| |
| |||||||
Log-Analyse und Auswertung: Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für SchadwareWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
20.07.2015, 07:21
| #1 |
 |  Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware Hallo, habe seit einigen Tagen ein extrem langsames Internet. Habe mit "Netstat -a" bei Eingabeaufforderung weit über 100 Netzwerkverbindungen entdeckt - ein Zeichen für Virenbefall? Nutze aber Kaspersky Internet Security plus regelmäßig CCleaner (nur Cleaner, nicht an die Registry). Bis vor ein paar Tagen habe ich auch regelmäßig (alle 2 Wochen) Malware Antimalware durchlaufen lasse - immer ohne Fund. Inzwischen geht die Aktualisierung der Datenbank nicht mehr. Habe heute die neue Version runtergeladen, aber beim Suchlauf scheiter der Rechner an der Aktualisierung. Gerade meldet mit Malware folgendes: "Malwarebytes war nicht in der Lage,den ANti.Rootkit-DDA-Treiber zu laden. Dieser Fehler kann durch eine Rootkit-Aktivität verursacht werden. Möchten Sie das System neu starten und versuchen, den Treiber zu installieren? ..." Ich habe erstmal auf "nein" geklickt. LogFiles unten Fehlermeldung bei Gmer: "C:/Windows/system32/config/system: Der Prozess kann nciht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird" Ich freue mich über Hilfe, 1000 Dank! Gunther Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 07:33 on 20/07/2015 (Gunther)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:18-07-2015 01 Ran by Gunther (administrator) on ARLT on 20-07-2015 07:48:17 Running from C:\Users\Gunther\Desktop Loaded Profiles: Gunther (Available Profiles: Gunther & Kinder) Platform: Windows 8.1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe (Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\prl_stat.exe () C:\Program Files (x86)\Acronis\TrueImageHome\prl_report.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Intel Corporation) C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (MSI) C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe (Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe (Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis International GmbH) C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe (Microsoft Corporation) C:\Windows\splwow64.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7543000 2014-03-04] (Realtek Semiconductor) HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch HKLM\...\Run: [ISCT Tray] => C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTsysTray8.exe [5860656 2014-02-21] (Intel Corporation) HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2465088 2014-11-17] (NVIDIA Corporation) HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart HKLM\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo) HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [571192 2014-08-14] (Acronis) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-04-07] (Apple Inc.) HKLM-x32\...\Run: [Super Charger] => C:\Program Files (x86)\MSI\Super Charger\Super Charger.exe [1047536 2014-04-08] (MSI) HKLM-x32\...\Run: [CanonQuickMenu] => C:\Program Files (x86)\Canon\Quick Menu\CNQMMAIN.EXE [1284680 2014-01-17] (CANON INC.) HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5343272 2014-11-27] (Acronis) HKLM-x32\...\Run: [AcronisTibMounterMonitor] => C:\Program Files (x86)\Common Files\Acronis\TibMounter\TibMounterMonitor.exe [606096 2014-10-17] (Acronis International GmbH) HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd) HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [VDownloader] => C:\Program Files\VDownloader\VDownloader4.exe [3017216 2014-10-23] (Vitzo) HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [SkyDrive] => C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2015-01-04] (Microsoft Corporation) HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Rainlendar2] => C:\Program Files\Rainlendar2\Rainlendar2.exe [4411488 2014-03-16] () HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Run: [Monotype SkyFonts Clean Up] => C:\Program Files\Monotype\SkyFonts\Monotype.SkyFonts.CleanUp.exe Startup: C:\Users\Gunther\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sidebar660.lnk [2015-02-16] ShortcutTarget: Sidebar660.lnk -> C:\Program Files\Windows Sidebar\sidebar.exe (No File) ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers: [AcronisSyncError] -> {934BC6C0-FEC2-4df5-A100-961DE2C8A0ED} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis) ShellIconOverlayIdentifiers: [AcronisSyncInProgress] -> {00F848DC-B1D4-4892-9C25-CAADC86A215D} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis) ShellIconOverlayIdentifiers: [AcronisSyncOk] -> {71573297-552E-46fc-BE3D-3DFAF88D47B7} => C:\Program Files (x86)\Acronis\TrueImageHome\tishell64.dll [2014-09-09] (Acronis) ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Start Page = https://lernen.phase-6.de/#/login HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.arlt.com BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO) BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO) BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO) BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO) BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll [2014-12-15] (DVDVideoSoft Ltd.) BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO) BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2014-12-22] (Kaspersky Lab ZAO) BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO) BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO) BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll [2014-12-15] (DVDVideoSoft Ltd.) Tcpip\..\Interfaces\{071B0494-A52A-4CEC-ABF8-B2C19B27E7E2}: [NameServer] 195.50.140.182 195.50.140.114 FireFox: ======== FF ProfilePath: C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default FF Homepage: hxxp://www.google.de/ FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-20] () FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-20] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-02-19] (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-02-19] (Intel Corporation) FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22] () FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22] () FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22] () FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation) FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-11-12] (NVIDIA Corporation) FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-11-12] (NVIDIA Corporation) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.) FF user.js: detected! => C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default\user.js [2014-12-22] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\Gunther\AppData\Roaming\Mozilla\Firefox\Profiles\8fcu2t3l.default\Extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900} [2014-12-22] FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{B64D9B05-48E1-4CEB-BF58-E0643994E900}.xpi [2015-06-03] FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2014-12-22] FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2014-12-22] FF HKLM-x32\...\Firefox\Extensions: - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2014-12-22] FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2014-12-22] FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2014-12-22] FF HKLM-x32\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt FF HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-12-22] Chrome: ======= CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] () S2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.) R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO) S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation) S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1149760 2014-11-17] (NVIDIA Corporation) S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887232 2014-01-31] (Intel(R) Corporation) R2 ISCTAgent; C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [209712 2014-02-21] () R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [154584 2014-02-19] (Intel Corporation) R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation) S2 MSI_SuperCharger; C:\Program Files (x86)\MSI\Super Charger\ChargeService.exe [162800 2014-03-17] (MSI) S2 MSI_Trigger_Service; C:\Program Files (x86)\MSI\MSITrigger\MSI_Trigger_Service.exe [30240 2013-09-26] (MICRO-STAR INTERNATIONAL CO., LTD.) S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1796928 2014-11-17] (NVIDIA Corporation) S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19821376 2014-11-17] (NVIDIA Corporation) S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation) S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R0 file_tracker; C:\Windows\System32\DRIVERS\file_tracker.sys [296736 2015-01-03] (Acronis International GmbH) R3 ikbevent; C:\Windows\system32\DRIVERS\ikbevent.sys [22216 2014-02-03] () R3 imsevent; C:\Windows\system32\DRIVERS\imsevent.sys [22728 2014-02-03] () R3 INETMON; C:\Windows\System32\Drivers\INETMON.sys [23936 2014-02-03] () R3 ISCT; C:\Windows\System32\drivers\ISCTD.sys [44744 2014-02-03] () R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO) S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab) R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2014-12-22] (Kaspersky Lab ZAO) R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO) R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2014-12-22] (Kaspersky Lab ZAO) R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO) R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO) R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO) R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO) R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO) R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-07-20] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation) R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [116736 2014-02-19] (Intel Corporation) R3 NTIOLib_1_0_3; C:\Program Files (x86)\MSI\Super Charger\NTIOLib_X64.sys [13368 2012-10-25] (MSI) R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [38216 2014-10-03] (NVIDIA Corporation) R0 tib; C:\Windows\System32\DRIVERS\tib.sys [1328928 2015-01-03] (Acronis International GmbH) R0 tib_mounter; C:\Windows\System32\DRIVERS\tib_mounter.sys [234784 2014-12-20] (Acronis International GmbH) S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation) S3 MSICDSetup; \??\F:\CDriver64.sys [X] S3 NTIOLib_1_0_C; \??\F:\NTIOLib_X64.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-20 07:48 - 2015-07-20 07:48 - 00020266 _____ C:\Users\Gunther\Desktop\FRST.txt 2015-07-20 07:48 - 2015-07-20 07:48 - 00000000 ____D C:\FRST 2015-07-20 07:36 - 2015-07-20 07:44 - 02134528 _____ (Farbar) C:\Users\Gunther\Desktop\FRST64.exe 2015-07-20 07:33 - 2015-07-20 07:33 - 00000476 _____ C:\Users\Gunther\Desktop\defogger_disable.log 2015-07-20 07:33 - 2015-07-20 07:33 - 00000000 _____ C:\Users\Gunther\defogger_reenable 2015-07-20 06:56 - 2015-07-20 06:56 - 00050477 _____ C:\Users\Gunther\Desktop\Defogger.exe 2015-07-19 19:05 - 2015-07-20 05:18 - 00118195 _____ C:\Windows\WindowsUpdate.log 2015-07-19 19:05 - 2015-07-19 19:05 - 00000842 _____ C:\Windows\setupact.log 2015-07-19 19:05 - 2015-07-19 19:05 - 00000000 _____ C:\Windows\setuperr.log 2015-07-15 19:03 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-07-15 19:03 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-07-15 19:03 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-07-15 19:03 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-07-15 19:03 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-07-15 19:03 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-07-15 19:03 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-07-15 19:03 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-07-15 18:52 - 2015-06-16 00:39 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-07-15 18:52 - 2015-06-16 00:38 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-07-15 18:52 - 2015-06-16 00:26 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-07-15 18:52 - 2015-06-16 00:24 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2015-07-15 18:52 - 2015-06-16 00:02 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2015-07-15 18:52 - 2015-06-15 23:58 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-07-15 18:52 - 2015-06-15 23:57 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-07-15 18:52 - 2015-06-15 23:56 - 00145408 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2015-07-15 18:52 - 2015-06-15 23:55 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-07-15 18:52 - 2015-06-15 23:49 - 01032704 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll 2015-07-15 18:52 - 2015-06-15 23:41 - 00262144 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2015-07-15 18:52 - 2015-06-15 23:38 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-07-15 18:52 - 2015-06-15 23:36 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-07-15 18:52 - 2015-06-15 23:17 - 02880000 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll 2015-07-15 18:52 - 2015-06-15 23:16 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-07-15 18:52 - 2015-06-15 23:15 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-07-15 18:52 - 2015-06-15 23:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-07-15 18:52 - 2015-06-15 23:04 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-07-15 18:52 - 2015-06-15 23:03 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2015-07-15 18:52 - 2015-06-15 22:52 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-07-15 18:52 - 2015-06-15 22:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2015-07-15 18:52 - 2015-06-15 22:44 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-07-15 18:52 - 2015-06-15 22:43 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-07-15 18:52 - 2015-06-15 22:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2015-07-15 18:52 - 2015-06-15 22:41 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-07-15 18:52 - 2015-06-15 22:37 - 00880128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll 2015-07-15 18:52 - 2015-06-15 22:32 - 00230400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2015-07-15 18:52 - 2015-06-15 22:31 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-07-15 18:52 - 2015-06-15 22:30 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-07-15 18:52 - 2015-06-15 22:30 - 00327168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-07-15 18:52 - 2015-06-15 22:17 - 01048576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll 2015-07-15 18:52 - 2015-06-15 22:07 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-07-15 18:52 - 2015-06-15 22:02 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-07-15 18:44 - 2015-07-02 00:08 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-07-15 18:44 - 2015-07-01 23:14 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-07-15 18:28 - 2015-07-03 15:52 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-07-15 18:28 - 2015-07-03 15:52 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-07-15 18:28 - 2015-07-03 15:50 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2015-07-15 18:28 - 2015-07-03 15:50 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2015-07-15 18:28 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-07-15 18:28 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-07-15 18:28 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2015-07-15 18:28 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-07-15 18:28 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2015-07-15 18:28 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys 2015-07-15 18:28 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys 2015-07-15 18:28 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys 2015-07-15 18:28 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll 2015-07-15 18:28 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-07-15 18:28 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-07-15 18:28 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll 2015-07-15 18:28 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-07-15 18:28 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-07-15 18:28 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe 2015-07-15 18:28 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll 2015-07-15 18:28 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe 2015-07-15 18:28 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll 2015-07-15 18:28 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2015-07-15 18:28 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2015-07-15 18:28 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll 2015-07-15 18:28 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll 2015-07-15 18:28 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2015-07-15 18:28 - 2015-01-30 03:29 - 00035840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\atlthunk.dll 2015-07-15 18:08 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2015-07-15 18:08 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2015-07-15 18:07 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll 2015-07-15 18:07 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll 2015-07-15 18:05 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll 2015-07-15 18:05 - 2015-03-11 03:49 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe 2015-07-15 18:05 - 2015-03-11 03:09 - 00021504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe 2015-07-13 08:41 - 2015-07-13 08:41 - 00000000 ____D C:\Program Files (x86)\MSECache 2015-06-22 11:21 - 2015-06-28 23:22 - 00000000 ____D C:\Users\Gunther\Desktop\dagmar neu 2015-06-22 10:41 - 2015-06-22 14:37 - 00000000 ____D C:\Users\Gunther\Desktop\ebay ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2015-07-20 07:41 - 2015-05-03 10:35 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-07-20 07:33 - 2014-12-20 18:46 - 00000000 ____D C:\Users\Gunther 2015-07-20 07:32 - 2014-12-27 16:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-07-20 07:26 - 2014-12-22 17:39 - 00000000 ____D C:\ProgramData\Kaspersky Lab 2015-07-20 07:22 - 2014-12-20 20:55 - 00000000 ____D C:\Users\Gunther\AppData\Local\Adobe 2015-07-20 07:19 - 2014-12-27 16:12 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-07-20 06:35 - 2014-12-20 18:51 - 00003600 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3601908654-2614856020-1968441776-1001 2015-07-20 06:19 - 2015-05-03 10:35 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 2015-07-20 06:19 - 2015-01-21 09:47 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 2015-07-20 03:21 - 2014-12-20 18:49 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F5319551-2BF6-4B80-A504-C4DA1805D0B8} 2015-07-20 00:04 - 2014-12-20 18:40 - 00000000 ____D C:\ProgramData\NVIDIA 2015-07-20 00:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru 2015-07-19 16:24 - 2015-01-04 08:55 - 00000000 ____D C:\Users\Gunther\OneDrive 2015-07-19 16:20 - 2014-12-20 20:39 - 00074777 _____ C:\Windows\SysWOW64\Gms.log 2015-07-19 13:02 - 2015-02-16 09:41 - 00000000 ____D C:\Users\Gunther\.rainlendar2 2015-07-18 09:29 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\tracing 2015-07-17 07:16 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp 2015-07-16 12:30 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\rescache 2015-07-16 08:51 - 2014-12-20 20:56 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2015-07-16 00:17 - 2013-09-16 16:11 - 01776918 _____ C:\Windows\system32\PerfStringBackup.INI 2015-07-16 00:17 - 2013-08-23 01:24 - 00764340 _____ C:\Windows\system32\perfh007.dat 2015-07-16 00:17 - 2013-08-23 01:24 - 00159160 _____ C:\Windows\system32\perfc007.dat 2015-07-16 00:10 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2015-07-16 00:10 - 2013-08-22 16:44 - 00598952 _____ C:\Windows\system32\FNTCACHE.DAT 2015-07-16 00:10 - 2013-08-22 15:25 - 00524288 ___SH C:\Windows\system32\config\BBI 2015-07-16 00:08 - 2014-12-27 15:52 - 00000000 ____D C:\Program Files (x86)\CDBurnerXP 2015-07-16 00:08 - 2014-12-20 20:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2015-07-15 21:28 - 2014-12-20 20:21 - 00000000 ____D C:\ProgramData\Microsoft Help 2015-07-15 21:27 - 2014-12-20 19:52 - 00000000 ____D C:\Windows\system32\MRT 2015-07-15 17:20 - 2015-01-01 20:50 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task 2015-07-15 12:41 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\AppReadiness 2015-07-13 23:10 - 2013-08-22 17:38 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-07-13 23:10 - 2013-08-22 17:38 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-07-12 17:17 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\NDF 2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieUserList 2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieSiteList 2015-07-10 11:10 - 2014-12-20 19:42 - 00000000 __SHD C:\Users\Gunther\AppData\Local\EmieBrowserModeList 2015-07-08 17:33 - 2015-01-26 19:44 - 00001131 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk 2015-07-08 17:33 - 2015-01-26 19:44 - 00001081 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk 2015-07-06 09:39 - 2015-06-03 09:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2015-07-03 13:26 - 2014-12-29 09:08 - 00004096 _____ C:\Users\Public\Documents\000016E5.LCS 2015-07-03 08:43 - 2014-12-20 19:52 - 130333168 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe ==================== Files in the root of some directories ======= 2015-01-23 09:02 - 2015-01-23 09:02 - 0000604 ____H () C:\Program Files (x86)\_43_S 2014-12-22 16:18 - 2010-01-26 12:11 - 0444283 _____ () C:\Program Files\Common Files\WinPcapNmap.exe 2015-01-07 10:08 - 2015-02-22 20:49 - 0235520 _____ () C:\Users\Gunther\AppData\Roaming\AllSimiliarSigns.rsd 2015-01-19 10:38 - 2015-01-19 10:38 - 0001564 _____ () C:\Users\Gunther\AppData\Local\recently-used.xbel 2014-12-23 19:07 - 2014-12-23 19:07 - 0000017 _____ () C:\Users\Gunther\AppData\Local\resmon.resmoncfg 2014-12-20 20:33 - 2014-12-20 20:33 - 0000000 ____H () C:\ProgramData\DP45977C.lfl ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-07-20 05:11 ==================== End of log ============================ [CODE]Additional FRST Logfile: Code:
ATTFilter scan result of Farbar Recovery Scan Tool (x64) Version:18-07-2015 01
Ran by Gunther at 2015-07-20 07:48:28
Running from C:\Users\Gunther\Desktop
Boot Mode: Normal
==========================================================
==================== Accounts: =============================
Administrator (S-1-5-21-3601908654-2614856020-1968441776-500 - Administrator - Disabled)
Gast (S-1-5-21-3601908654-2614856020-1968441776-501 - Limited - Disabled)
Gunther (S-1-5-21-3601908654-2614856020-1968441776-1001 - Administrator - Enabled) => C:\Users\Gunther
Kinder (S-1-5-21-3601908654-2614856020-1968441776-1002 - Limited - Enabled) => C:\Users\Kinder
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acronis True Image 2015 (HKLM-x32\...\{08DC7D7A-1CA0-4E96-B12F-9B9577FCF0F8}Visible) (Version: 18.0.6525 - Acronis)
Acronis True Image 2015 (x32 Version: 18.0.6525 - Acronis) Hidden
Adobe Digital Editions 2.0 (HKLM-x32\...\Adobe Digital Editions 2.0) (Version: 2.0.1 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
AllSimiliarSigns Version 1.5.2 (HKLM-x32\...\{C08B26CF-7FC6-4D7A-858A-C1BA3B6E6491}_is1) (Version: 1.5.2 - AllSimiliarSigns)
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Avid License Control (HKLM-x32\...\{F187D064-F101-4E95-8D05-4027809AA0F8}) (Version: 3.0.1 - Avid Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Canon CanoScan LiDE 220 On-screen Manual (HKLM-x32\...\Canon CanoScan LiDE 220 On-screen Manual) (Version: 7.7.1 - Canon Inc.)
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version: 1.1.11.1 - Canon Inc.)
Canon Quick Menu (HKLM-x32\...\CanonQuickMenu) (Version: 2.4.0 - Canon Inc.)
CanoScan LiDE 220 Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ4811) (Version: 1.00 - Canon Inc.)
capella reader (HKLM-x32\...\{660A1E62-8B31-4CC4-A36A-7EBDD099831E}) (Version: 7.1.25 - capella software AG)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.5.5666 - CDBurnerXP)
CDex - Open Source Digital Audio CD Extractor (HKLM-x32\...\CDex) (Version: 1.75.0.2014 - Georgy Berdyshev)
CD-LabelPrint (HKLM-x32\...\MediaNavigation.CDLabelPrint) (Version: - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Free M4a to MP3 Converter 8.3 (HKLM-x32\...\Free M4a to MP3 Converter_is1) (Version: - ManiacTools.com)
Free YouTube to MP3 Converter version 3.12.52.1215 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.52.1215 - DVDVideoSoft Ltd.)
G DATA Logox4 Speechengine (HKLM-x32\...\lgx4.lgx.server) (Version: - G DATA Software AG)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.0.1168 - Intel Corporation)
Intel(R) Smart Connect Technology (HKLM\...\{9A37ADB3-3D8D-4EDF-8F6D-B8A66F18087B}) (Version: 5.0.10.2793 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.13 - Intel(R) Corporation) Hidden
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
Lernwerkstatt 8 (HKLM-x32\...\InstallShield_{08BE0A17-0AB8-4B0C-88E2-EB1B4977A511}) (Version: 8.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH)
Lernwerkstatt 8 (x32 Version: 8.00.0000 - Medienwerkstatt Mühlacker Verlagsgesellschaft mbH) Hidden
MAGIX Video deluxe 2015 (HKLM\...\MX.{FFDC29E6-5C7C-4AA8-AF5A-99E015165382}) (Version: 14.0.0.159 - MAGIX Software GmbH)
MAGIX Video deluxe 2015 (Version: 14.0.0.159 - MAGIX Software GmbH) Hidden
MAGIX Video deluxe 2015 Update (Version: 14.0.0.162 - MAGIX AG) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM-x32\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 x64 ENU (HKLM\...\{D4AD39AD-091E-4D33-BB2B-59F6FCB8ADC3}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{90ffcee5-8608-4e94-8c18-a4feb4f83fb8}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Works 6-9 Converter (HKLM-x32\...\{95140000-0137-0407-0000-0000000FF1CE}) (Version: 14.0.6120.5002 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version: - Pavel Cvrcek)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.3.0 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
MSI Super Charger (HKLM-x32\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.025 - MSI)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
NVIDIA 3D Vision Controller-Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 344.75 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 344.75 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.4.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.4.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 344.75 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA Miracast Virtueller Ton 344.75 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Miracast.VirtualAudio) (Version: 344.75 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.0.1 - pdfforge)
Rainlendar2 (remove only) (HKLM-x32\...\Rainlendar2) (Version: - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.23.1126.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7188 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
SHIELD Streaming (Version: 3.1.2000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.13.69 - NVIDIA Corporation) Hidden
Sibelius 7 OpenType Fonts (HKLM-x32\...\{623C2BD8-1B28-4F98-B578-E9D139827269}) (Version: 7.1.3 - Avid)
Sibelius 7.5 (HKLM\...\{BBADBAB3-56A4-444B-834E-D8730B574C3E}) (Version: 7.5.0.157 - Avid Technology)
SteuerBerater 2014-2015 (HKLM-x32\...\{415227BD-34D9-4DB3-B74C-554407208203}) (Version: 14.11.2 - Akademische Arbeitsgemeinschaft)
SteuerSparErklärung Plus 2015 (HKLM-x32\...\{312C0E08-8F94-4536-AAF6-3413F784AC5F}) (Version: 20.34.161 - Akademische Arbeitsgemeinschaft)
The Inner World 1.0 (HKLM\...\{E8C6E886-0605-416D-BCC1-33B84E08F7EA}) (Version: 1.0 - Headup Games)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VDownloader 4.0.959 (HKLM\...\{A7E19604-93AF-4611-8C9F-CE509C2B286E}_is1) (Version: - Vitzo Limited)
VGA Boost (HKLM-x32\...\{809ACFAE-9A4D-4C60-9223-D8B615CD8CBA}}_is1) (Version: 1.0.0.7 - MSI)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
==================== Custom CLSID (Whitelisted): ==========================
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
CustomCLSID: HKU\S-1-5-21-3601908654-2614856020-1968441776-1001_Classes\CLSID\{0B7AD8D3-094A-44DE-A348-83C6C3FA347C}\InprocServer32 -> C:\Users\Gunther\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Clipboarder.gadget\Release\Clipboarder64.dll (Helmut Buhler)
CustomCLSID: HKU\S-1-5-21-3601908654-2614856020-1968441776-1001_Classes\CLSID\{0E7BE950-4ACC-47CB-834B-41A8B96BBFF9}\InprocServer32 -> C:\Users\Gunther\AppData\Local\Microsoft\Windows Sidebar\Gadgets\Sidebar7.gadget\Release\Sidebar7.64.dll (Helmut Buhler)
CustomCLSID: HKU\S-1-5-21-3601908654-2614856020-1968441776-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)
==================== Restore Points =========================
24-06-2015 14:37:04 Windows Update
06-07-2015 07:38:57 Geplanter Prüfpunkt
09-07-2015 08:46:47 Windows Update
15-07-2015 21:26:04 Windows Update
==================== Hosts content: ===============================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (Whitelisted) =============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
Task: {0B3E03D0-938A-4C4C-B1E6-F5642A3678F0} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {1510DFDB-61DF-4526-8D16-75B4D5193104} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {57C6D167-A9B3-4C87-8CD3-E1E7DD25EBCF} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {8E413AFB-B1D6-45B9-A994-1638992CB378} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3601908654-2614856020-1968441776-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {E6C46F73-25FA-4596-8555-7ED962051810} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {EC4DEF59-39A4-469F-8F3C-D2F05ABAF8EB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-20] (Adobe Systems Incorporated)
(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Loaded Modules (Whitelisted) ==============
2014-02-21 10:47 - 2014-02-21 10:47 - 00209712 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
2014-02-21 10:47 - 2014-02-21 10:47 - 00057648 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\NetworkHeuristic.dll
2014-02-21 10:47 - 2014-02-21 10:47 - 00057648 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTEncryptionCheck.dll
2014-02-21 10:47 - 2014-02-21 10:47 - 00037168 _____ () C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\ISCTNetMon.dll
2012-07-09 10:23 - 2012-07-09 10:23 - 02700672 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\prl_report.exe
2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-21 04:06 - 2015-01-21 04:06 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-20 18:40 - 2014-11-12 23:56 - 00118080 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-02-19 19:51 - 2014-02-19 19:51 - 01241560 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-03-06 16:00 - 2014-03-06 16:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-11-27 11:42 - 2014-11-27 11:42 - 00037696 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\qt_icontray_ex.dll
2014-11-27 11:42 - 2014-11-27 11:42 - 00034624 _____ () C:\Program Files (x86)\Common Files\Acronis\Home\thread_pool.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
2014-04-20 02:42 - 2014-12-22 17:40 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-09-09 11:00 - 2014-09-09 11:00 - 00023576 _____ () C:\Program Files (x86)\Acronis\TrueImageHome\ti_managers_proxy_stub.dll
==================== Alternate Data Streams (Whitelisted) =========
(If an entry is included in the fixlist, only the ADS will be removed.)
AlternateDataStreams: C:\Users\Gunther\OneDrive:ms-properties
==================== Safe Mode (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (Whitelisted) ===============
(If an entry is included in the fixlist, the registry item will be restored to default or removed.)
==================== Internet Explorer trusted/restricted ===============
(If an entry is included in the fixlist, it will be removed from the registry.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Gunther\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\img_0939.jpg
DNS Servers: 195.50.140.182 - 195.50.140.114
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
HKLM\...\StartupApproved\Run: => "Acronis Scheduler2 Service"
HKLM\...\StartupApproved\Run: => "ISCT Tray"
HKLM\...\StartupApproved\Run: => "Logitech Download Assistant"
HKLM\...\StartupApproved\Run: => "ShadowPlay"
HKLM\...\StartupApproved\Run: => "NvBackend"
HKLM\...\StartupApproved\Run: => "VDownloader"
HKLM\...\StartupApproved\Run: => "iTunesHelper"
HKLM\...\StartupApproved\Run32: => "AcronisTibMounterMonitor"
HKLM\...\StartupApproved\Run32: => "TrueImageMonitor.exe"
HKLM\...\StartupApproved\Run32: => "CanonQuickMenu"
HKLM\...\StartupApproved\Run32: => "Super Charger"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\StartupFolder: => "Sidebar660.lnk"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "CCleaner Monitoring"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "SkyDrive"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "VDownloader"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "Monotype SkyFonts Clean Up"
HKU\S-1-5-21-3601908654-2614856020-1968441776-1001\...\StartupApproved\Run: => "Rainlendar2"
==================== FirewallRules (Whitelisted) ===============
(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)
FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{CFD465DB-7F04-4F78-95FB-A9B29866DD3C}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{B0AA1134-D870-4BA4-A28C-62BFA3C64DA2}] => (Allow) LPort=2869
FirewallRules: [{CE0D6CA9-640A-4159-8EF4-6750B1163A7D}] => (Allow) LPort=1900
FirewallRules: [{104C89DE-27BB-4517-BA83-662B1F52FB3F}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{DEC50003-F7CC-40BE-A7E2-327F9BE959D7}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{ED3AC2A9-EC26-42E6-9986-2EB92066E9BE}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{0B27EEBA-B2BB-4396-92AE-5CA857761E61}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{7A2E2C6A-840E-4159-9A9E-0F8DB1F772A0}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{5956D6E9-DE01-4D19-A1D9-B7F4744B37B4}] => (Allow) C:\Program Files (x86)\Common Files\Acronis\SyncAgent\syncagentsrv.exe
FirewallRules: [{D816479E-63A6-43A0-8EFA-265BA1BC3B12}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{9E891A22-0218-4316-BC9C-643FF06BD1FD}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{E227CD03-E21A-4BB5-999C-C89A424B87AF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{7BAB5499-C409-4804-8A73-211BED315671}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{8694782E-E50C-4BDB-B7E9-149DCC06E386}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{30FC0C01-35A8-47AB-B8EF-6B59E4F77ABB}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{EC8E8DBB-D45C-47F8-8CBA-ACE99FB18DBA}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{038C5AF0-7350-4112-84B9-DD42766D1844}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{3054D7A2-AD10-4661-91CE-C433C6408E3D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{525083E5-4874-4596-9F60-6678269ABF6B}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{BE5D6CD9-3274-410F-BE0B-E9E8EC017114}] => (Allow) C:\Users\Gunther\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{D6DF458D-EC88-4260-8300-C5B55565FF60}] => (Allow) C:\Program Files\MAGIX\Video deluxe 2015\Videodeluxe.exe
FirewallRules: [{DB54A79F-855A-4A68-A2D5-0D7AA5B99CA5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{44F44605-9734-4CB4-824D-D79FCB3476B5}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{06A224B6-87DA-4DA4-B62C-DE909EDB3378}] => (Allow) C:\Program Files\iTunes\iTunes.exe
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (07/20/2015 12:04:07 AM) (Source: NvStreamSvc) (EventID: 1) (User: )
Description: NvStreamSvcCan continue stopping. [0]
Error: (07/19/2015 07:05:46 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2007) (User: NT-AUTORITÄT)
Description: There was an error communicating to the Orion inference server
Error: (07/19/2015 07:05:24 PM) (Source: Microsoft-Windows-LocationProvider) (EventID: 2006) (User: NT-AUTORITÄT)
Description: There was an error with the Windows Location Provider database
Error: (07/19/2015 06:05:44 PM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
Error: (07/18/2015 09:29:41 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_stisvc, Version: 6.3.9600.17415, Zeitstempel: 0x54504177
Name des fehlerhaften Moduls: CNQ_CIL.dll, Version: 1.0.0.1, Zeitstempel: 0x534e21ac
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000000000002b530
ID des fehlerhaften Prozesses: 0x8d0
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_stisvc0
Pfad der fehlerhaften Anwendung: svchost.exe_stisvc1
Pfad des fehlerhaften Moduls: svchost.exe_stisvc2
Berichtskennung: svchost.exe_stisvc3
Vollständiger Name des fehlerhaften Pakets: svchost.exe_stisvc4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: svchost.exe_stisvc5
Error: (07/17/2015 05:15:28 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0xc0c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
Error: (07/17/2015 05:15:26 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1830
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
Error: (07/17/2015 05:15:24 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0xcd4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
Error: (07/17/2015 07:16:51 AM) (Source: Microsoft-Windows-Defrag) (EventID: 257) (User: )
Description: Das Volume "Wiederherstellung" wurde aufgrund eines Fehlers nicht optimiert: Falscher Parameter. (0x80070057)
Error: (07/16/2015 02:36:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: wwahost.exe, Version: 6.3.9600.17415, Zeitstempel: 0x5450355f
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.3.9600.17736, Zeitstempel: 0x550f42c2
Ausnahmecode: 0xc0000008
Fehleroffset: 0x0003ca2c
ID des fehlerhaften Prozesses: 0x150c
Startzeit der fehlerhaften Anwendung: 0xwwahost.exe0
Pfad der fehlerhaften Anwendung: wwahost.exe1
Pfad des fehlerhaften Moduls: wwahost.exe2
Berichtskennung: wwahost.exe3
Vollständiger Name des fehlerhaften Pakets: wwahost.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: wwahost.exe5
System errors:
=============
Error: (07/20/2015 07:12:23 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat
Error: (07/20/2015 07:04:21 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (07/20/2015 07:01:10 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat
Error: (07/20/2015 06:56:18 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (07/20/2015 06:46:14 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat
Error: (07/20/2015 06:31:44 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat
Error: (07/20/2015 06:26:25 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (07/20/2015 06:24:58 AM) (Source: Microsoft-Windows-Kernel-General) (EventID: 5) (User: ARLT)
Description: 0x8000002a117\??\C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \S-1-5-21-3601908654-2614856020-1968441776-1001-0-ntuser.dat
Error: (07/20/2015 06:10:56 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Error: (07/20/2015 06:10:56 AM) (Source: DCOM) (EventID: 10016) (User: ARLT)
Description: AnwendungsspezifischLokalStart{7022A3B3-D004-4F52-AF11-E9E987FEE25F}{ADA41B3C-C6FD-4A08-8CC1-D6EFDE67BE7D}ARLTGuntherS-1-5-21-3601908654-2614856020-1968441776-1001LocalHost (unter Verwendung von LRPC)Nicht verfügbarNicht verfügbar
Microsoft Office:
=========================
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-4790K CPU @ 4.00GHz
Percentage of memory in use: 13%
Total physical RAM: 16335.72 MB
Available physical RAM: 14051.61 MB
Total Virtual: 18767.72 MB
Available Virtual: 16159.16 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:111.27 GB) (Free:49.09 GB) NTFS
Drive d: () (Fixed) (Total:1863.01 GB) (Free:1607.31 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 27C2FF93)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 111.8 GB) (Disk ID: 00000000)
Partition: GPT Partition Type.
==================== End of log ============================
Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net Rootkit scan 2015-07-20 07:58:22 Windows 6.2.9200 x64 \Device\Harddisk1\DR1 -> \Device\00000039 Samsung_SSD_840_EVO_120GB rev.EXT0BB0Q 111,79GB Running: Gmer-19357.exe; Driver: C:\Users\Gunther\AppData\Local\Temp\pxldrpow.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff9600023b600 15 bytes [00, 96, F2, 01, 00, 6A, 6C, ...] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 16 fffff9600023b610 11 bytes [00, D7, FB, FF, 00, 7B, D1, ...] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffe8dfa4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffe8dfa4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffe8dfa5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffe8dfa53ff 8 bytes {JMP 0xffffffffffffffee} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffe8dfa579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffe8dfa5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffe8dfa5ef1 8 bytes {JMP 0xffffffffffffff9e} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffe8dfa5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffe8dfa60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffe8dfa64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffe8dfa6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffe8dfa66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffe8dfa8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffe8dfa8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffe8dfa8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffe8dfa8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffe8dfa90ae 8 bytes {JMP 0xffffffffffffff96} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffe8dfa917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffe8dfa9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffe8dfa9fcd 8 bytes {JMP 0xffffffffffffffaf} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffe8dfaaae0 8 bytes {JMP 0xffffffffffffffcd} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffe8dfaab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffe8dfab2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffe8dfab33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffe8dfac4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffe8dfac5b0 8 bytes {JMP 0xffffffffffffffc7} .text ... * 2 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffe8dfad0d3 8 bytes {JMP 0xffffffffffffffef} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffe8dfad10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffe8dfad57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffe8dfad6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffe8dfad888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffe8dfad944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffe8dfadba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffe8dfadd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffe8dfae073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffe8dfae124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffe8dfae160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffe8dfaeb74 8 bytes {JMP 0xffffffffffffffd0} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffe8dfafe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffe8dfb009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffe8dfb015b 8 bytes [70, 6C, BD, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffe8dfb1438 8 bytes [40, 6C, BD, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffe8dfb15e6 8 bytes [30, 6C, BD, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffe8dfb1877 8 bytes [20, 6C, BD, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffe8dfb1a2d 8 bytes [10, 6C, BD, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffe8dfb1c35 8 bytes [00, 6C, BD, 7E, 00, 00, 00, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffe8e021290 8 bytes {JMP QWORD [RIP-0x6fe5e]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffe8e021410 8 bytes {JMP QWORD [RIP-0x6fe30]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffe8e021440 8 bytes {JMP QWORD [RIP-0x712eb]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffe8e021560 8 bytes {JMP QWORD [RIP-0x70c1e]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffe8e021610 8 bytes {JMP QWORD [RIP-0x71122]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffe8e021cd0 8 bytes {JMP QWORD [RIP-0x700a1]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffe8e021fd0 8 bytes {JMP QWORD [RIP-0x705a9]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffe8e022850 8 bytes {JMP QWORD [RIP-0x70fdf]} .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000775713f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077571583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077571621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077571674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000775716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000775716e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077571727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 7 .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000775725d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077572714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077572961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3860] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077572bd3 8 bytes [DC, 6A, BD, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffe8dfa4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffe8dfa4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffe8dfa5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffe8dfa53ff 8 bytes {JMP 0xffffffffffffffee} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffe8dfa579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffe8dfa5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffe8dfa5ef1 8 bytes {JMP 0xffffffffffffff9e} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffe8dfa5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffe8dfa60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffe8dfa64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffe8dfa6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffe8dfa66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffe8dfa8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffe8dfa8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffe8dfa8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffe8dfa8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffe8dfa90ae 8 bytes {JMP 0xffffffffffffff96} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffe8dfa917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffe8dfa9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffe8dfa9fcd 8 bytes {JMP 0xffffffffffffffaf} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffe8dfaaae0 8 bytes {JMP 0xffffffffffffffcd} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffe8dfaab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffe8dfab2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffe8dfab33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffe8dfac4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffe8dfac5b0 8 bytes {JMP 0xffffffffffffffc7} .text ... * 2 .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffe8dfad0d3 8 bytes {JMP 0xffffffffffffffef} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffe8dfad10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffe8dfad57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffe8dfad6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffe8dfad888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffe8dfad944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffe8dfadba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffe8dfadd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffe8dfae073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffe8dfae124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffe8dfae160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffe8dfaeb74 8 bytes {JMP 0xffffffffffffffd0} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffe8dfafe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffe8dfb009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffe8dfb015b 8 bytes {JO 0x6e; JMP 0x82} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffe8dfb1438 8 bytes {INS BYTE [RDI], DX; JMP 0x82} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffe8dfb15e6 8 bytes [30, 6C, EB, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffe8dfb1877 8 bytes [20, 6C, EB, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffe8dfb1a2d 8 bytes [10, 6C, EB, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffe8dfb1c35 8 bytes [00, 6C, EB, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffe8e021290 8 bytes {JMP QWORD [RIP-0x6fe5e]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffe8e021410 8 bytes {JMP QWORD [RIP-0x6fe30]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffe8e021440 8 bytes {JMP QWORD [RIP-0x712eb]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffe8e021560 8 bytes {JMP QWORD [RIP-0x70c1e]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffe8e021610 8 bytes {JMP QWORD [RIP-0x71122]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffe8e021cd0 8 bytes {JMP QWORD [RIP-0x700a1]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffe8e021fd0 8 bytes {JMP QWORD [RIP-0x705a9]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffe8e022850 8 bytes {JMP QWORD [RIP-0x70fdf]} .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000775713f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077571583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077571621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077571674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000775716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000775716e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077571727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 7 .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000775725d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077572714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077572961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077572bd3 8 bytes [DC, 6A, EB, 7E, 00, 00, 00, ...] .text C:\PROGRA~2\MICROS~3\Office12\OIS.EXE[4604] C:\PROGRA~2\MICROS~3\Office12\cdlmso.dll!?DoEvent@Cdl@@YG_NAAUtagMSG@@@Z + 28 0000000073f76588 4 bytes [EE, 2A, 24, 39] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffe8dfa4b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffe8dfa4f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffe8dfa5206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffe8dfa53ff 8 bytes {JMP 0xffffffffffffffee} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffe8dfa579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffe8dfa5954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffe8dfa5ef1 8 bytes {JMP 0xffffffffffffff9e} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffe8dfa5f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399 00007ffe8dfa60ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977 00007ffe8dfa64d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310 00007ffe8dfa6616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491 00007ffe8dfa66cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359 00007ffe8dfa8397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67 00007ffe8dfa8a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864 00007ffe8dfa8d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143 00007ffe8dfa8e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510 00007ffe8dfa90ae 8 bytes {JMP 0xffffffffffffff96} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715 00007ffe8dfa917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772 00007ffe8dfa9d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685 00007ffe8dfa9fcd 8 bytes {JMP 0xffffffffffffffaf} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352 00007ffe8dfaaae0 8 bytes {JMP 0xffffffffffffffcd} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488 00007ffe8dfaab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 3 .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565 00007ffe8dfab2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78 00007ffe8dfab33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311 00007ffe8dfac4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528 00007ffe8dfac5b0 8 bytes {JMP 0xffffffffffffffc7} .text ... * 2 .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579 00007ffe8dfad0d3 8 bytes {JMP 0xffffffffffffffef} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47 00007ffe8dfad10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495 00007ffe8dfad57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43 00007ffe8dfad6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456 00007ffe8dfad888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180 00007ffe8dfad944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596 00007ffe8dfadba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424 00007ffe8dfadd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771 00007ffe8dfae073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948 00007ffe8dfae124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48 00007ffe8dfae160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756 00007ffe8dfaeb74 8 bytes {JMP 0xffffffffffffffd0} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371 00007ffe8dfafe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556 00007ffe8dfb009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171 00007ffe8dfb015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744 00007ffe8dfb1438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214 00007ffe8dfb15e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567 00007ffe8dfb1877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429 00007ffe8dfb1a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213 00007ffe8dfb1c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffe8e021290 8 bytes {JMP QWORD [RIP-0x6fe5e]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffe8e021410 8 bytes {JMP QWORD [RIP-0x6fe30]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffe8e021440 8 bytes {JMP QWORD [RIP-0x712eb]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffe8e021560 8 bytes {JMP QWORD [RIP-0x70c1e]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffe8e021610 8 bytes {JMP QWORD [RIP-0x71122]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffe8e021cd0 8 bytes {JMP QWORD [RIP-0x700a1]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffe8e021fd0 8 bytes {JMP QWORD [RIP-0x705a9]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffe8e022850 8 bytes {JMP QWORD [RIP-0x70fdf]} .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 00000000775713f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077571583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077571621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077571674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 00000000775716d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 00000000775716e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077571727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text ... * 7 .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16 00000000775725d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308 0000000077572714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529 0000000077572961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...] .text C:\Users\Gunther\Desktop\Gmer-19357.exe[896] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595 0000000077572bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...] ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\csrss.exe [5284:1676] fffff9600082f2d0 ---- EOF - GMER 2.1 ---- Geändert von GunHill (20.07.2015 um 07:26 Uhr) |
| Themen zu Internet extrem langsam -viel zu viele Netzwerkverbindunge - ein Zeichen für Schadware |
| adware, browser, converter, cpu, ebanking, excel, fehlermeldung, firefox, firefox 39.0, flash player, homepage, internet, kaspersky, langsam, malware, mozilla, mp3, netstat, proxy, prozess, realtek, registry, rundll, scan, schadware, security, software, super, svchost.exe, tracker |
Baum-Darstellung