls irgendein Song oder ähnlichen läuft, dieses Problem lässt sich nur beheben, wenn ich den Stecker ziehe (Der ON/OFF Button am PC funktioniert in diesem Zustand leider auch nicht). Manchmal kommt auch ein komischer Geruch aus dem Prozessor bei soeinem Vorfall auf, es riecht meines Erachtens nach etwas Verbranntem. Wenn ich den Pc für ca. 20min ausgeschaltet lasse, kann ich den Pc wieder für ca 30min benutzen, falls ich ihn früher starte, stürzt er auch früher ab. Hier die Logfiles: defrogger: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:19 on 13/06/2015 (Xation RAP)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015
Ran by Xation RAP (administrator) on ALEXANDER-PC on 13-06-2015 16:21:21
Running from C:\Users\Xation RAP\Desktop
Loaded Profiles: Xation RAP (Available Profiles: Xation RAP & kaa & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
() C:\Windows\System32\dmwu.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
() C:\Windows\SysWOW64\mjcm\dnkt.exe
() C:\Windows\System32\tprb\dnkt.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Curse) C:\Users\Xation RAP\AppData\Local\Apps\2.0\ZBV8ZOG4.WMY\AB2QM7DM.KEQ\curs..tion_9e9e83ddf3ed3ead_0005.0001_36a9b62c0f9ec26c\CurseClient.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-08-06] (Egis Technology Inc.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7883296 2009-06-16] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-06-16] (Realtek Semiconductor Corp.)
HKLM\...\Run: [LogMeIn GUI] => "C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe"
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2754704 2015-05-23] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [126712 2014-12-31] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-3370461886-3779078357-998046073-1017\...\MountPoints2: {be1f98f1-8b6c-11e4-a348-00016c70c901} - F:\startme.exe
Startup: C:\Users\Alex #1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\config.xml [2012-08-29] ()
Startup: C:\Users\Alex #1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip [2012-09-28] ()
Startup: C:\Users\Alex #1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk [2012-04-13]
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe (No File)
Startup: C:\Users\Alex #1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tinychat.lnk [2012-07-23]
ShortcutTarget: Tinychat.lnk -> C:\Program Files (x86)\Tinychat\Tinychat.exe (No File)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk [2014-12-02]
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Xation RAP\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip [2014-09-04] ()
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll [2009-08-06] (Egis Technology Inc.)
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL =
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL =
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3370461886-3779078357-998046073-1017\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/
HKU\S-1-5-21-3370461886-3779078357-998046073-1017\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}
URLSearchHook: HKLM-x32 - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File
URLSearchHook: HKLM-x32 - (No Name) - {542e4d79-1970-4e95-9862-fdb96f61b280} - No File
URLSearchHook: HKLM-x32 - (No Name) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - No File
URLSearchHook: HKLM-x32 - (No Name) - {2ea04d33-5259-40b9-b79b-cb037d4824e7} - No File
URLSearchHook: HKLM-x32 - (No Name) - {f999a48b-1950-4d81-9971-79018f807b4b} - No File
URLSearchHook: HKLM-x32 - (No Name) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - No File
URLSearchHook: HKLM-x32 - (No Name) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - No File
URLSearchHook: HKLM-x32 - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No File
SearchScopes: HKLM-x32 -> URL ${SEARCH_URL}{searchTerms}
SearchScopes: HKU\.DEFAULT -> {33524C00-63FB-43DB-A6BF-0A4E14B24649} URL = hxxp://www.basicscan.com/?prt=BASICSCAN115&keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-3370461886-3779078357-998046073-1017 -> DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid=&&st=23&did=10963&UPN2=92545566360146822
SearchScopes: HKU\S-1-5-21-3370461886-3779078357-998046073-1017 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKU\S-1-5-21-3370461886-3779078357-998046073-1017 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://mysearch.sweetpacks.com?src=6&q={searchTerms}&barid=&&st=23&did=10963&UPN2=92545566360146822
BHO: Web Assistant -> {336D0C35-8A85-403a-B9D2-65C292C39087} -> C:\Program Files\Web Assistant\Extension64.dll [2013-01-29] ()
BHO: Expat Shield Class -> {3706EE7C-3CAD-445D-8A43-03EBC3B75908} -> No File
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2012-09-03] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-28] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2012-09-03] (Oracle Corporation)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-11-20] (DVDVideoSoft Ltd.)
BHO: Hotspot Shield Class -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll [2009-10-22] (Hewlett-Packard Co.)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2012-11-29] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2012-11-29] (Oracle Corporation)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll [2009-10-22] (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKU\S-1-5-21-3370461886-3779078357-998046073-1017 -> No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Hosts: 127.0.0.1 arctium.logon.battle.net
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\Xation RAP\AppData\Roaming\Mozilla\Firefox\Profiles\ay5bc43f.default
FF DefaultSearchEngine : Google
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-12] ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll [2012-09-03] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.7.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2012-09-03] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-12] ()
FF Plugin-x32: @checkpoint.com/FFApi -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.116.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.132.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll [2012-11-29] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2012-11-29] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-13] (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin -> C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-19] (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-10] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll [2011-02-02] (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2010-11-10] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2012-08-01] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2012-08-01] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2012-08-01] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2012-08-01] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2012-08-01] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll [2012-08-01] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll [2012-08-01] (Apple Inc.)
FF SearchPlugin: C:\Users\Xation RAP\AppData\Roaming\Mozilla\Firefox\Profiles\ay5bc43f.default\searchplugins\MyStart Search.xml [2015-06-06]
FF SearchPlugin: C:\Users\Xation RAP\AppData\Roaming\Mozilla\Firefox\Profiles\ay5bc43f.default\searchplugins\MyStart.xml [2013-10-03]
FF SearchPlugin: C:\Users\Xation RAP\AppData\Roaming\Mozilla\Firefox\Profiles\ay5bc43f.default\searchplugins\Sweetpacks Search.xml [2015-06-13]
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\adawaretb.xml [2013-08-08]
FF Extension: Download videos and MP3s from YouTube - C:\Users\Xation RAP\AppData\Roaming\Mozilla\Firefox\Profiles\ay5bc43f.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-11-29]
FF Extension: QuickStores-Toolbar - C:\Program Files (x86)\Mozilla Firefox\extensions\quickstores@quickstores.de [2010-07-13]
FF Extension: BasicScan - C:\Program Files (x86)\Mozilla Firefox\extensions\{6AA54174-C9E8-4B07-95A0-0FBC19CBE64C} [2011-12-14]
FF HKLM\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF Extension: Web Assistant - C:\Program Files\Web Assistant\Firefox [2012-06-24]
FF HKLM\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{336D0C35-8A85-403a-B9D2-65C292C39087}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-11-29]
FF HKLM-x32\...\Firefox\Extensions: [{FE1DEEEA-DB6D-44b8-83F0-34FC0F9D1052}] - C:\Program Files\Web Assistant\Firefox
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2014-12-02]
FF HKU\S-1-5-21-3370461886-3779078357-998046073-1017\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF HKU\S-1-5-21-3370461886-3779078357-998046073-1017\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF ExtraCheck: C:\Program Files (x86)\mozilla firefox\firefox.cfg [2013-01-30] <==== ATTENTION
Chrome:
=======
CHR Profile: C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (ProxFlow) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-11-06]
CHR Extension: (Google Drive) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-08-31]
CHR Extension: (YouTube) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-08-31]
CHR Extension: (Adblock Plus) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2015-02-04]
CHR Extension: (Google Search) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-08-31]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-13]
CHR Extension: (Google Wallet) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-31]
CHR Extension: (Gmail) - C:\Users\Xation RAP\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-08-31]
CHR HKLM\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-06-24]
CHR HKLM-x32\...\Chrome\Extension: [dhdepfaagokllfmhfbcfmocaeigmoebo] - C:\Users\Alex #1\AppData\Local\Savings Sidekick\Chrome\Savings Sidekick.crx [2012-10-09]
CHR HKLM-x32\...\Chrome\Extension: [dlnembnfbcpjnepmfjmngjenhhajpdfd] - C:\Program Files\Web Assistant\source.crx [2012-06-24]
CHR HKLM-x32\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Alex #X\AppData\Roaming\BabSolution\CR\Delta.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ikechanjclfkclficnnobciobfhbhgno] - C:\ProgramData\Download and Sa\ikechanjclfkclficnnobciobfhbhgno.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [jcdgjdiieiljkfkdcloehkohchhpekkn] - C:\Users\Alex #1\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetFB.crx [2012-09-24]
CHR HKLM-x32\...\Chrome\Extension: [jpnbdefcbnoefmmcpelplabbkfmfhlho] - C:\Users\Notfall-Konto\AppData\Local\Premiumplay Codec-C\Chrome\Premiumplay Codec-C.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [kfkcangbigakljkjeglcofaomihpejif] - C:\Users\Alex #1\AppData\Local\CRE\kfkcangbigakljkjeglcofaomihpejif.crx [2012-09-09]
CHR HKLM-x32\...\Chrome\Extension: [leocdeigfnkaojcapikdjcdbedcjmffc] - C:\Users\Alex #1\AppData\Local\CRE\leocdeigfnkaojcapikdjcdbedcjmffc.crx [2012-08-26]
CHR HKLM-x32\...\Chrome\Extension: [mpfkfpmlciebaiepdediekoemmjaoong] - C:\Users\Alex Normales Konto\AppData\Local\PC Speed Up Extension\Chrome\PC Speed Up Extension.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [niapdbllcanepiiimjjndipklodoedlc] - C:\Users\ALEX#1~1\AppData\Local\Temp\YontooLayers.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\chrome-newtab-search.crx [Not Found]
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Windows\SysWOW64\mjcm\SweetNT.crx [2014-07-16]
CHR HKLM-x32\...\Chrome\Extension: [pliakegieldboipflllagplgjdhagpca] - C:\ProgramData\Bcool\pliakegieldboipflllagplgjdhagpca.crx [2012-09-19]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-07] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [178424 2014-12-31] (Avira Operations GmbH & Co. KG)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-23] (NVIDIA Corporation)
R2 IBUpdaterService; C:\Windows\system32\dmwu.exe [3039536 2015-01-05] ()
R2 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [311592 2009-08-06] (Egis Technology Inc.)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1893008 2015-05-23] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [23006864 2015-05-23] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-07-07] ()
R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1026432 2015-06-08] (Enigma Software Group USA, LLC.)
S4 Web Assistant; C:\Program Files\Web Assistant\ExtensionUpdaterService.exe [188760 2013-01-29] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S3 getPlusHelper; C:\Program Files (x86)\NOS\bin\getPlus_Helper.dll [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-07] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
S3 cpuz137; C:\Program Files (x86)\CPUID\PC Wizard 2013\pcwiz_x64.sys [26856 2014-02-17] (CPUID)
R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2015-06-08] (Enigma Software Group USA, LLC.)
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2015-06-08] ()
S3 gfiark; C:\Windows\System32\drivers\gfiark.sys [39504 2013-04-11] (ThreatTrack Security)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-08-18] (GFI Software)
S4 LMIRfsClientNP; No ImagePath
S3 ManyCam; C:\Windows\System32\DRIVERS\mcvidrv_x64.sys [44928 2012-10-11] (ManyCam LLC)
S3 mcaudrv_simple; C:\Windows\System32\drivers\mcaudrv_x64.sys [28160 2013-01-31] (ManyCam LLC)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-23] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2015-04-03] (NVIDIA Corporation)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-06-21] (Anchorfree Inc.)
S3 XSplit_Dummy; C:\Windows\System32\drivers\xspltspk.sys [26200 2014-07-02] (SplitmediaLabs Limited)
S3 IAMTVE; \SystemRoot\system32\DRIVERS\IAMTVE.sys [X]
S3 IAMTXPE; \SystemRoot\system32\DRIVERS\IAMTXPE.sys [X]
S2 LMIInfo; \??\C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [X]
S3 NAL; \??\C:\Windows\system32\Drivers\iqvw64e.sys [X]
S3 RTL8192su; system32\DRIVERS\RTL8192su.sys [X]
S0 TfFsMon; system32\drivers\TfFsMon.sys [X]
S3 TfNetMon; \??\C:\Windows\system32\drivers\TfNetMon.sys [X]
S0 TFSysMon; system32\drivers\TfSysMon.sys [X]
S3 X6va006; \??\C:\Users\NOTFAL~1\AppData\Local\Temp\006DFD6.tmp [X]
S3 X6va008; \??\C:\Windows\SysWOW64\Drivers\X6va008 [X]
==================== NetSvcs (Whitelisted) ===================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
==================== One Month Created files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-13 16:21 - 2015-06-13 16:21 - 00027259 _____ C:\Users\Xation RAP\Desktop\FRST.txt
2015-06-13 16:21 - 2015-06-13 16:21 - 00000000 ____D C:\FRST
2015-06-13 16:20 - 2015-06-13 16:20 - 02108928 _____ (Farbar) C:\Users\Xation RAP\Desktop\FRST64.exe
2015-06-13 16:19 - 2015-06-13 16:19 - 00050477 _____ C:\Users\Xation RAP\Desktop\Defogger.exe
2015-06-13 16:19 - 2015-06-13 16:19 - 00000482 _____ C:\Users\Xation RAP\Desktop\defogger_disable.log
2015-06-13 16:19 - 2015-06-13 16:19 - 00000000 _____ C:\Users\Xation RAP\defogger_reenable
2015-06-11 00:26 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-11 00:26 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-11 00:26 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-11 00:26 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-11 00:26 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-11 00:26 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-11 00:26 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-11 00:26 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-11 00:26 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-11 00:26 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-11 00:25 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-11 00:25 - 2015-05-09 05:27 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-11 00:25 - 2015-05-09 05:27 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-11 00:25 - 2015-05-09 05:27 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-11 00:25 - 2015-05-09 05:27 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-11 00:25 - 2015-05-09 05:26 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-11 00:25 - 2015-05-09 05:26 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-11 00:25 - 2015-05-09 05:26 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-11 00:25 - 2015-05-09 05:25 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-11 00:25 - 2015-05-09 05:20 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:20 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:13 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-11 00:25 - 2015-05-09 05:13 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-11 00:25 - 2015-05-09 05:12 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-11 00:25 - 2015-05-09 05:12 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-11 00:25 - 2015-05-09 05:12 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 05:08 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 04:01 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-11 00:25 - 2015-05-09 04:01 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-11 00:25 - 2015-05-09 03:59 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 03:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 03:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-11 00:25 - 2015-05-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-11 00:25 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-11 00:25 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-11 00:22 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-11 00:22 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-11 00:22 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-11 00:22 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-11 00:22 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-11 00:22 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-11 00:22 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-11 00:22 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-11 00:22 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-11 00:22 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-11 00:22 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-11 00:22 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-11 00:22 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-11 00:22 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-11 00:22 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-11 00:22 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-11 00:22 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-11 00:22 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-11 00:22 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-11 00:22 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-11 00:22 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-11 00:22 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-11 00:22 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-11 00:22 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-11 00:22 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-11 00:22 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-11 00:22 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-11 00:22 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-11 00:22 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-11 00:22 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-11 00:22 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-11 00:22 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-11 00:22 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-11 00:22 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-11 00:22 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-11 00:22 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-11 00:22 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-11 00:22 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-11 00:22 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-11 00:22 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-11 00:22 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-11 00:22 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-11 00:22 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-11 00:22 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-11 00:22 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-11 00:22 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-11 00:22 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-11 00:22 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-11 00:22 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-11 00:22 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-11 00:22 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-11 00:22 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-11 00:22 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-11 00:22 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-11 00:22 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-11 00:22 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-11 00:22 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-11 00:22 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-11 00:22 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-11 00:22 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-11 00:22 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-11 00:08 - 2015-06-11 00:08 - 00000000 ____D C:\Program Files (x86)\Microsoft ASP.NET
2015-06-09 13:08 - 2015-06-09 13:15 - 00000404 _____ C:\Windows\Tasks\SpyHunter4.job
2015-06-09 13:08 - 2015-06-09 13:09 - 00003784 _____ C:\Windows\System32\Tasks\SpyHunter4
2015-06-08 15:37 - 2015-06-08 15:37 - 01197344 _____ C:\Users\Xation RAP\Downloads\HijackThis - CHIP-Installer (1).exe
2015-06-08 15:22 - 2015-06-08 15:22 - 01197344 _____ C:\Users\Xation RAP\Downloads\HijackThis - CHIP-Installer.exe
2015-06-08 15:03 - 2015-06-08 15:03 - 00003354 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2015-06-08 15:03 - 2015-06-08 15:03 - 00001091 _____ C:\Users\Xation RAP\Desktop\SpyHunter.lnk
2015-06-08 15:03 - 2015-06-08 15:03 - 00000000 ____D C:\Users\Xation RAP\AppData\Roaming\Enigma Software Group
2015-06-08 15:03 - 2015-06-08 15:03 - 00000000 ____D C:\sh4ldr
2015-06-08 15:03 - 2015-06-08 15:03 - 00000000 _____ C:\autoexec.bat
2015-06-08 15:02 - 2015-06-08 15:02 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2015-06-08 15:02 - 2015-06-08 15:02 - 00000000 ____D C:\Program Files\Enigma Software Group
2015-06-08 15:01 - 2015-06-08 15:01 - 03109248 _____ (Enigma Software Group USA, LLC.) C:\Users\Xation RAP\Downloads\SpyHunter-Installer.exe
2015-06-08 13:43 - 2015-06-08 13:43 - 00000000 ____D C:\temp
2015-06-08 13:42 - 2015-02-04 05:56 - 31515280 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 24198856 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 22993224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 17559432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 15294280 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 13916280 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 13828032 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 12894024 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2015-06-08 13:42 - 2015-02-04 05:56 - 11272240 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 11209192 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 04244680 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 03987600 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 02823992 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 01907400 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434144.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 01555656 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434144.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 00944328 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 00907464 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 00902344 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll
2015-06-08 13:42 - 2015-02-04 05:56 - 00870032 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll
2015-06-08 13:32 - 2015-04-03 15:21 - 00048784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll
2015-06-08 13:32 - 2015-04-03 15:21 - 00038032 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys
2015-06-07 16:41 - 2015-06-07 16:41 - 00003416 ____N C:\bootsqm.dat
2015-06-06 19:57 - 2015-06-06 19:59 - 00000000 ____D C:\Users\Xation RAP\Documents\Heroes of the Storm
2015-06-06 19:55 - 2015-06-06 19:55 - 00001199 _____ C:\Users\Public\Desktop\Heroes of the Storm.lnk
2015-06-06 19:55 - 2015-06-06 19:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Heroes of the Storm
2015-06-06 17:17 - 2015-06-13 15:03 - 00000000 ____D C:\Program Files (x86)\Heroes of the Storm
2015-06-06 15:04 - 2015-06-06 15:04 - 00001426 _____ C:\Users\Public\Desktop\World of Warcraft Public Test.lnk
2015-06-06 14:54 - 2015-06-13 12:13 - 00000000 ____D C:\Program Files (x86)\World of Warcraft Public Test
2015-06-06 01:45 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-06 01:45 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-06 01:45 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-06 01:45 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-06 01:45 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-06 01:45 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-06 01:45 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-06 01:45 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-02 23:59 - 2015-06-02 23:59 - 00000000 ____D C:\Users\Xation RAP\AppData\Local\GWX
2015-05-15 14:40 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 14:40 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
==================== One Month Modified files and folders ========
(If an entry is included in the fixlist, the file/folder will be moved.)
2015-06-13 16:19 - 2013-08-31 00:08 - 00000000 ____D C:\Users\Xation RAP
2015-06-13 16:17 - 2009-11-12 20:16 - 01571365 _____ C:\Windows\WindowsUpdate.log
2015-06-13 16:16 - 2013-12-19 19:32 - 00000000 ____D C:\Users\Xation RAP\AppData\Local\Deployment
2015-06-13 16:14 - 2015-02-04 06:54 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-13 16:14 - 2014-09-02 15:48 - 00000000 ____D C:\Users\Xation RAP\AppData\Local\SWDS
2015-06-13 16:14 - 2012-09-19 13:08 - 00000416 ____H C:\Windows\Tasks\OptimizerPro1UpdaterTask{DCEDDF43-55B1-46F9-B9F1-D2F857ADF13C}.job
2015-06-13 16:14 - 2012-09-19 09:05 - 00000416 ____H C:\Windows\Tasks\OptimizerPro1UpdaterTask{985914A4-7E5B-4A44-ABFF-BFA40E96F1AB}.job
2015-06-13 16:13 - 2013-06-20 16:06 - 00148642 _____ C:\Windows\setupact.log
2015-06-13 16:13 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-13 15:57 - 2009-07-14 06:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-13 15:57 - 2009-07-14 06:45 - 00018736 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-13 15:37 - 2014-03-16 12:52 - 00000000 ____D C:\Users\Xation RAP\AppData\Local\Battle.net
2015-06-13 14:52 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-13 14:28 - 2012-04-11 22:15 - 00001146 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3370461886-3779078357-998046073-1008UA.job
2015-06-13 14:24 - 2015-02-04 06:54 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-13 13:44 - 2012-04-22 09:20 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-12 23:28 - 2012-04-11 22:15 - 00001124 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3370461886-3779078357-998046073-1008Core.job
2015-06-12 00:45 - 2012-04-22 09:20 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-12 00:45 - 2012-04-22 09:20 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-12 00:45 - 2011-10-31 09:10 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-11 23:50 - 2012-11-29 01:04 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-11 23:50 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-11 23:49 - 2009-07-14 06:45 - 05052208 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 23:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-11 23:21 - 2009-08-15 06:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-11 00:50 - 2015-02-04 06:55 - 00002179 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2015-06-08 14:58 - 2013-08-04 10:16 - 00549480 _____ C:\Windows\PFRO.log
2015-06-08 13:57 - 2014-09-01 23:54 - 00000000 ____D C:\Users\Xation RAP\AppData\Local\NVIDIA Corporation
2015-06-08 13:57 - 2014-09-01 23:54 - 00000000 ____D C:\Users\Xation RAP\AppData\Local\NVIDIA
2015-06-08 13:46 - 2009-11-12 20:23 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-08 13:42 - 2012-11-18 10:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
2015-06-08 13:33 - 2012-02-20 21:22 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-06-08 13:32 - 2012-03-09 19:29 - 00000000 ____D C:\ProgramData\boost_interprocess
2015-06-08 13:32 - 2012-02-20 21:22 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-06-08 13:31 - 2014-12-19 18:26 - 00000000 ____D C:\Users\kaa\AppData\Local\NVIDIA Corporation
2015-06-08 13:31 - 2014-12-19 18:26 - 00000000 ____D C:\Users\kaa\AppData\Local\NVIDIA
2015-06-08 13:23 - 2014-12-19 18:31 - 00000000 ____D C:\Users\kaa\AppData\Roaming\Avira
2015-06-06 19:57 - 2010-08-24 19:51 - 00000000 ____D C:\ProgramData\Blizzard Entertainment
2015-06-06 15:57 - 2014-07-13 11:24 - 00000000 ____D C:\Program Files (x86)\World of Warcraft
2015-06-06 14:53 - 2014-03-16 12:52 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-06-06 13:24 - 2014-12-11 11:08 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-06 13:24 - 2014-05-07 00:40 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-05-30 23:44 - 2013-12-28 14:17 - 00000000 ____D C:\Users\Xation RAP\AppData\Local\Spotify
2015-05-30 23:38 - 2015-05-01 12:59 - 00000000 ____D C:\Users\Xation RAP\AppData\Roaming\Spotify
2015-05-23 03:47 - 2014-09-01 23:54 - 01756424 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll
2015-05-23 03:47 - 2014-09-01 23:54 - 01571696 _____ (NVIDIA Corporation) C:\Windows\system32\nvspcap64.dll
2015-05-23 03:47 - 2014-09-01 23:54 - 01320304 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspcap.dll
2015-05-23 03:47 - 2014-09-01 23:54 - 01316000 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll
2015-05-21 00:06 - 2009-11-11 14:33 - 00699490 _____ C:\Windows\system32\perfh007.dat
2015-05-21 00:06 - 2009-11-11 14:33 - 00149630 _____ C:\Windows\system32\perfc007.dat
2015-05-21 00:06 - 2009-07-14 07:13 - 01620932 _____ C:\Windows\system32\PerfStringBackup.INI
2015-05-19 23:49 - 2015-04-05 20:39 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-19 23:49 - 2015-04-05 20:39 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-19 23:19 - 2015-02-04 06:54 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-19 23:19 - 2015-02-04 06:54 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-19 10:26 - 2012-05-20 00:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-19 10:26 - 2012-05-20 00:25 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-15 15:28 - 2009-07-14 09:45 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-15 15:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-15 14:40 - 2012-05-20 00:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
==================== Files in the root of some directories =======
2009-08-15 06:11 - 2009-02-10 21:23 - 0192484 _____ () C:\Program Files (x86)\Common Files\Acer GameZone online.ico
2013-09-08 22:18 - 2015-01-14 18:19 - 0005120 _____ () C:\Users\Xation RAP\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-09-01 13:58 - 2014-09-11 01:29 - 0007600 _____ () C:\Users\Xation RAP\AppData\Local\Resmon.ResmonCfg
2011-12-14 16:58 - 2011-12-14 16:58 - 0000000 _____ () C:\ProgramData\386cda49d45d6907f28b0407f2be8d2d_c
2009-11-12 20:26 - 2009-11-12 20:28 - 0008031 _____ () C:\ProgramData\ArcadeDeluxe3.log
2009-08-15 06:12 - 2009-07-18 03:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
2011-01-04 23:30 - 2014-12-02 13:33 - 0007650 _____ () C:\ProgramData\hpzinstall.log
Some files in TEMP:
====================
C:\Users\Alex #1\AppData\Local\Temp\09132107isxdl.dll
C:\Users\Alex #1\AppData\Local\Temp\09132107mcpx.dll
C:\Users\Alex #1\AppData\Local\Temp\09132107ShellExt.dll
C:\Users\Alex #1\AppData\Local\Temp\09136141isxdl.dll
C:\Users\Alex #1\AppData\Local\Temp\09136141mcpx.dll
C:\Users\Alex #1\AppData\Local\Temp\09136141ShellExt.dll
C:\Users\Alex #1\AppData\Local\Temp\14102128isxdl.dll
C:\Users\Alex #1\AppData\Local\Temp\14102128mcpx.dll
C:\Users\Alex #1\AppData\Local\Temp\14102128ShellExt.dll
C:\Users\Alex #1\AppData\Local\Temp\7za.exe
C:\Users\Alex #1\AppData\Local\Temp\ApnIC.dll
C:\Users\Alex #1\AppData\Local\Temp\APNSTUB.EXE
C:\Users\Alex #1\AppData\Local\Temp\APNTOOLBARINSTALLER.EXE
C:\Users\Alex #1\AppData\Local\Temp\AskSLib.dll
C:\Users\Alex #1\AppData\Local\Temp\contentDATs.exe
C:\Users\Alex #1\AppData\Local\Temp\crt7360.tmp.exe
C:\Users\Alex #1\AppData\Local\Temp\ezLooker-S-Setup_Suite1.exe
C:\Users\Alex #1\AppData\Local\Temp\FastDownload.exe
C:\Users\Alex #1\AppData\Local\Temp\mgsqlite3.dll
C:\Users\Alex #1\AppData\Local\Temp\OptChrome.exe
C:\Users\Alex #1\AppData\Local\Temp\SEARCHRESULTSTOOLBAR.EXE
C:\Users\Alex #1\AppData\Local\Temp\setup_snapdo.exe
C:\Users\Alex #1\AppData\Local\Temp\Shortcut_bundlesweetimsetup.exe
C:\Users\Alex #1\AppData\Local\Temp\SIMEEIInstaller.exe
C:\Users\Alex #1\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Alex #1\AppData\Local\Temp\sonarinst.exe
C:\Users\Alex #1\AppData\Local\Temp\SQLite.dll
C:\Users\Alex #1\AppData\Local\Temp\sqlite3.exe
C:\Users\Alex #1\AppData\Local\Temp\swt-win32-3349.dll
C:\Users\Alex #1\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Alex #1\AppData\Local\Temp\tbDVDerror.dll
C:\Users\Alex #1\AppData\Local\Temp\tbedrs.dll
C:\Users\Alex #1\AppData\Local\Temp\twapi-be29e7f1-71ae-4703-50cb-1d52be512f51.dll
C:\Users\Alex #1\AppData\Local\Temp\utt37F6.tmp.exe
C:\Users\Alex #1\AppData\Local\Temp\YontooIEClient.dll
C:\Users\Alex #1\AppData\Local\Temp\YontooSetup-S.exe
C:\Users\kaa\AppData\Local\Temp\avgnt.exe
C:\Users\kaa\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\kaa\AppData\Local\Temp\nvStInst.exe
C:\Users\Xation RAP\AppData\Local\Temp\ApnIC.dll
C:\Users\Xation RAP\AppData\Local\Temp\APNSTUB.EXE
C:\Users\Xation RAP\AppData\Local\Temp\APNTOOLBARINSTALLER.EXE
C:\Users\Xation RAP\AppData\Local\Temp\AskSLib.dll
C:\Users\Xation RAP\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Xation RAP\AppData\Local\Temp\avgnt.exe
C:\Users\Xation RAP\AppData\Local\Temp\EASOUNInstaller.exe
C:\Users\Xation RAP\AppData\Local\Temp\GuardICQ.exe
C:\Users\Xation RAP\AppData\Local\Temp\gwunstal.exe
C:\Users\Xation RAP\AppData\Local\Temp\MouseKeyboardCenterx64_1031.exe
C:\Users\Xation RAP\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Xation RAP\AppData\Local\Temp\nvSCPAPISvr.exe
C:\Users\Xation RAP\AppData\Local\Temp\nvStInst.exe
C:\Users\Xation RAP\AppData\Local\Temp\SEARCHRESULTSTOOLBAR.EXE
C:\Users\Xation RAP\AppData\Local\Temp\Uninstall.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-04-07 16:26
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-13 16:33:49
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST310005 rev.CC44 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\XATION~1\AppData\Local\Temp\kglyauog.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960000e4d00 7 bytes [00, 89, F3, FF, C1, 98, F0]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff960000e4d08 3 bytes [C0, 06, 02]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075fd1401 2 bytes JMP 7788b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075fd1419 2 bytes JMP 7788b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075fd1431 2 bytes JMP 77908f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075fd144a 2 bytes CALL 7786489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075fd14dd 2 bytes JMP 77908822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075fd14f5 2 bytes JMP 779089f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075fd150d 2 bytes JMP 77908718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075fd1525 2 bytes JMP 77908ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075fd153d 2 bytes JMP 7787fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075fd1555 2 bytes JMP 778868ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075fd156d 2 bytes JMP 77908fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075fd1585 2 bytes JMP 77908b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075fd159d 2 bytes JMP 779086dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075fd15b5 2 bytes JMP 7787fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075fd15cd 2 bytes JMP 7788b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075fd16b2 2 bytes JMP 77908ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1764] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075fd16bd 2 bytes JMP 77908671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075fd1401 2 bytes JMP 7788b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075fd1419 2 bytes JMP 7788b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075fd1431 2 bytes JMP 77908f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075fd144a 2 bytes CALL 7786489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075fd14dd 2 bytes JMP 77908822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075fd14f5 2 bytes JMP 779089f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075fd150d 2 bytes JMP 77908718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075fd1525 2 bytes JMP 77908ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075fd153d 2 bytes JMP 7787fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075fd1555 2 bytes JMP 778868ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075fd156d 2 bytes JMP 77908fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075fd1585 2 bytes JMP 77908b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075fd159d 2 bytes JMP 779086dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075fd15b5 2 bytes JMP 7787fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075fd15cd 2 bytes JMP 7788b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075fd16b2 2 bytes JMP 77908ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[1800] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075fd16bd 2 bytes JMP 77908671 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 0000000073a817fa 2 bytes CALL 778611a9 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000073a81860 2 bytes CALL 778611a9 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000073a81942 2 bytes JMP 75ad7089 C:\Windows\syswow64\WS2_32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 0000000073a8194d 2 bytes JMP 75adcba6 C:\Windows\syswow64\WS2_32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075fd1401 2 bytes JMP 7788b21b C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075fd1419 2 bytes JMP 7788b346 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075fd1431 2 bytes JMP 77908f29 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075fd144a 2 bytes CALL 7786489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075fd14dd 2 bytes JMP 77908822 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075fd14f5 2 bytes JMP 779089f8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075fd150d 2 bytes JMP 77908718 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075fd1525 2 bytes JMP 77908ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075fd153d 2 bytes JMP 7787fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075fd1555 2 bytes JMP 778868ef C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075fd156d 2 bytes JMP 77908fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075fd1585 2 bytes JMP 77908b42 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075fd159d 2 bytes JMP 779086dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075fd15b5 2 bytes JMP 7787fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075fd15cd 2 bytes JMP 7788b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075fd16b2 2 bytes JMP 77908ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\PnkBstrA.exe[1956] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075fd16bd 2 bytes JMP 77908671 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075fd1401 2 bytes JMP 7788b21b C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075fd1419 2 bytes JMP 7788b346 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075fd1431 2 bytes JMP 77908f29 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075fd144a 2 bytes CALL 7786489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075fd14dd 2 bytes JMP 77908822 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075fd14f5 2 bytes JMP 779089f8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075fd150d 2 bytes JMP 77908718 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075fd1525 2 bytes JMP 77908ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075fd153d 2 bytes JMP 7787fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075fd1555 2 bytes JMP 778868ef C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075fd156d 2 bytes JMP 77908fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075fd1585 2 bytes JMP 77908b42 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075fd159d 2 bytes JMP 779086dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075fd15b5 2 bytes JMP 7787fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075fd15cd 2 bytes JMP 7788b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075fd16b2 2 bytes JMP 77908ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Windows\SysWOW64\mjcm\dnkt.exe[3980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075fd16bd 2 bytes JMP 77908671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075b22ab1 5 bytes JMP 00000001001af046
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075fd1401 2 bytes JMP 7788b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075fd1419 2 bytes JMP 7788b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075fd1431 2 bytes JMP 77908f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075fd144a 2 bytes CALL 7786489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075fd14dd 2 bytes JMP 77908822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075fd14f5 2 bytes JMP 779089f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075fd150d 2 bytes JMP 77908718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075fd1525 2 bytes JMP 77908ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075fd153d 2 bytes JMP 7787fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075fd1555 2 bytes JMP 778868ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075fd156d 2 bytes JMP 77908fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075fd1585 2 bytes JMP 77908b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075fd159d 2 bytes JMP 779086dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075fd15b5 2 bytes JMP 7787fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075fd15cd 2 bytes JMP 7788b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075fd16b2 2 bytes JMP 77908ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075fd16bd 2 bytes JMP 77908671 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075fd1401 2 bytes JMP 7788b21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075fd1419 2 bytes JMP 7788b346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075fd1431 2 bytes JMP 77908f29 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075fd144a 2 bytes CALL 7786489d C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075fd14dd 2 bytes JMP 77908822 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075fd14f5 2 bytes JMP 779089f8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075fd150d 2 bytes JMP 77908718 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075fd1525 2 bytes JMP 77908ae2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075fd153d 2 bytes JMP 7787fca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075fd1555 2 bytes JMP 778868ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075fd156d 2 bytes JMP 77908fe3 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075fd1585 2 bytes JMP 77908b42 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075fd159d 2 bytes JMP 779086dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075fd15b5 2 bytes JMP 7787fd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075fd15cd 2 bytes JMP 7788b2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075fd16b2 2 bytes JMP 77908ea4 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe[260] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075fd16bd 2 bytes JMP 77908671 C:\Windows\syswow64\kernel32.dll
---- Threads - GMER 2.1 ----
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [3828:4436] 000007feee93bc60
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3836:4488] 000007feeea9f5f8
Thread C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3836:4496] 000007feee93bc60
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2708:6480] 0000000076327587
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2708:3292] 000000006ee08aa6
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2708:6396] 0000000077db2e65
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2708:6640] 0000000077db3e85
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2708:2176] 0000000077db3e85
Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2708:5344] 0000000077db3e85
---- EOF - GMER 2.1 ----
Mit freundlichen Grüßen Alex |
| Themen zu PC friert ein: Bild bleibt stehen, Maus nicht bewegbar. |
| antivir, avira, browser, defender, esgscanner.sys, flash player, google, helper, hijack, hijackthis, home, hotspot, launch, maus, mozilla, problem, prozessor, realtek, registry, rundll, scan, security, services.exe, software, svchost.exe, system, temp, windows |
Baum-Darstellung