Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren

SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


Log-Analyse und Auswertung: SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML.

Antwort
Alt 10.08.2015, 21:18   #1
DerDocker
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


hallo zusammen,

ich habe gestern voller panik spyhunter 4 installiert und jetzt lässt es sich nicht mehr deinstallieren.
mit der systemsteuerung habe ich es versucht und mit tune up utillities versucht,aber die installation wird immer abgebrochen.
vor lauter verzweiflung habe ich dann zusätzlich *malewarebytes anti-maleware und pc scan & repair by reimage*installiert.aber auch dieser versuch schlug fehl.

was computer angeht,bin ich nicht grad wissend,deswegen bin ich für jede info und hilfe sehr dankbar.

ich hoffe,ihr könnt mir helfen,dieses programm wieder loszuwerden.

viele grüße mike

Alt 10.08.2015, 21:40   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!



Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________
Alt 10.08.2015, 22:01   #3
DerDocker
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

das zeigt er mir an....


FRST Additions Logfile:
Code:
ATTFilter
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:09-08-2015
durchgeführt von Mike (2015-08-10 22:48:21)
Gestartet von C:\Users\Mike\Downloads
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1580386797-2802970296-1791143644-500 - Administrator - Disabled)
Gast (S-1-5-21-1580386797-2802970296-1791143644-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1580386797-2802970296-1791143644-1003 - Limited - Enabled)
Mike (S-1-5-21-1580386797-2802970296-1791143644-1001 - Administrator - Enabled) => C:\Users\Mike

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Disabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Internet Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Avira Antivirus (Disabled - Out of date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

abDocs (HKLM-x32\...\{CA4FE8B0-298C-4E5D-A486-F33B126D6A0A}) (Version: 1.05.2005 - Acer Incorporated)
abDocs Office AddIn (HKLM-x32\...\{DCBF3379-246B-47E1-8173-639B63940838}) (Version: 3.01.2006 - Acer Incorporated)
abFiles (HKLM-x32\...\{13885028-098C-4799-9B71-27DAC96502D5}) (Version: 2.00.3009 - Acer Incorporated)
abMedia (HKLM-x32\...\{E9AF1707-3F3A-49E2-8345-4F2D629D0876}) (Version: 2.06.2003.0 - Acer Incorporated)
abPhoto (HKLM-x32\...\{B5AD89F2-03D3-4206-8487-018298007DD0}) (Version: 3.01.2005.1 - Acer Incorporated)
Acer Care Center (HKLM\...\{A424844F-CDB3-45E2-BB77-1DDE4A091E76}) (Version: 1.00.3008 - Acer Incorporated)
Acer Explorer Agent (HKLM\...\{4D0F42CF-1693-43D9-BDC8-19141D023EE0}) (Version: 2.00.3000 - Acer Incorporated)
Acer Launch Manager (HKLM\...\{C18D55BD-1EC6-466D-B763-8EEDDDA9100E}) (Version: 8.00.8115 - Acer Incorporated)
Acer Portal (HKLM-x32\...\{A5AD0B17-F34D-49BE-A157-C8B3D52ACD13}) (Version: 3.04.2002 - Acer Incorporated)
Acer Power Management (HKLM\...\{91F52DE4-B789-42B0-9311-A349F10E5479}) (Version: 7.00.8106.0 - Acer Incorporated)
Acer Quick Access (HKLM\...\{C1FA525F-D701-4B31-9D32-504FC0CF0B98}) (Version: 1.01.3018 - Acer Incorporated)
Acer Recovery Management (HKLM\...\{07F2005A-8CAC-4A4B-83A2-DA98A722CA61}) (Version: 6.00.8108 - Acer Incorporated)
Acer User Experience Improvement Program App Monitor Plugin (HKLM\...\{978724F6-1863-4DD5-9E66-FB77F5AB5613}) (Version: 1.02.3005 - Acer Incorporated)
Acer User Experience Improvement Program Framework (HKLM\...\{12A718F2-2357-4D41-9E1F-18583A4745F7}) (Version: 1.02.3005 - Acer Incorporated)
Acer Video Player (HKLM-x32\...\{B6846F20-4821-11E3-8F96-0800200C9A66}) (Version: 1.00.2011.1 - Acer Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Flash Player 18 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
AnySend (HKLM-x32\...\ASPackage) (Version:  - CMI Limited) <==== ACHTUNG
AOP Framework (HKLM-x32\...\{4A37A114-702F-4055-A4B6-16571D4A5353}) (Version: 3.04.2001.2 - Acer Incorporated)
Avira (HKLM-x32\...\{a5e00a72-db4a-4f77-8874-d1265b8fcd7e}) (Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.12.408 - Avira Operations GmbH & Co. KG)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
CPU Miner (HKLM\...\cpuminer) (Version: 1.1 - Open Source)
CyberLink PhotoDirector 3 (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.1.5524 - CyberLink Corp.)
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.0.4220 - CyberLink Corp.)
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.4609.02 - CyberLink Corp.)
Druckerdeinstallation für EPSON XP-302 303 305 306 Series (HKLM\...\EPSON XP-302 303 305 306 Series) (Version:  - SEIKO EPSON Corporation)
eBay Worldwide (HKLM-x32\...\{91589413-6675-4C27-8AFC-EFB9103B90A5}) (Version: 2.4.0105 - OEM)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
Farm to Fork Collector's Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Foxit PhantomPDF (HKLM-x32\...\{D4DF5498-C95C-4A02-9951-725FB2D7BC0D}) (Version: 6.0.121.624 - Foxit Corporation)
FreeRIP MP3 Converter 4.5.3 (HKLM-x32\...\{501451DE-5808-4599-B544-8BD0915B6B24}_is1) (Version: 4.5.3 - GreenTree Applications SRL)
Game Explorer Categories - genres (HKLM-x32\...\WildTangentGameProvider-acer-genres) (Version: 11.0.0.7 - WildTangent, Inc.)
Game Explorer Categories - main (HKLM-x32\...\WildTangentGameProvider-acer-main) (Version: 11.0.0.7 - WildTangent, Inc.)
Genesys USB Mass Storage Device (HKLM-x32\...\{959B7F35-2819-40C5-A0CD-3C53B5FCC935}) (Version: 4.3.2.2.1001 - Genesys Logic)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 3.0.2.59 - WildTangent) Hidden
Host App Service (HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\Pokki) (Version: 0.269.7.564 - Pokki)
Intel(R) Management Engine Components (HKLM\...\{1CEAC85D-2590-4760-800F-8DE5E91F3700}) (Version: 10.0.30.1072 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3939 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 13.2.0.1016 - Intel Corporation)
Intel(R) Serial IO (HKLM\...\{9FD91C5C-44AE-4D9D-85BE-AE52816B0294}) (Version: 1.1.226.0 - Intel Corporation)
Intel(R) Technology Access (HKLM-x32\...\{efc54997-dfa9-44b1-afac-3a7ac4f45730}) (Version: 1.3.6.1042 - Intel Corporation)
Intel(R) Update Manager (HKLM-x32\...\{43FA4AC8-46F8-423F-96FD-9A7D67048F1C}) (Version: 2.5.1634 - Intel Corporation)
Intel(R) Wireless Bluetooth(R)(patch version 17.1.1431.1) (HKLM\...\{302600C1-6BDF-4FD1-1407-148929CC1385}) (Version: 17.1.1407.0480 - Intel Corporation)
Intel® Chipsatz-Gerätesoftware (x32 Version: 10.0.22 - Intel(R) Corporation) Hidden
Intel® PROSet/Wireless Software (HKLM-x32\...\{7991b5ae-96d7-4df2-97fb-a605b7cb638b}) (Version: 17.12.0 - Intel Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Jewel Match 3 (x32 Version: 3.0.2.59 - WildTangent) Hidden
Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{653C1B5A-3287-47B1-8613-0745D4E771C4}) (Version: 15.0.0.463 - Kaspersky Lab)
Kaspersky Internet Security (x32 Version: 15.0.0.463 - Kaspersky Lab) Hidden
King Oddball (x32 Version: 3.0.2.48 - WildTangent) Hidden
LUXOR Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM-x32\...\McAfee Security Scan) (Version: 3.0.285.6 - McAfee, Inc.)
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d491dd9d-2eda-4d75-b504-1a201436e7fd}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Mozilla Firefox 39.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0.3 (x86 de)) (Version: 39.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 39.0 - Mozilla)
MyFreeCodec (HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\MyFreeCodec) (Version:  - )
NVIDIA Grafiktreiber 333.57 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 333.57 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Picexa (HKLM-x32\...\Picexa) (Version:  - Taiwan Shui Mu Chih Ching Technology Limited)
Plants vs. Zombies - Game of the Year (x32 Version: 3.0.2.59 - WildTangent) Hidden
Pokki Start Menu (HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\Pokki_Start_Menu) (Version: 0.269.7.564 - Pokki)
Polar Bowler 1st Frame (x32 Version: 3.0.2.59 - WildTangent) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.34.617.2014 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7344 - Realtek Semiconductor Corp.)
Reimage Repair (HKLM\...\Reimage Repair) (Version: 1.8.2.0 - Reimage) <==== ACHTUNG
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.15013.18 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.15013.18 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Setup (HKLM-x32\...\{7ADF667E-E14D-4D2C-827C-B0108F0D93BC}) (Version:  - )
Spotify (HKLM-x32\...\Spotify) (Version: 0.9.6.81.gd359a796 - Spotify AB)
SpyHunter 4 (HKLM-x32\...\SpyHunter) (Version: 4.20.9.4533 - Enigma Software Group, LLC)
The Chronicles of Emerland Solitaire (x32 Version: 3.0.2.51 - WildTangent) Hidden
Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden
TuneUp Utilities 2014 (de-DE) (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM-x32\...\TuneUp Utilities) (Version: 14.0.1000.354 - TuneUp Software)
TuneUp Utilities 2014 (x32 Version: 14.0.1000.354 - TuneUp Software) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (x32 Version: 4.0.11.13 - WildTangent) Hidden
WinZipper (HKLM-x32\...\WinZipper) (Version: 1.5.105 - Taiwan Shui Mu Chih Ching Technology Limited.) <==== ACHTUNG
Zuma's Revenge (x32 Version: 2.2.0.97 - WildTangent) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Wiederherstellungspunkte =========================

20-07-2015 09:35:35 Geplanter Prüfpunkt
08-08-2015 10:09:45 Geplanter Prüfpunkt
10-08-2015 18:28:51 Wiederherstellungsvorgang

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2013-08-22 15:25 - 2013-08-22 15:25 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {0DAAAB9A-97A2-440F-9138-B00AC9C3F216} - System32\Tasks\JVGUMHUFL => C:\ProgramData\4a17ae48464444a9a35f3c050c0e05b3\4a17ae48464444a9a35f3c050c0e05b3.exe <==== ACHTUNG
Task: {224BDA18-44AD-4F3D-916A-FBEF123D358D} - System32\Tasks\Abelssoft\Updater scan => C:\Program Files (x86)\CHIP Updater\CHIPUpdater.exe
Task: {26D731B1-3F8A-4E9B-9278-58AAA0239373} - System32\Tasks\ACC => C:\Program Files (x86)\Acer\Care Center\LiveUpdateChecker.exe [2014-08-29] ()
Task: {287AA044-F02F-4DD8-8A21-0D56BFA77406} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files (x86)\TuneUp Utilities 2014\OneClick.exe [2015-06-25] (TuneUp Software)
Task: {28FAE812-6381-4D53-AAE5-FFBBF5A325EB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-08] (Adobe Systems Incorporated)
Task: {3EEF1CCB-616B-4BE4-A8AF-AC9866244621} - System32\Tasks\ReimageUpdater => C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [2015-05-19] (Reimage®) <==== ACHTUNG
Task: {3F13E7A0-8D92-4FFC-A828-4C6191BEEF92} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-07-03] (Microsoft Corporation)
Task: {55E21077-EAF9-4BE4-AE0C-76C57781265B} - System32\Tasks\UbtFrameworkService => C:\Program Files\Acer\User Experience Improvement Program\Framework\TriggerFramework.exe [2014-03-13] (TODO: <Company name>)
Task: {57E3A7EA-B18F-41FD-BC75-5287590B9FC0} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-04-30] (Oracle Corporation)
Task: {5EEAC558-7F5B-4AE7-9591-DB0BE0C18C49} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-16] (Google Inc.)
Task: {64158EA8-3BF8-4ED5-BE70-0E219F4F5759} - System32\Tasks\AcerCloud => C:\Program Files (x86)\Acer\Acer Portal\AcerPortal.exe [2014-12-19] (Acer)
Task: {6D240119-E177-4147-8852-37F3724738A7} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473 => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-06-09] ()
Task: {734C501C-74A8-4D36-B6DF-D9D9E4604DD4} - \WordSurfer Auto Updater 1.10.0.19 Pending Update -> Keine Datei <==== ACHTUNG
Task: {78D10AF6-EF14-49D3-98A5-819354D7252A} - System32\Tasks\Launch Manager => C:\Program Files\Acer\Acer Launch Manager\LMLauncher.exe [2014-12-30] (Acer Incorporate)
Task: {80A010D2-CA99-4862-B01E-B88C780E3C9B} - System32\Tasks\Software Update Application => C:\ProgramData\OEM\UpgradeTool\ListCheck.exe [2014-06-09] (Acer Incorporated)
Task: {8203031F-BE7E-4E79-8C99-2CC2C4CC50C2} - System32\Tasks\Quick Access => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-10-17] (Acer Incorporate)
Task: {8E46DB5E-ED2B-4E1E-98F1-E9BABF4DD109} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-02-16] (Google Inc.)
Task: {901295A4-841B-4FBD-9A3C-3703002E9C11} - System32\Tasks\ACCAgent => C:\Program Files (x86)\Acer\Care Center\LiveUpdateAgent.exe [2014-08-29] ()
Task: {9659698D-3F29-4A5A-B54C-851D7A8FD6B5} - System32\Tasks\Power Management => C:\Program Files\Acer\Acer Power Management\ePowerTrayLauncher.exe [2014-07-22] (Acer Incorporated)
Task: {AE6B59E1-68F6-4BB5-867E-F3E002F4C553} - System32\Tasks\Recovery Management\Notification => C:\Program Files\Acer\Acer Recovery Management\Notification\Notification.exe [2014-06-17] (Acer Incorporated)
Task: {E054ED25-AA0A-4E4C-B2BD-5AEEE65ACC6B} - System32\Tasks\IUM-F1E24CA0-B63E-4F13-A9E3-4ADE3BFF3473-Logon => C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-06-09] ()
Task: {E286F866-0A3A-4180-B1AA-AC7E100C0397} - System32\Tasks\SpyHunter4Startup => C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe [2015-08-08] (Enigma Software Group USA, LLC.)
Task: {E7E97AE7-E6FD-4A5A-BED5-6643B61C9240} - System32\Tasks\LaunchSignup => C:\Program Files (x86)\MyPC Backup\Signup Wizard.exe <==== ACHTUNG
Task: {EAAB0DE5-1C48-405B-80B4-C321224DD50A} - System32\Tasks\Quick Access Quick Launcher => C:\Program Files\Acer\Acer Quick Access\QALauncher.exe [2014-10-17] (Acer Incorporate)
Task: {EC59CBF6-991B-49E2-9C0A-3D58AB7A2AFE} - \WordSurfer Auto Updater 1.10.0.19 Core -> Keine Datei <==== ACHTUNG
Task: {F60D949C-969E-4B86-B29A-8A91A1F2E75C} - \Run_Bobby_Browser -> Keine Datei <==== ACHTUNG

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2014-11-24 00:43 - 2014-08-31 15:00 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2014-08-29 20:55 - 2012-04-24 12:43 - 00254512 ____N () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2015-05-19 12:46 - 2015-05-19 12:46 - 06759912 _____ () C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
2015-06-25 07:53 - 2015-06-25 07:53 - 00699704 _____ () C:\Program Files (x86)\TuneUp Utilities 2014\avgrepliba.dll
2014-08-29 21:00 - 2014-07-01 23:13 - 00111872 _____ () C:\Program Files (x86)\Acer\clear.fi plug-in\Clearfishellext_x64.dll
2014-11-12 05:20 - 2014-11-06 11:16 - 00456296 _____ () C:\Windows\system32\igfxTray.exe
2015-08-10 22:40 - 2015-08-10 22:40 - 00050477 _____ () C:\Users\Mike\Downloads\Defogger.exe
2014-03-06 16:00 - 2014-03-06 16:00 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\kpcengine.2.3.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00468672 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-04-20 02:42 - 2015-02-16 15:52 - 00642344 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-04-20 02:42 - 2014-04-20 02:42 - 00347328 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com\nponlinebanking.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\Users\Mike\OneDrive:ms-properties

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ColorMedia => ""="service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Mike\Pictures\Naturwesen\10603584_766710903390518_8834917833517691852_n.jpg
DNS Servers: 192.168.1.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKLM\...\StartupApproved\Run32: => "abDocsDllLoader"
HKLM\...\StartupApproved\Run32: => "KiesTrayAgent"
HKLM\...\StartupApproved\Run32: => "Allin1Convert Search Scope Monitor"
HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"
HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\StartupApproved\StartupFolder: => "MyPC Backup.lnk"
HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\StartupApproved\Run: => "Pokki"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139
FirewallRules: [{3458DD54-E0FF-4F06-BB29-EF4CB149B028}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDirector10\PDR10.EXE
FirewallRules: [{DB3BE63B-6FCD-4057-A6AF-2596A11BA895}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{96D89B5C-58D3-4755-AD8B-91EEA9E706C8}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{A4F8DA0F-6AE5-451E-AA84-E0EED01AC04D}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{4BB4B980-4B2D-45A2-AF75-6A91021BA3B7}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{549E3BB0-DE9A-4F7D-B47E-282EB7EEEF71}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{068FAEF0-419C-42F8-9935-E7A12CE7DD2B}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\DMCDaemon.exe
FirewallRules: [{CEDB11DA-08F7-4AB2-B54D-09BBBC28445C}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{F5D0EC4F-CEA6-489B-95B9-C40F7EA8DC3A}] => (Allow) C:\Program Files (x86)\Acer\abPhoto\WindowsUpnp.exe
FirewallRules: [{187DE9D0-8878-4952-8173-42B7B782C0A9}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{7F45F531-CA21-41C0-9DE3-9ABD029D76F2}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{3A91171C-A655-4592-A070-5168F33F2715}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{5107FD83-FDDD-4C67-9219-115D67BD2131}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{92A2F55A-CFDA-48F7-A2C7-F7F5FCEEBC2D}] => (Allow) C:\Program Files (x86)\Spotify\spotify.exe
FirewallRules: [{156BBB3D-3E92-4091-9FC6-BDC572DA798C}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{A6923A21-0521-427C-9EDE-C430052D372F}] => (Allow) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
FirewallRules: [{B115AD87-4C56-4C44-A113-B2FFD5F90D74}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12.exe
FirewallRules: [{3867E7B9-E6ED-45B4-B652-6E7D0AFD0E64}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\PowerDVD12ML.exe
FirewallRules: [{CE0685CB-CF6A-41E7-9EF0-26D70F6C3BE6}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD12\Movie\PowerDVD.exe
FirewallRules: [{A7354CD5-0721-4700-BFBD-0A335C6CCD6E}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{5FB485DD-2B0B-45AD-9DBE-C5D4438A1324}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{48BABD39-9D9B-4176-87E9-353FFCF6F0FD}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{D87DCB75-EFE5-4305-8CD5-8DF90F84665C}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{937858A5-115D-401E-8272-AF54D37A8917}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{839A4B6E-EE87-4960-A422-A294849FD3EF}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{83EA830E-67CB-467D-95B3-F6866DA3F239}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{C7D1ECE1-6249-4269-B6A4-CADE57CF934B}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{0BC2E8CE-8385-48B6-A0F7-DD27643779EB}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{E49BA674-219B-4A30-AA85-698FF73C2777}] => (Allow) C:\Program Files (x86)\Acer\AOP Framework\acer\ccd.exe
FirewallRules: [{B750229C-642A-4BAD-B1C8-751C5EFB7A79}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{E1325898-80F9-4725-841D-69D387EBE202}] => (Allow) C:\Program Files (x86)\Acer\abMedia\DMCDaemon.exe
FirewallRules: [{8E4A631C-98FA-4756-B304-ACEF490AAF5D}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{7C1F9B35-76FC-4E0E-98B3-0E77740CF95C}] => (Allow) C:\Program Files (x86)\Acer\abMedia\WindowsUpnpMV.exe
FirewallRules: [{77C43871-72CC-4400-A32D-BFFEAB217CD0}] => (Allow) D:\o2CD.exe
FirewallRules: [{18A9F0C5-D28C-4AE1-A031-5B17E04F24EF}] => (Allow) D:\o2CD.exe
FirewallRules: [{5AAADA7C-CD9C-4894-8D6E-E43636A0807F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{0DDDA528-A3E7-4005-9AB1-A18E32D308A7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Fehlerhafte Geräte im Gerätemanager =============

Name: Intel(R) Technology Access TAP Driver (NDIS 6.30)
Description: Intel(R) Technology Access TAP Driver (NDIS 6.30)
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel Corporation
Service: NetTap630
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/10/2015 10:48:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:48:15Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:47:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:47:45Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:47:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:47:15Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:46:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:46:45Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:46:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:46:15Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:45:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:45:45Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:45:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:45:15Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:44:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:44:45Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:44:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:44:15Z. Fehlercode: 0x80040154.

Error: (08/10/2015 10:43:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: Fehler beim Planen des Softwareschutzdiensts für den erneuten Start bei 2115-07-17T20:43:45Z. Fehlercode: 0x80040154.


Systemfehler:
=============
Error: (08/10/2015 10:39:55 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Netzwerkverbindungsbroker" wurde mit folgendem Fehler beendet: 
%%4294967295

Error: (08/10/2015 10:39:37 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:37:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:35:35 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:35:34 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:34:24 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:34:23 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:34:08 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:34:07 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106

Error: (08/10/2015 10:33:44 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" wurde mit folgendem Fehler beendet: 
%%10106


Microsoft Office:
=========================
Error: (08/10/2015 10:48:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:48:15Z

Error: (08/10/2015 10:47:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:47:45Z

Error: (08/10/2015 10:47:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:47:15Z

Error: (08/10/2015 10:46:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:46:45Z

Error: (08/10/2015 10:46:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:46:15Z

Error: (08/10/2015 10:45:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:45:45Z

Error: (08/10/2015 10:45:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:45:15Z

Error: (08/10/2015 10:44:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:44:45Z

Error: (08/10/2015 10:44:15 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:44:15Z

Error: (08/10/2015 10:43:45 PM) (Source: Software Protection Platform Service) (EventID: 16385) (User: )
Description: 0x800401542115-07-17T20:43:45Z


CodeIntegrity:
===================================
  Date: 2015-08-10 19:45:08.438
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 19:45:06.271
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 19:36:06.788
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 18:54:52.925
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 18:54:52.925
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 18:54:52.925
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 18:54:52.849
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 18:54:52.726
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 18:54:52.635
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.

  Date: 2015-08-10 18:54:52.629
  Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Windows\System32\svchost.exe) attempted to load \Device\HarddiskVolume4\Program Files (x86)\Elex-tech\YAC\iSafeSrvMon64.dll that did not meet the Windows signing level requirements.


==================== Speicherinformationen =========================== 

Processor: Intel(R) Core(TM) i5-5200U CPU @ 2.20GHz
Prozentuale Nutzung des RAM: 35%
Installierter physikalischer RAM: 8107.32 MB
Verfügbarer physikalischer RAM: 5216.73 MB
Summe virtueller Speicher: 9387.32 MB
Verfügbarer virtueller Speicher: 5797.22 MB

==================== Laufwerke ================================

Drive c: (Acer) (Fixed) (Total:915.15 GB) (Free:620.57 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 2B011BCF)

Partition: GPT.

==================== Ende von log ============================
--- --- ---
__________________
Alt 10.08.2015, 22:02   #4
DerDocker
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


GMER Logfile:
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-08-10 23:01:32
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\00000031 WDC_WD10JPVX-22JC3T0 rev.01.01A01 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\Mike\AppData\Local\Temp\fwldypow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                                                                                    00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                                                                                        00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                                                                                    00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                                                                                          00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                                                                                     00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                                                                                            00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                                                                                       00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                                                                                          00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                                                                                                                                      00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977                                                                                                               00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                                                                                                                        00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                                                                                                                        00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                                                                                                                             00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                                                                                                                                  00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                                                                                                                                 00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                                                                                                                                  00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                                                                                                                                     00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                                                                                                                                     00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                                                                                                                                       00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                                                                                                                           00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                                                                                                                                      00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                                                                                                                                      00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 3
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                                                                                                                          00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                                                                                                                                     00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                                                                                                                           00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                                                                                                                           00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text    ...                                                                                                                                                                                                                                                        * 2
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579                                                                                                                      00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47                                                                                                                     00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                                                                                                                                      00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                                                                                                                                      00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                                                                                                                                     00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                                                                                                                          00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                                                                                                                        00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                                                                                                                            00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                                                                                                                            00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                                                                                                                            00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                                                                                                                                  00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                                                                                                                            00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                                                                                                                                 00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                                                                                                                                    00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                                                                                                                         00007ffbbdb4015b 8 bytes [70, 6C, 78, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                                                                                                                         00007ffbbdb41438 8 bytes [40, 6C, 78, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                                                                                                                                 00007ffbbdb415e6 8 bytes [30, 6C, 78, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                                                                                                                                00007ffbbdb41877 8 bytes [20, 6C, 78, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                                                                                                                               00007ffbbdb41a2d 8 bytes [10, 6C, 78, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                                                                                                                                  00007ffbbdb41c35 8 bytes [00, 6C, 78, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                       00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                     00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                           00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                         00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                             00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                             00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                           00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                           00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                                                                                                                                       00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                                                                                                                                       0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                                                                                             0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                                                                                                                       0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                   00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                                                                                               00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                                                                                              0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 7
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                                                                                                             00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                                                                                                                         0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                                                                                                                           0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe[3200] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                                                                                                                                      0000000077612bd3 8 bytes [DC, 6A, 78, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                                                                          00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                                                                              00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                                                                          00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                                                                                00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                                                                           00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                                                                                  00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                                                                             00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                                                                                00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                                                                                                                            00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977                                                                                                     00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                                                                                                              00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                                                                                                              00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                                                                                                                   00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                                                                                                                        00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                                                                                                                       00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                                                                                                                        00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                                                                                                                           00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                                                                                                                           00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                                                                                                                             00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                                                                                                                 00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                                                                                                                            00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                                                                                                                            00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 3
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                                                                                                                00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                                                                                                                           00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                                                                                                                 00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                                                                                                                 00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text    ...                                                                                                                                                                                                                                                        * 2
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579                                                                                                            00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47                                                                                                           00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                                                                                                                            00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                                                                                                                            00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                                                                                                                           00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                                                                                                                00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                                                                                                              00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                                                                                                                  00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                                                                                                                  00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                                                                                                                  00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                                                                                                                        00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                                                                                                                  00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                                                                                                                       00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                                                                                                                          00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                                                                                                               00007ffbbdb4015b 8 bytes [70, 6C, B5, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                                                                                                               00007ffbbdb41438 8 bytes [40, 6C, B5, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                                                                                                                       00007ffbbdb415e6 8 bytes [30, 6C, B5, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                                                                                                                      00007ffbbdb41877 8 bytes [20, 6C, B5, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                                                                                                                     00007ffbbdb41a2d 8 bytes [10, 6C, B5, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                                                                                                                        00007ffbbdb41c35 8 bytes [00, 6C, B5, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                             00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                           00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                 00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                               00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                   00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                   00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                 00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                 00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                                                                                                                             00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                                                                                                                             0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                                                                                   0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                                                                                                             0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                         00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                                                                                     00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                                                                                    0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 7
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                                                                                                   00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                                                                                                               0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                                                                                                                 0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[4448] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                                                                                                                            0000000077612bd3 8 bytes [DC, 6A, B5, 7E, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                                                                                     00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                                                                                         00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                                                                                     00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                                                                                           00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                                                                                      00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                                                                                             00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                                                                                        00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                                                                                           00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                                                                                                                                       00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977                                                                                                                00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                                                                                                                         00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                                                                                                                         00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                                                                                                                              00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                                                                                                                                   00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                                                                                                                                  00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                                                                                                                                   00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                                                                                                                                      00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                                                                                                                                      00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                                                                                                                                        00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                                                                                                                            00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                                                                                                                                       00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                                                                                                                                       00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 3
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                                                                                                                           00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                                                                                                                                      00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                                                                                                                            00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                                                                                                                            00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text    ...                                                                                                                                                                                                                                                        * 2
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579                                                                                                                       00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47                                                                                                                      00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                                                                                                                                       00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                                                                                                                                       00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                                                                                                                                      00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                                                                                                                           00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                                                                                                                         00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                                                                                                                             00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                                                                                                                             00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                                                                                                                             00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                                                                                                                                   00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                                                                                                                             00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                                                                                                                                  00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                                                                                                                                     00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                                                                                                                          00007ffbbdb4015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                                                                                                                          00007ffbbdb41438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                                                                                                                                  00007ffbbdb415e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                                                                                                                                 00007ffbbdb41877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                                                                                                                                00007ffbbdb41a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                                                                                                                                   00007ffbbdb41c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                        00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                      00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                            00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                          00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                              00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                              00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                            00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                            00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                                                                                                                                        00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                                                                                                                                        0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                                                                                              0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                                                                                                                        0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                    00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                                                                                                00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                                                                                               0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 7
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                                                                                                              00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                                                                                                                          0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                                                                                                                            0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe[5180] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                                                                                                                                       0000000077612bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                                                                          00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                                                                              00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                                                                          00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                                                                                00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                                                                           00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                                                                                  00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                                                                             00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                                                                                00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                                                                                                                            00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977                                                                                                     00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                                                                                                              00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                                                                                                              00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                                                                                                                   00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                                                                                                                        00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                                                                                                                       00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                                                                                                                        00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                                                                                                                           00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                                                                                                                           00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                                                                                                                             00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                                                                                                                 00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                                                                                                                            00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                                                                                                                            00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 3
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                                                                                                                00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                                                                                                                           00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                                                                                                                 00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                                                                                                                 00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text    ...                                                                                                                                                                                                                                                        * 2
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579                                                                                                            00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47                                                                                                           00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                                                                                                                            00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                                                                                                                            00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                                                                                                                           00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                                                                                                                00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                                                                                                              00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                                                                                                                  00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                                                                                                                  00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                                                                                                                  00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                                                                                                                        00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                                                                                                                  00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                                                                                                                       00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                                                                                                                          00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                                                                                                               00007ffbbdb4015b 8 bytes [70, 6C, 64, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                                                                                                               00007ffbbdb41438 8 bytes [40, 6C, 64, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                                                                                                                       00007ffbbdb415e6 8 bytes [30, 6C, 64, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                                                                                                                      00007ffbbdb41877 8 bytes [20, 6C, 64, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                                                                                                                     00007ffbbdb41a2d 8 bytes [10, 6C, 64, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                                                                                                                        00007ffbbdb41c35 8 bytes [00, 6C, 64, 7F, 00, 00, 00, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                             00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                           00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                 00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                               00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                   00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                   00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                 00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                 00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                                                                                                                             00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                                                                                                                             0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                                                                                   0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                                                                                                             0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                         00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                                                                                     00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                                                                                    0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 7
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                                                                                                   00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                                                                                                               0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                                                                                                                 0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe[5360] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                                                                                                                            0000000077612bd3 8 bytes [DC, 6A, 64, 7F, 00, 00, 00, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                                                                                                       00007ffbbdb34b04 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                                                                                                           00007ffbbdb34f2c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                                                                                                       00007ffbbdb35206 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                                                                                                             00007ffbbdb353ff 8 bytes {JMP 0xffffffffffffffee}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                                                                                                        00007ffbbdb3579f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                                                                                                               00007ffbbdb35954 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                                                                                                          00007ffbbdb35ef1 8 bytes {JMP 0xffffffffffffff9e}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                                                                                                             00007ffbbdb35f4e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlWakeAddressAll + 399                                                                                                                                                         00007ffbbdb360ef 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfStateChangeNotification + 977                                                                                                                                  00007ffbbdb364d1 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 310                                                                                                                                                           00007ffbbdb36616 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSimpleTryPost + 491                                                                                                                                                           00007ffbbdb366cb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlReportSilentProcessExit + 359                                                                                                                                                00007ffbbdb38397 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 67                                                                                                                                                     00007ffbbdb38a13 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrFindEntryForAddress + 864                                                                                                                                                    00007ffbbdb38d30 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrGetDllHandleByName + 143                                                                                                                                                     00007ffbbdb38e9f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 510                                                                                                                                                        00007ffbbdb390ae 8 bytes {JMP 0xffffffffffffff96}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrInitializeThunk + 715                                                                                                                                                        00007ffbbdb3917b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlQueueWorkItem + 772                                                                                                                                                          00007ffbbdb39d14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrAddRefDll + 685                                                                                                                                                              00007ffbbdb39fcd 8 bytes {JMP 0xffffffffffffffaf}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 352                                                                                                                                                         00007ffbbdb3aae0 8 bytes {JMP 0xffffffffffffffcd}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!SbSelectProcedure + 488                                                                                                                                                         00007ffbbdb3ab68 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 3
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetVersion + 565                                                                                                                                                             00007ffbbdb3b2e5 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlGetNtProductType + 78                                                                                                                                                        00007ffbbdb3b33e 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 311                                                                                                                                                              00007ffbbdb3c4d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll + 528                                                                                                                                                              00007ffbbdb3c5b0 8 bytes {JMP 0xffffffffffffffc7}
.text    ...                                                                                                                                                                                                                                                        * 2
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlAllocateActivationContextStack + 579                                                                                                                                         00007ffbbdb3d0d3 8 bytes {JMP 0xffffffffffffffef}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlFreeThreadActivationContextStack + 47                                                                                                                                        00007ffbbdb3d10f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlProcessFlsData + 495                                                                                                                                                         00007ffbbdb3d57f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 43                                                                                                                                                         00007ffbbdb3d6eb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDetectHeapLeaks + 456                                                                                                                                                        00007ffbbdb3d888 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpReleaseWait + 180                                                                                                                                                             00007ffbbdb3d944 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlRegisterWait + 596                                                                                                                                                           00007ffbbdb3dba4 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWait + 424                                                                                                                                                               00007ffbbdb3dd58 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 771                                                                                                                                                               00007ffbbdb3e073 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!TpSetWaitEx + 948                                                                                                                                                               00007ffbbdb3e124 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsA + 48                                                                                                                                                     00007ffbbdb3e160 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlRandomEx + 756                                                                                                                                                               00007ffbbdb3eb74 8 bytes {JMP 0xffffffffffffffd0}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteFunctionTable + 371                                                                                                                                                    00007ffbbdb3fe63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlAddFunctionTable + 556                                                                                                                                                       00007ffbbdb4009c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlProtectHeap + 171                                                                                                                                                            00007ffbbdb4015b 8 bytes [70, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlInitializeCriticalSectionEx + 744                                                                                                                                            00007ffbbdb41438 8 bytes [40, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!EtwRegisterTraceGuidsW + 214                                                                                                                                                    00007ffbbdb415e6 8 bytes [30, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!EtwNotificationRegister + 567                                                                                                                                                   00007ffbbdb41877 8 bytes [20, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlDllShutdownInProgress + 429                                                                                                                                                  00007ffbbdb41a2d 8 bytes [10, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!RtlRunOnceExecuteOnce + 213                                                                                                                                                     00007ffbbdb41c35 8 bytes [00, 6C, F8, 7F, 00, 00, 00, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                                                                                          00007ffbbdbb1290 8 bytes {JMP QWORD [RIP-0x6fe5e]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                                                                                                        00007ffbbdbb1410 8 bytes {JMP QWORD [RIP-0x6fe30]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                                                                                              00007ffbbdbb1440 8 bytes {JMP QWORD [RIP-0x712eb]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                                                                                            00007ffbbdbb1560 8 bytes {JMP QWORD [RIP-0x70c1e]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                                                                                                00007ffbbdbb1610 8 bytes {JMP QWORD [RIP-0x71122]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                                                                                                00007ffbbdbb1cd0 8 bytes {JMP QWORD [RIP-0x700a1]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                                                                                              00007ffbbdbb1fd0 8 bytes {JMP QWORD [RIP-0x705a9]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                                                                                              00007ffbbdbb2850 8 bytes {JMP QWORD [RIP-0x70fdf]}
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438                                                                                                                                                          00000000776113f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387                                                                                                                                                          0000000077611583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                                                                                                                0000000077611621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68                                                                                                                                                          0000000077611674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                                                                                                      00000000776116d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                                                                                                                  00000000776116e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                                                                                                                 0000000077611727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    ...                                                                                                                                                                                                                                                        * 7
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuFlushInstructionCache + 16                                                                                                                                                00000000776125d0 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuInitializeStartupContext + 308                                                                                                                                            0000000077612714 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuResetToConsistentState + 529                                                                                                                                              0000000077612961 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text    C:\Users\Mike\Downloads\Gmer-19357.exe[6860] C:\Windows\system32\wow64cpu.dll!CpuProcessTerm + 595                                                                                                                                                         0000000077612bd3 8 bytes [DC, 6A, F8, 7F, 00, 00, 00, ...]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\system32\csrss.exe [708:732]                                                                                                                                                                                                                    fffff960008ae2d0
Thread   C:\Windows\Explorer.EXE [2408:5388]                                                                                                                                                                                                                        00007ffbad4be630
---- Processes - GMER 2.1 ----

Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\uds.dll.000000000006ad50-01d049ed6378490f-01d0a1f94e82ee12 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)               0000000071a90000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\avengine.dll.9ee8bd3c2dfe2b51237b1662e1c9ede4 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                            0000000071a00000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavbase.kdl.ec30a0e81f3e302a0b46ce9429e61be5 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                             0000000071960000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavemu.kdl.b6b6dd223ad2aad28374217a028b59b0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                             00000000712e0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kjim.kdl.e30a2afa3b21fc3c867bdf51ac89005f (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                                0000000071060000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\mark.kdl.841a103288da704ab47258a8a435c8d1 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                                0000000071000000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\qscan.kdl.930f4350f703b72d5b371e32d0b0a20b (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                               0000000070ed0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\arkmon.kdl.05412b88de65b3a6617f42e1fbad772c (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                              0000000070d60000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\kavsys.kdl.8ddf5e38536ca52585f7111e29787d9b (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                              0000000070ce0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\intctrl.kdl.0000000000090000-01d049ed627928ba-01d04813eb1eff00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)           0000000070800000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon.kdl.0000000000019800-01d049ed6318e9bd-01d0aeb067f58b79 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)             000000006fee0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\swmon_drv.kdl.0000000000018600-01d049ed63417292-01d04813f3773a00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)         000000006f9b0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\vlns.kdl.485c531d29ec65f537ebf368a496dbad (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                                000000006de30000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pbs.kdl.eefcc4c76375abb2b40e8e5c00c7eccf (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                                 000000006dcd0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\pdm.kdl.0000000000069740-01d049ed62e6d694-01d04813ed815900 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)               000000006ecc0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\bsshlp2.kdl.7b5ed3ca6d3d7225b866af3c09484fec (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                             000000006ebc0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\klavasyswatch.dll.000000000012e400-01d049ed62804f5e-01d0a96d089d22bb (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)     00000000625b0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\sys_critical_obj.dll.0000000000023800-01d049ed6356e803-01d04813aabf8100 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)  00000000624b0000
Library  C:\ProgramData\Kaspersky Lab\AVP15.0.0\Bases\Cache\heurap.dll.7aaa0a24800a0898e1e21547cd09831d (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [1784] (FILE NOT FOUND)                              00000000623d0000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                                                      unknown MBR code

---- EOF - GMER 2.1 ----
--- --- ---
Alt 10.08.2015, 22:15   #5
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


Was ist mit meiner Frage nach bisherigen Funden und wenn es welche gab, den Logs dazu?

__________________
Logfiles bitte immer in CODE-Tags posten

Alt 11.08.2015, 12:30   #6
DerDocker
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

ich habe nochmal mit kaspersky gescannt


hat aber nichts gefunden

Alt 11.08.2015, 13:25   #7
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


Zitat:
AV: Avira Antivirus (Disabled - Out of date) {4D041356-F94D-285F-8768-AAE50FA36859}
AV: Kaspersky Internet Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
Sowas geht nicht. Einer muss auf jeden Fall runter!

Außerdem fehlt die FRST.txt
__________________
Logfiles bitte immer in CODE-Tags posten

Alt 12.08.2015, 17:14   #8
DerDocker
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

tut mir leid...


bei mir dauert das immer ein bißchen...

hier kommt die FRST
FRST Logfile:
Code:
ATTFilter
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:09-08-2015
durchgeführt von Mike (Administrator) auf MIKESPC (10-08-2015 22:47:17)
Gestartet von C:\Users\Mike\Downloads
Geladene Profile: Mike (Verfügbare Profile: Mike)
Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Opera)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Taiwan Shui Mu Chih Ching Technology Limited.) C:\Program Files (x86)\WinZipper\winzipersvc.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Reimage®) C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
() C:\Program Files\Reimage\Reimage Protector\ReiSystem.exe
(DEVGURU Co., LTD.) C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avpui.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Malwarebytes Corporation) C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbam.exe
(TuneUp Software) C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesApp64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
() C:\Windows\System32\igfxTray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Spotify Ltd) C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avcenter.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Antivirus\avscan.exe
() C:\Users\Mike\Downloads\Defogger.exe


==================== Registry (Nicht auf der Ausnahmeliste) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2404296 2014-08-09] (NVIDIA Corporation)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13675736 2014-08-14] (Realtek Semiconductor)
HKLM-x32\...\Run: [BacKGround Agent] => C:\Program Files (x86)\Acer\AOP Framework\BackgroundAgent.exe [62208 2014-12-19] (Acer Incorporated)
HKLM-x32\...\Run: [abDocsDllLoader] => C:\Program Files (x86)\Acer\abDocs\abDocsDllLoader.exe [90880 2014-12-19] ()
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2015-01-14] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [334896 2015-04-30] (Oracle Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-07-02] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\Antivirus\avgnt.exe [782008 2015-07-15] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\Run: [Pokki] => "%LOCALAPPDATA%\Pokki\Engine\HostAppServiceUpdater.exe" /LOGON
HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIIKE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1580386797-2802970296-1791143644-1001\...\Run: [Spotify Web Helper] => C:\Program Files (x86)\Spotify\Data\SpotifyWebHelper.exe [1168896 2014-11-24] (Spotify Ltd)
IFEO: [Debugger] "C:\Program Files (x86)\TuneUp Utilities 2014\TUAutoReactivator64.exe"
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2015-08-08]
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.285\SSScheduler.exe (McAfee, Inc.)
ShellIconOverlayIdentifiers: [ACloudSyncedRF] -> {5CCE71FA-9F61-4F24-9CD1-98D819B40D68} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll [2014-12-19] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncedSF] -> {5D5F18B7-D59B-4B18-A3E9-0A4BDCCCB699} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll [2014-12-19] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudSyncing] -> {C1E1456F-C2D8-4C96-870D-35F1E13941EE} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll [2014-12-19] (Acer Incorporated)
ShellIconOverlayIdentifiers: [ACloudToBeSynced] -> {307523FA-DDC0-4068-983F-2A6B34627744} => C:\Program Files (x86)\Acer\Acer Portal\x64\shellext_win.dll [2014-12-19] (Acer Incorporated)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = www.google.com
URLSearchHook: HKU\S-1-5-21-1580386797-2802970296-1791143644-1001 - (Kein Name) - {5bcf818d-78c8-41b8-ba89-65c5fdac4fc4} - C:\Program Files (x86)\Allin1Convert_8h\bar\2.bin\8hSrcAs.dll Keine Datei
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> {AA9A4890-4262-4441-8977-E2FFCBFB706C} URL = hxxp://de.yhs4.search.yahoo.com/yhs/search?hspart=acer&hsimp=yhs-acer_001&p={searchTerms}
SearchScopes: HKU\S-1-5-21-1580386797-2802970296-1791143644-1001 -> DefaultScope {2023ECEC-E06A-4372-A1C7-0B49F9E0FFF0} URL = 
BHO: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-02-16] (Kaspersky Lab ZAO)
BHO: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\x64\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin -> {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\ContentBlocker\ie_content_blocker_plugin.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin -> {73455575-E40C-433C-9784-C78DC7761455} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll [2015-02-16] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\ssv.dll [2015-06-03] (Oracle Corporation)
BHO-x32: Safe Money Plugin -> {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\OnlineBanking\online_banking_bho.dll [2014-04-20] (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-06-03] (Oracle Corporation)
BHO-x32: URL Advisor Plugin -> {E33CF602-D945-461A-83F0-819F76A199F8} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\IEExt\UrlAdvisor\klwtbbho.dll [2014-04-20] (Kaspersky Lab ZAO)
Winsock: Catalog9-x64 01 C:\Windows\system32\ColorMedia64.dll File Not ' & $found1 & '
Winsock: Catalog9-x64 02 C:\Windows\system32\ColorMedia64.dll File Not ' & $found1 & '
Winsock: Catalog9-x64 03 C:\Windows\system32\ColorMedia64.dll File Not ' & $found1 & '
Winsock: Catalog9-x64 04 C:\Windows\system32\ColorMedia64.dll File Not ' & $found1 & '
Winsock: Catalog9-x64 16 C:\Windows\system32\ColorMedia64.dll File Not ' & $found1 & '
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{34CA4B93-D531-4A72-AC6C-38968442BF47}: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tejux.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-08-08] ()
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-08-08] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/pdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-05-14] ()
FF Plugin-x32: @foxitsoftware.com/Foxit PhantomPDF Plugin,version=1.0,application/vnd.fdf -> C:\Program Files (x86)\Foxit PhantomPDF\plugins\npFoxitPhantomPDFPlugin.dll [2014-05-14] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.56 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2014-10-10] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-06-03] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files (x86)\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-06-03] (Oracle Corporation)
FF Plugin-x32: @kaspersky.com/content_blocker -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2015-02-16] ()
FF Plugin-x32: @kaspersky.com/online_banking -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2015-02-16] ()
FF Plugin-x32: @kaspersky.com/virtual_keyboard -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2015-02-16] ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-16] (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll [2013-08-06] ()
FF user.js: detected! => C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tejux.default\user.js [2015-08-10]
FF Extension: Avira Browser Safety - C:\Users\Mike\AppData\Roaming\Mozilla\Firefox\Profiles\wq4tejux.default\Extensions\abs@avira.com [2015-08-10]
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com
FF Extension: Dangerous Websites Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\content_blocker@kaspersky.com [2015-02-16]
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\virtual_keyboard@kaspersky.com [2015-02-16]
FF HKLM-x32\...\Firefox\Extensions:  - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\url_advisor@kaspersky.com [2015-02-16]
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\anti_banner@kaspersky.com [2015-02-16]
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\FFExt\online_banking@kaspersky.com [2015-02-16]

Chrome: 
=======
CHR HomePage: Default -> hxxp://www.mystartsearch.com/?type=hppp&ts=1439014980&z=1f8c6793c72e3f58bd535c5g2z4c8t5e6g1z7tbedc&from=cmi&uid=WDCXWD10JPVX-22JC3T0_WD-WX91A94C289TC289T
CHR StartupUrls: Default -> "hxxp://www.mystartsearch.com/?type=hppp&ts=1439014980&z=1f8c6793c72e3f58bd535c5g2z4c8t5e6g1z7tbedc&from=cmi&uid=WDCXWD10JPVX-22JC3T0_WD-WX91A94C289TC289T"
CHR DefaultSearchKeyword: Default -> mystartsearch
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-02-16]
CHR Extension: (Google Drive) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-02-16]
CHR Extension: (YouTube) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-02-16]
CHR Extension: (Google Search) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-02-16]
CHR Extension: (Kaspersky Protection) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\dbhjdbfgekjfcfkkfjjmlmojhbllhbho [2015-02-16]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-16]
CHR Extension: (Google Wallet) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-02-16]
CHR Extension: (Amazon) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj [2015-02-20]
CHR Extension: (Gmail) - C:\Users\Mike\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-02-16]
CHR HKLM\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [dbhjdbfgekjfcfkkfjjmlmojhbllhbho] - https://chrome.google.com/webstore/detail/dbhjdbfgekjfcfkkfjjmlmojhbllhbho
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ocbnpbkmjpgbdcgiflkgkpnkinifpgpj] - C:\Users\Mike\ChromeExtensions\ocbnpbkmjpgbdcgiflkgkpnkinifpgpj\amazon-icon-2.crx [2015-02-18]

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\Antivirus\avmailc7.exe [887128 2015-07-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\Antivirus\sched.exe [461672 2015-07-15] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\Antivirus\avguard.exe [461672 2015-07-15] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\Antivirus\avwebg7.exe [1213072 2015-07-15] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [218816 2015-07-02] (Avira Operations GmbH & Co. KG)
R2 AVP15.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 15.0.0\avp.exe [233552 2014-04-20] (Kaspersky Lab ZAO)
S3 BthHFSrv; C:\Windows\System32\BthHFSrv.dll [324608 2014-10-29] (Microsoft Corporation)
S4 CCDMonitorService; C:\Program Files (x86)\Acer\AOP Framework\CCDMonitorService.exe [2713856 2014-12-19] (Acer Incorporated)
S4 ePowerSvc; C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe [2573032 2014-07-22] (Acer Incorporated)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
S4 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-04-24] (WildTangent)
S4 iBtSiva; C:\Program Files (x86)\Intel\Bluetooth\ibtsiva.exe [121304 2014-08-07] (Intel Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [325224 2014-11-06] (Intel Corporation)
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [887256 2014-05-13] (Intel(R) Corporation)
S2 Intel(R) TechnologyAccessService; C:\Program Files\Intel Corporation\Intel(R) Technology Access\IntelTechnologyAccessService.exe [93408 2015-03-17] (Intel(R) Corporation)
S4 iumsvc; C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [174368 2014-06-09] ()
S4 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [158496 2014-10-10] (Intel Corporation)
S4 LMSvc; C:\Program Files\Acer\Acer Launch Manager\LMSvc.exe [455912 2014-12-30] (Acer Incorporate)
R2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-06-18] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [234776 2012-09-05] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-08-18] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1721800 2014-08-09] (NVIDIA Corporation)
S4 QASvc; C:\Program Files\Acer\Acer Quick Access\QASvc.exe [458984 2014-10-17] (Acer Incorporate)
R2 ReimageRealTimeProtector; C:\Program Files\Reimage\Reimage Protector\ReiGuard.exe [7414256 2015-05-19] (Reimage®)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [254512 2012-04-24] ()
S4 RMSvc; C:\Program Files\Acer\Acer Quick Access\RMSvc.exe [449768 2014-10-17] (Acer Incorporate)
R2 ss_conn_service; C:\Program Files (x86)\Samsung\USB Drivers\25_escape\conn\ss_conn_service.exe [743688 2014-10-13] (DEVGURU Co., LTD.)
R2 TuneUp.UtilitiesSvc; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe [2145080 2015-06-25] (TuneUp Software)
S4 UEIPSvc; C:\Program Files\Acer\User Experience Improvement Program\Framework\UBTService.exe [234240 2014-07-15] (acer)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366520 2015-02-04] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23792 2015-02-04] (Microsoft Corporation)
R2 winzipersvc; C:\Program Files (x86)\WinZipper\winzipersvc.exe [337040 2015-07-21] (Taiwan Shui Mu Chih Ching Technology Limited.) <==== ACHTUNG
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3817168 2014-08-18] (Intel® Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [137288 2015-07-15] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [148632 2015-07-15] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\system32\DRIVERS\avkmgr.sys [28600 2015-07-15] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\system32\DRIVERS\avnetflt.sys [43576 2015-07-15] (Avira Operations GmbH & Co. KG)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [226304 2014-03-18] (Microsoft Corporation)
R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [141624 2014-05-13] (Motorola Solutions, Inc.)
R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1424184 2014-06-17] (Motorola Solutions, Inc.)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [15920 2015-08-08] (Enigma Software Group USA, LLC.)
U5 GeneStor; C:\Windows\System32\Drivers\GeneStor.sys [110824 2014-06-11] (GenesysLogic)
R3 iaLPSS_I2C; C:\Windows\System32\drivers\iaLPSS_I2C.sys [120312 2014-06-10] (Intel Corporation)
R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [220104 2014-08-07] (Intel Corporation)
R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [457824 2014-02-20] (Kaspersky Lab ZAO)
S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [29616 2012-07-27] (Kaspersky Lab)
R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [142344 2015-02-16] (Kaspersky Lab ZAO)
R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [243808 2014-04-10] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [771272 2015-02-16] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [30304 2014-02-25] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [28768 2014-03-28] (Kaspersky Lab ZAO)
R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [29280 2013-08-08] (Kaspersky Lab ZAO)
R1 klpd; C:\Windows\system32\DRIVERS\klpd.sys [15456 2013-04-12] (Kaspersky Lab ZAO)
R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [67680 2014-03-19] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [179296 2014-03-26] (Kaspersky Lab ZAO)
R3 LMDriver; C:\Windows\System32\drivers\LMDriver.sys [21360 2013-07-17] (Acer Incorporated)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [113880 2015-08-10] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [129312 2014-10-10] (Intel Corporation)
S1 ndisrd; C:\Windows\system32\DRIVERS\ndisrfl.sys [41688 2014-10-30] (Intel Corporation)
S3 NetTap630; C:\Windows\system32\DRIVERS\nettap630.sys [67800 2014-10-30] (Intel Corporation)
R3 NETwNb64; C:\Windows\system32\DRIVERS\Netwbw02.sys [3479528 2014-08-21] (Intel Corporation)
S3 QRDCIO; C:\Windows\System32\drivers\QRDCIO.sys [9728 2009-10-20] (QUANTA)
R3 RadioShim; C:\Windows\System32\drivers\RadioShim.sys [14680 2013-07-17] (Acer Incorporated)
R3 SynRMIHID; C:\Windows\system32\DRIVERS\SynRMIHID.sys [42224 2014-02-20] (Synaptics Incorporated)
R3 TuneUpUtilitiesDrv; C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys [31144 2015-06-04] (TuneUp Software)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114496 2015-02-04] (Microsoft Corporation)

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-10 22:47 - 2015-08-10 22:48 - 00026957 _____ C:\Users\Mike\Downloads\FRST.txt
2015-08-10 22:46 - 2015-08-10 22:47 - 00000000 ____D C:\FRST
2015-08-10 22:44 - 2015-08-10 22:44 - 02171392 _____ (Farbar) C:\Users\Mike\Downloads\FRST64.exe
2015-08-10 22:44 - 2015-08-10 22:44 - 00000242 _____ C:\Users\Mike\Downloads\defogger_enable.log
2015-08-10 22:43 - 2015-08-10 22:43 - 00000470 _____ C:\Users\Mike\Downloads\defogger_disable.log
2015-08-10 22:40 - 2015-08-10 22:40 - 00050477 _____ C:\Users\Mike\Downloads\Defogger.exe
2015-08-10 22:11 - 2015-08-10 22:11 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Avira
2015-08-10 22:06 - 2015-07-15 08:37 - 00148632 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-08-10 22:06 - 2015-07-15 08:37 - 00137288 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-08-10 22:06 - 2015-07-15 08:37 - 00043576 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-08-10 22:06 - 2015-07-15 08:37 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-08-10 22:00 - 2015-08-10 22:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-08-10 22:00 - 2015-08-10 22:06 - 00000000 ____D C:\ProgramData\Avira
2015-08-10 22:00 - 2015-08-10 22:06 - 00000000 ____D C:\Program Files (x86)\Avira
2015-08-10 22:00 - 2015-08-10 22:00 - 00001216 _____ C:\Users\Public\Desktop\Avira.lnk
2015-08-10 21:52 - 2015-08-10 21:53 - 04721376 _____ (Avira Operations GmbH & Co. KG) C:\Users\Mike\Downloads\avira_de_av_55c900fce673a__ws.exe
2015-08-10 20:22 - 2015-08-10 22:37 - 00113880 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-08-10 20:21 - 2015-08-10 20:21 - 00001122 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-08-10 20:21 - 2015-08-10 20:21 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-08-10 20:21 - 2015-08-10 20:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-08-10 20:21 - 2015-08-10 20:21 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-08-10 20:21 - 2015-06-18 08:42 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-08-10 20:21 - 2015-06-18 08:41 - 00109272 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-08-10 20:21 - 2015-06-18 08:41 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-08-10 20:20 - 2015-08-10 20:21 - 24345872 _____ (Malwarebytes Corporation ) C:\Users\Mike\Downloads\mbam-setup-2.1.8.1057.exe
2015-08-10 20:18 - 2015-08-10 21:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-10 19:13 - 2015-08-10 19:13 - 00004270 _____ C:\Windows\System32\Tasks\ReimageUpdater
2015-08-10 19:13 - 2015-08-10 19:13 - 00000000 ____D C:\ProgramData\Reimage Protector
2015-08-10 19:12 - 2015-08-10 19:15 - 00000000 ____D C:\rei
2015-08-10 19:12 - 2015-08-10 19:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reimage Repair
2015-08-10 19:12 - 2015-08-10 19:13 - 00000000 ____D C:\Program Files\Reimage
2015-08-10 19:12 - 2015-08-10 19:12 - 00001921 _____ C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
2015-08-10 19:10 - 2015-08-10 21:38 - 00000148 _____ C:\Windows\Reimage.ini
2015-08-10 19:10 - 2015-08-10 19:10 - 00772016 _____ (Reimage®) C:\Users\Mike\Downloads\ReimageRepair.exe
2015-08-10 19:06 - 2015-08-10 18:23 - 00001345 _____ C:\Users\Mike\Desktop\SpyHunter.lnk
2015-08-08 21:31 - 2015-08-08 21:31 - 00000000 ____D C:\Users\Mike\AppData\Local\Macromedia
2015-08-08 21:27 - 2015-08-08 21:28 - 01187032 _____ (Adobe Systems Incorporated) C:\Users\Mike\Downloads\flashplayer18_ga_install.exe
2015-08-08 21:22 - 2015-08-08 21:22 - 00002190 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2015-08-08 21:22 - 2015-08-08 21:22 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus
2015-08-08 21:22 - 2015-08-08 21:22 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2015-08-08 21:22 - 2015-08-08 21:22 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2015-08-08 16:13 - 2015-08-08 16:20 - 00000000 ____D C:\Users\Mike\AppData\Local\Mozilla
2015-08-08 16:13 - 2015-08-08 16:13 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Mozilla
2015-08-08 16:12 - 2015-08-10 21:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-08 16:12 - 2015-08-10 21:08 - 00001167 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-08-08 16:12 - 2015-08-08 16:12 - 00001179 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-08-08 16:12 - 2015-08-08 16:12 - 00000000 ____D C:\ProgramData\Mozilla
2015-08-08 16:02 - 2015-08-08 16:02 - 00000000 _____ C:\autoexec.bat
2015-08-08 16:01 - 2015-08-08 16:01 - 00003320 _____ C:\Windows\System32\Tasks\SpyHunter4Startup
2015-08-08 16:01 - 2015-08-08 16:01 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Enigma Software Group
2015-08-08 16:01 - 2015-08-08 16:01 - 00000000 ____D C:\sh4ldr
2015-08-08 15:59 - 2015-08-08 15:59 - 00000000 ____D C:\Program Files\Enigma Software Group
2015-08-08 14:47 - 2015-06-25 04:31 - 04177920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-08 14:47 - 2015-06-16 07:36 - 01661576 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-08-08 14:47 - 2015-06-16 07:36 - 01212248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-08-08 14:47 - 2015-06-11 05:49 - 01380600 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-08-08 14:47 - 2015-06-10 18:13 - 01097216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-08-08 14:47 - 2015-05-11 20:17 - 01201664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bthport.sys
2015-08-08 14:47 - 2015-05-07 19:50 - 22292672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-08 14:47 - 2015-05-07 19:00 - 03109376 _____ (Microsoft Corporation) C:\Windows\system32\ExplorerFrame.dll
2015-08-08 14:47 - 2015-05-07 18:53 - 19734960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-08 14:47 - 2015-05-07 18:12 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ExplorerFrame.dll
2015-08-08 14:46 - 2015-06-28 07:07 - 00442712 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-08 14:46 - 2015-06-28 07:07 - 00178008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-08 14:46 - 2015-06-28 07:06 - 01311960 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-08 14:46 - 2015-06-28 07:06 - 00332120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-08 14:46 - 2015-06-27 18:42 - 00747520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-08 14:46 - 2015-06-27 05:13 - 00202240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-08 14:46 - 2015-06-27 05:12 - 00401408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-08 14:46 - 2015-06-27 05:12 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-08 14:46 - 2015-06-27 04:40 - 00445440 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-08-08 14:46 - 2015-06-27 04:05 - 01441792 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-08 14:46 - 2015-06-27 04:00 - 00989184 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-08 14:46 - 2015-06-27 03:53 - 00324096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-08-08 14:46 - 2015-06-27 03:26 - 00802816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-08 14:46 - 2015-06-16 00:41 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-08-08 14:46 - 2015-06-16 00:24 - 03320320 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-08-08 14:46 - 2015-06-15 23:16 - 00059904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-08-08 14:46 - 2015-06-15 23:09 - 03607552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-08-08 14:46 - 2015-06-15 22:50 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-08-08 14:46 - 2015-06-15 21:57 - 02460160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-08-08 14:46 - 2015-05-07 18:47 - 00564224 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-08-08 14:46 - 2015-04-23 17:47 - 03084288 _____ (Microsoft Corporation) C:\Windows\system32\msftedit.dll
2015-08-08 14:46 - 2015-04-23 17:16 - 02471424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msftedit.dll
2015-08-08 14:44 - 2015-07-09 21:51 - 00136904 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-08 14:44 - 2015-07-09 20:40 - 00359936 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-08 14:44 - 2015-07-09 18:03 - 03701760 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-08 14:44 - 2015-07-09 17:54 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-08 14:44 - 2015-07-09 17:53 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-08 14:44 - 2015-07-09 17:50 - 00409088 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2015-08-08 14:44 - 2015-07-09 17:50 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-08 14:44 - 2015-07-09 17:48 - 00891904 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-08 14:44 - 2015-07-09 17:46 - 02229248 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-08 14:44 - 2015-07-09 17:38 - 00029696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-08 14:44 - 2015-07-09 17:37 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-08 14:44 - 2015-07-09 17:35 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-08 14:44 - 2015-07-09 17:34 - 00721920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-08 14:44 - 2015-06-27 05:08 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-08 14:44 - 2015-06-27 05:08 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-08 14:44 - 2015-06-27 04:14 - 00027136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-08 14:42 - 2015-05-07 17:21 - 00522240 _____ (Microsoft Corporation) C:\Windows\system32\GeofenceMonitorService.dll
2015-08-08 14:42 - 2015-05-07 17:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\GeofenceMonitorService.dll
2015-08-08 14:42 - 2015-05-03 02:39 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2015-08-08 14:42 - 2015-04-30 01:22 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\WiFiDisplay.dll
2015-08-08 14:42 - 2015-04-28 15:13 - 00513480 _____ C:\Windows\SysWOW64\locale.nls
2015-08-08 14:42 - 2015-04-28 15:13 - 00513480 _____ C:\Windows\system32\locale.nls
2015-08-08 14:42 - 2014-11-04 21:25 - 00059712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdclass.sys
2015-08-08 14:42 - 2014-11-04 21:25 - 00051008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouclass.sys
2015-08-08 14:42 - 2014-11-04 08:55 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\sermouse.sys
2015-08-08 14:42 - 2014-11-04 08:54 - 00108544 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\i8042prt.sys
2015-08-08 14:42 - 2014-11-04 08:54 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\kbdhid.sys
2015-08-08 14:42 - 2014-11-04 08:54 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mouhid.sys
2015-08-08 14:40 - 2015-07-14 16:14 - 00358912 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-08 14:40 - 2015-07-14 16:14 - 00301056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-08 14:40 - 2015-07-14 16:14 - 00035840 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-08 14:40 - 2015-07-14 16:13 - 00044032 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-08 14:40 - 2015-05-30 23:18 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\werdiagcontroller.dll
2015-08-08 14:40 - 2015-05-30 21:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\AudioEndpointBuilder.dll
2015-08-08 14:40 - 2015-05-30 21:35 - 00911360 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-08-08 14:40 - 2015-05-03 17:09 - 00274944 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2015-08-08 14:40 - 2015-05-03 16:58 - 00210944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2015-08-08 14:40 - 2015-05-03 16:55 - 00971776 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2015-08-08 14:40 - 2015-05-03 16:49 - 00811008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2015-08-08 14:39 - 2015-05-11 18:34 - 00332800 _____ (Microsoft Corporation) C:\Windows\system32\fhcpl.dll
2015-08-08 14:39 - 2015-04-25 04:25 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2015-08-08 13:28 - 2015-08-08 13:28 - 00000061 _____ C:\Windows\wininit.ini
2015-08-08 08:23 - 2015-08-08 08:23 - 00000000 _____ C:\Windows\prleth.sys
2015-08-08 08:23 - 2015-08-08 08:23 - 00000000 _____ C:\Windows\hgfs.sys
2015-08-08 08:21 - 2015-08-09 19:56 - 00000000 ____D C:\Users\Mike\AppData\Local\SmartWeb
2015-08-08 08:21 - 2015-08-08 17:17 - 00000000 ____D C:\Users\Mike\AppData\Local\DBC284B4-85-405D-99A1-58BB63B0E92A
2015-08-06 20:51 - 2015-08-10 21:15 - 00000000 ____D C:\Program Files (x86)\Picexa
2015-08-06 20:51 - 2015-08-06 20:51 - 00000000 ____D C:\Users\Mike\AppData\Roaming\eCyber
2015-08-03 11:45 - 2015-08-08 12:57 - 00000000 ____D C:\Program Files (x86)\0ED37E05-1438595105-254F-89AF-00E0B89C8C3A
2015-08-03 11:45 - 2015-08-08 12:53 - 00000000 ____D C:\Users\Mike\AppData\Roaming\ASPackage
2015-08-03 11:45 - 2013-08-22 15:25 - 00000824 _____ C:\Windows\system32\Drivers\etc\hp.bak
2015-07-24 13:23 - 2015-08-10 21:18 - 00000000 ____D C:\Program Files (x86)\Elex-tech
2015-07-24 13:23 - 2015-08-10 21:15 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Elex-tech
2015-07-24 13:23 - 2015-07-24 13:23 - 00000000 ____D C:\Windows\system32\log
2015-07-15 19:37 - 2015-07-15 19:37 - 00687576 _____ (Opera Software) C:\Users\Mike\Downloads\Opera_NI_stable (2).exe
2015-07-15 19:30 - 2015-08-10 21:23 - 00000000 ____D C:\Program Files (x86)\WinZipper
2015-07-15 19:30 - 2015-07-24 13:22 - 00000000 ____D C:\Users\Mike\AppData\Roaming\WinZipper
2015-07-15 19:30 - 2015-07-15 19:30 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinZipper
2015-07-13 17:40 - 2015-07-13 17:40 - 00687064 _____ (Opera Software) C:\Users\Mike\Downloads\Opera_NI_stable (1).exe
2015-07-12 23:41 - 2015-07-12 23:41 - 00001137 _____ C:\Users\Mike\Desktop\Continue Live Installation.lnk

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-10 22:44 - 2015-02-16 15:06 - 00000000 ____D C:\Users\Mike
2015-08-10 22:07 - 2015-02-16 15:01 - 01137976 _____ C:\Windows\WindowsUpdate.log
2015-08-10 22:00 - 2014-08-29 20:53 - 00000000 ____D C:\ProgramData\Package Cache
2015-08-10 22:00 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\system32\sru
2015-08-10 21:22 - 2015-02-16 15:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-08-10 21:22 - 2015-02-16 15:15 - 00000000 ___RD C:\Users\Mike\OneDrive
2015-08-10 21:20 - 2014-03-18 11:54 - 00658546 _____ C:\Windows\PFRO.log
2015-08-10 21:20 - 2013-08-22 16:46 - 00038883 _____ C:\Windows\setupact.log
2015-08-10 21:20 - 2013-08-22 16:45 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-10 21:15 - 2014-08-29 21:17 - 00000000 ____D C:\Windows\Panther
2015-08-10 21:04 - 2015-02-16 15:13 - 00003598 _____ C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1580386797-2802970296-1791143644-1001
2015-08-10 20:52 - 2015-02-16 17:51 - 00000000 ____D C:\Users\Mike\AppData\Local\CrashDumps
2015-08-10 20:34 - 2015-02-18 12:34 - 00000000 ____D C:\ProgramData\4a17ae48464444a9a35f3c050c0e05b3
2015-08-10 20:19 - 2015-02-16 16:02 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-10 18:37 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\BBI
2015-08-10 18:17 - 2015-02-16 15:36 - 00003922 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{40AC6669-08D5-49C8-BEE3-4AEB450C3834}
2015-08-08 21:23 - 2015-02-16 16:01 - 00000000 ____D C:\Users\Mike\AppData\Local\Adobe
2015-08-08 21:22 - 2015-02-16 16:02 - 00003772 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-08 18:55 - 2013-08-22 16:44 - 00377224 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-08 18:51 - 2013-08-22 17:36 - 00000000 ___RD C:\Windows\ToastData
2015-08-08 18:51 - 2013-08-22 17:36 - 00000000 ____D C:\Windows\WinStore
2015-08-08 18:39 - 2013-08-22 17:20 - 00000000 ____D C:\Windows\CbsTemp
2015-08-08 18:08 - 2015-02-18 12:44 - 00000000 ____D C:\Windows\system32\MRT
2015-08-08 13:57 - 2015-02-28 14:53 - 00000000 ____D C:\Program Files (x86)\CHIP Updater
2015-08-08 13:34 - 2015-02-16 15:38 - 00000000 ____D C:\Program Files (x86)\Opera
2015-08-08 13:33 - 2015-02-16 15:39 - 00000000 ____D C:\Users\Mike\AppData\Local\Opera Software
2015-08-08 13:27 - 2015-02-16 15:39 - 00000000 ____D C:\Users\Mike\AppData\Roaming\Opera Software
2015-08-08 13:11 - 2015-02-16 15:08 - 00001458 _____ C:\Users\Mike\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-08-08 08:49 - 2013-08-22 15:25 - 00262144 ___SH C:\Windows\system32\config\ELAM
2015-07-14 19:19 - 2015-04-26 20:19 - 19198128 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2015-07-14 07:46 - 2011-06-11 02:58 - 00773968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2015-07-14 07:46 - 2011-06-11 02:58 - 00421200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2015-07-13 23:10 - 2015-06-15 21:59 - 00792568 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-13 23:10 - 2015-06-15 21:59 - 00178168 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-07-13 17:39 - 2015-02-22 12:29 - 00000000 __SHD C:\Users\Mike\AppData\Local\EmieBrowserModeList
2015-07-13 17:39 - 2015-02-16 15:36 - 00000000 __SHD C:\Users\Mike\AppData\Local\EmieUserList
2015-07-13 17:39 - 2015-02-16 15:36 - 00000000 __SHD C:\Users\Mike\AppData\Local\EmieSiteList

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2015-02-17 14:35 - 2015-02-17 14:36 - 0007680 _____ () C:\Users\Mike\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-11-24 00:59 - 2014-11-24 00:59 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
2015-02-18 12:49 - 2015-02-18 12:49 - 0001534 _____ () C:\ProgramData\ss.ini

Einige Dateien in TEMP:
====================
C:\Users\Mike\AppData\Local\Temp\avgnt.exe
C:\Users\Mike\AppData\Local\Temp\ReimagePackage.exe
C:\Users\Mike\AppData\Local\Temp\sqlite3.exe
C:\Users\Mike\AppData\Local\Temp\Uninstall.exe


==================== Bamital & volsnap Check =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-03 18:48

==================== Ende von log ============================
--- --- ---
Alt 12.08.2015, 21:58   #9
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - Standard

SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    AnySend

    Reimage Repair

    WinZipper

  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 

__________________
Logfiles bitte immer in CODE-Tags posten

Antwort

Themen zu SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren
computer, deinstalliere, deinstallieren, gestern, hallo zusammen, hoffe, installation, installier, installiert, lauter, malewarebytes, nicht mehr, panik, programm, scan, spyhunter, systems, systemsteuerung, tune up, versucht, verzweiflung, voller, win, zusammen, zusätzlich


« Wahrscheinliche infektion mit Trojaner, Information durch e-mail von t-online | TR/Patched.Ren.Gen2 immer von Avira gefunden - wie entferne ich diesen? »


Ähnliche Themen: SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren


  1. Spyhunter 4 läßt sich nicht deinstallieren
    Plagegeister aller Art und deren Bekämpfung - 06.04.2016 (42)
  2. Win 7 : Avira lässt sich nicht mehr öffnen und einschalten . Mir fehlen die Rechte zum deinstallieren.
    Log-Analyse und Auswertung - 14.08.2015 (20)
  3. Habe SpyHunter runtergeladen und kann nicht mehr deinstallieren
    Plagegeister aller Art und deren Bekämpfung - 25.06.2015 (27)
  4. WIN 7: Malewarebytes lässt sich nicht mehr deinstallieren bzw updaten
    Log-Analyse und Auswertung - 23.06.2015 (3)
  5. Windows 7 SpyHunter lässt sich nicht löschen
    Log-Analyse und Auswertung - 17.06.2015 (3)
  6. Spyhunter 4 lässt sich nicht deinstallieren
    Plagegeister aller Art und deren Bekämpfung - 09.02.2015 (16)
  7. Webssearches und Spyhunter 4 lässt sich nicht entfernen
    Log-Analyse und Auswertung - 11.01.2015 (9)
  8. Windows 7: Spyhunter lässt sich nicht mehr entfernen!
    Log-Analyse und Auswertung - 08.01.2015 (13)
  9. Spyhunter 4 lässt sich nicht total entfernen
    Plagegeister aller Art und deren Bekämpfung - 15.12.2014 (18)
  10. Avira Antivir lässt sich nicht mehr öffnen, deinstallieren oder neu herunterladen
    Log-Analyse und Auswertung - 02.06.2014 (59)
  11. Spyhunter lässt sich nicht entfernen
    Log-Analyse und Auswertung - 31.05.2014 (25)
  12. spyhunter lässt sich nicht entfernen
    Log-Analyse und Auswertung - 26.02.2014 (13)
  13. Spyhunter lässt sich nicht deinstallieren
    Plagegeister aller Art und deren Bekämpfung - 06.12.2013 (7)
  14. PC-Performer lässt sich nicht mehr deinstallieren
    Log-Analyse und Auswertung - 03.12.2013 (16)
  15. HDvid Codec V1 eingefangen, lässt sich nicht deinstallieren, Rechner hängt sich bei Beutzerwechsel auf
    Log-Analyse und Auswertung - 28.09.2013 (15)
  16. chatzum lässt sich nicht mehr deinstallieren
    Plagegeister aller Art und deren Bekämpfung - 11.10.2012 (1)
  17. AVG lässt sich nicht deinstallieren
    Log-Analyse und Auswertung - 24.05.2011 (3)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren - hallo zusammen, ich habe gestern voller panik spyhunter 4 installiert und jetzt lässt es sich nicht mehr deinstallieren. mit der systemsteuerung habe ich es versucht und mit tune up utillities - SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren...
Archiv
Du betrachtest: SPYHUNTER auf WIN 8.1 lässt sich nicht mehr deinstallieren auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19