Windows 7: Trojaner in Battlenet.dll

Cier78 · 12.08.2015, 10:05

AVIRA findet in letzter Zeit immer wieder die angeblich schädliche Datei TR/Crypt.EPACK.Gen2' [trojan]. Foren haben unterschiedliche Ergebnisse gebracht ob es ein Trojaner ist oder Avira nur spinnt. Vielen Dank

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:15 on 12/08/2015 (****)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

ATTFilter

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:11-08-2015 02
durchgeführt von ***** (Administrator) auf *****-PC (12-08-2015 10:16:36)
Gestartet von C:\Users\****\Downloads
Geladene Profile: **** (Verfügbare Profile: ****)
Platform: Windows 7 Professional Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Intel Corporation) C:\Windows\System32\igfxCUIService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Windows (R) Win 7 DDK provider) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\AdminService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Windows\SysWOW64\PnkBstrB.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Atheros Communications) C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Pixart Imaging Inc) C:\Windows\System32\TiltWheelMouse.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Blizzard Entertainment) C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe
(Blizzard Entertainment) C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Windows\System32\igfxEM.exe
(Intel Corporation) C:\Windows\System32\igfxHK.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\****\Downloads\Defogger.exe


==================== Registry (Nicht auf der Ausnahmeliste) ==================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2673296 2015-03-28] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2807024 2014-01-23] (Synaptics Incorporated)
HKLM\...\Run: [XboxStat] => C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe [825184 2009-09-30] (Microsoft Corporation)
HKLM\...\Run: [MouseDriver] => C:\Windows\system32\TiltWheelMouse.exe [241152 2012-12-19] (Pixart Imaging Inc)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [782008 2015-07-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [134368 2015-07-02] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer\Run: [BtvStack] => C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe [133760 2013-12-24] (Atheros Communications)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKU\S-1-5-21-2636122418-664884286-3338874239-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-2636122418-664884286-3338874239-1000 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-07-20] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-07-20] (Oracle Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{4EC4A7E3-3CB3-46F2-A54A-0F4293809B4D}: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{7EAF0E18-90A6-4944-9709-8C335E09BBD4}: [NameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\****\AppData\Roaming\Mozilla\Firefox\Profiles\bycmui4f.default-1415659434543
FF Homepage: google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_209.dll [2015-07-15] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_209.dll [2015-07-15] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-12-10] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-07-20] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-07-20] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-06-29] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2636122418-664884286-3338874239-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\****\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2014-07-07] (Unity Technologies ApS)
FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\bycmui4f.default-1415659434543\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-05-14]

Chrome: 
=======
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [887128 2015-07-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [461672 2015-07-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [461672 2015-07-25] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1213072 2015-07-25] (Avira Operations GmbH & Co. KG)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 AtherosSvc; C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\adminservice.exe [318592 2013-12-24] (Windows (R) Win 7 DDK provider) [Datei ist nicht signiert]
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [218816 2015-07-02] (Avira Operations GmbH & Co. KG)
S3 BEService; C:\Program Files (x86)\Common Files\BattlEye\BEService.exe [448384 2014-12-03] ()
S2 CGVPNCliService; C:\Program Files\CyberGhost 5\Service.exe [64624 2014-06-12] (CyberGhost S.R.L)
S3 Futuremark SystemInfo Service; C:\Program Files (x86)\Futuremark\SystemInfo\FMSISvc.exe [528096 2014-06-08] (Futuremark)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152144 2015-03-28] (NVIDIA Corporation)
R2 igfxCUIService1.0.0.0; C:\Windows\system32\igfxCUIService.exe [314696 2014-05-21] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-12-10] (Intel Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1878672 2015-03-28] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22995600 2015-03-28] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files (x86)\Origin\OriginClientService.exe [2004488 2015-07-09] (Electronic Arts)
S2 PinnacleUpdateSvc; C:\Program Files (x86)\PowerUp Software\Pinnacle Game Profiler\pinnacle_updater.exe [438272 2014-01-12] (PowerUp Software, LLC) [Datei ist nicht signiert]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2015-06-16] ()
R2 PnkBstrB; C:\Windows\SysWOW64\PnkBstrB.exe [107832 2015-06-16] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [162528 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [141416 2015-07-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-02] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 BTATH_LWFLT; C:\Windows\System32\DRIVERS\btath_lwflt.sys [77464 2013-12-24] (Qualcomm Atheros)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-09-02] (Disc Soft Ltd)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [100312 2013-12-10] (Intel Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-03-28] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [465624 2014-01-03] (Realsil Semiconductor Corporation)
R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [9101016 2013-12-10] (Realtek Semiconductor Corp.)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-01-23] (Synaptics Incorporated)
R3 t_mouse.sys; C:\Windows\System32\DRIVERS\t_mouse.sys [6144 2012-12-19] ()
S3 cpuz137; \??\C:\Windows\TEMP\cpuz137\cpuz137_x64.sys [X]
S3 GPUZ; \??\C:\Windows\TEMP\GPUZ.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-12 10:16 - 2015-08-12 10:16 - 02172928 _____ (Farbar) C:\Users\****\Downloads\FRST64.exe
2015-08-12 10:16 - 2015-08-12 10:16 - 00014510 _____ C:\Users\****\Downloads\FRST.txt
2015-08-12 10:16 - 2015-08-12 10:16 - 00000000 ____D C:\FRST
2015-08-12 10:15 - 2015-08-12 10:15 - 00000486 _____ C:\Users\****\Downloads\defogger_disable.log
2015-08-12 10:15 - 2015-08-12 10:15 - 00000000 _____ C:\Users\****\defogger_reenable
2015-08-12 10:14 - 2015-08-12 10:14 - 00050477 _____ C:\Users\****\Downloads\Defogger.exe
2015-08-07 15:42 - 2015-08-08 08:07 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-08-02 15:01 - 2015-08-02 15:01 - 01358858 _____ C:\Users\****\Downloads\Dark Souls - High-Res UI and Subtitles-21-1-211.rar
2015-08-02 14:58 - 2015-08-02 14:58 - 00029344 _____ C:\Users\****\Downloads\Morten242s UI for DSfix-45-1-5-1.zip
2015-08-02 14:55 - 2015-08-02 14:55 - 00392093 _____ C:\Users\****\Downloads\DSfix24.zip
2015-08-02 14:47 - 2015-08-02 14:47 - 00000000 ____D C:\Users\****\Documents\NBGI
2015-08-02 14:47 - 2015-08-02 14:47 - 00000000 ____D C:\Users\****\AppData\Local\NBGI
2015-08-01 10:09 - 2015-08-01 10:09 - 00000000 ____D C:\Users\****\Documents\NeocoreGames
2015-07-31 23:54 - 2015-07-31 23:54 - 00000000 ____D C:\Users\****\Documents\Hitman Blood Money
2015-07-28 16:51 - 2015-07-25 20:07 - 00017856 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-07-28 16:51 - 2015-07-25 20:04 - 00765440 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-07-28 16:51 - 2015-07-25 20:04 - 00726528 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-07-28 16:51 - 2015-07-25 20:03 - 01085440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-07-28 16:51 - 2015-07-25 20:03 - 00433664 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-07-28 16:51 - 2015-07-25 20:03 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-07-28 16:51 - 2015-07-25 20:03 - 00067584 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-07-28 16:51 - 2015-07-25 19:55 - 01145856 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-07-25 16:44 - 2015-07-25 16:44 - 00000000 ____D C:\Users\****\Tracing
2015-07-25 16:32 - 2015-08-09 00:34 - 00000000 ____D C:\Users\****\AppData\Roaming\Skype
2015-07-25 16:32 - 2015-07-25 16:32 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2015-07-25 16:32 - 2015-07-25 16:32 - 00000000 ___RD C:\Program Files (x86)\Skype
2015-07-25 16:32 - 2015-07-25 16:32 - 00000000 ____D C:\Users\****\AppData\Local\Skype
2015-07-25 16:32 - 2015-07-25 16:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2015-07-25 16:31 - 2015-07-25 16:32 - 00000000 ____D C:\ProgramData\Skype
2015-07-25 16:30 - 2015-07-25 16:30 - 01384064 _____ (Skype Technologies S.A.) C:\Users\****\Downloads\SkypeSetup.exe
2015-07-25 11:20 - 2015-07-25 11:23 - 00000000 ____D C:\Users\****\Desktop\Für iPhone
2015-07-25 11:17 - 2015-07-25 11:17 - 00001043 _____ C:\Users\Public\Desktop\MediaMonkey.lnk
2015-07-25 11:17 - 2015-07-25 11:17 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MediaMonkey
2015-07-25 11:17 - 2015-07-25 11:17 - 00000000 ____D C:\ProgramData\MediaMonkey
2015-07-25 11:17 - 2015-07-25 11:17 - 00000000 ____D C:\Program Files (x86)\MediaMonkey
2015-07-25 11:16 - 2015-07-25 11:16 - 15916768 _____ (Ventis Media Inc. ) C:\Users\****\Downloads\MediaMonkey_4.1.8.1751.exe
2015-07-25 10:38 - 2015-07-25 10:41 - 135072657 _____ C:\Users\****\Downloads\Portal2-OST-Volume-2.zip
2015-07-25 10:34 - 2015-07-25 10:36 - 164242463 _____ C:\Users\****\Downloads\Portal2-OST-Volume1.zip
2015-07-25 10:20 - 2015-07-25 11:17 - 175127388 _____ C:\Users\****\Downloads\Transistor.zip
2015-07-24 11:04 - 2015-07-24 11:04 - 00000000 ____D C:\Users\****\AppData\Local\CEF
2015-07-21 15:54 - 2015-07-15 05:19 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-07-21 15:54 - 2015-07-15 05:19 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-07-21 15:54 - 2015-07-15 05:19 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-07-21 15:54 - 2015-07-15 05:19 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-07-21 15:54 - 2015-07-15 04:55 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-07-21 15:54 - 2015-07-15 04:55 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-07-21 15:54 - 2015-07-15 04:55 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-07-21 15:54 - 2015-07-15 04:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-07-21 15:54 - 2015-07-15 03:59 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-07-21 15:54 - 2015-07-15 03:52 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-07-20 22:06 - 2015-07-20 22:06 - 02063070 _____ C:\Users\****\Downloads\EarthBound (USA).zip
2015-07-20 22:04 - 2015-07-20 23:21 - 00000000 ____D C:\Users\****\Desktop\Snes
2015-07-20 22:04 - 2015-07-20 22:04 - 02003610 _____ C:\Users\****\Downloads\snes9x-1.53-x64.zip
2015-07-20 19:43 - 2015-07-20 19:44 - 00000000 ____D C:\Users\****\AppData\Local\kaneandlynch
2015-07-20 17:52 - 2015-07-20 17:56 - 00000000 ____D C:\Users\****\Desktop\Jonas
2015-07-15 17:18 - 2015-07-09 19:58 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 02603008 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-07-15 17:18 - 2015-07-09 19:58 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-07-15 17:18 - 2015-07-09 19:58 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-07-15 17:18 - 2015-07-09 19:58 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-07-15 17:18 - 2015-07-09 19:43 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-07-15 17:18 - 2015-07-09 19:43 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-07-15 17:18 - 2015-07-09 19:43 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-07-15 17:18 - 2015-07-09 19:43 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-07-15 17:18 - 2015-07-09 19:42 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-07-15 17:18 - 2015-07-02 23:21 - 19877376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-07-15 17:18 - 2015-07-02 23:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-07-15 17:18 - 2015-07-02 22:50 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-07-15 17:18 - 2015-07-02 22:49 - 25193984 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-07-15 17:18 - 2015-07-02 22:46 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-07-15 17:18 - 2015-07-02 22:40 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-07-15 17:18 - 2015-07-02 22:23 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-07-15 17:18 - 2015-07-02 22:19 - 12855296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-07-15 17:18 - 2015-07-02 22:12 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-07-15 17:18 - 2015-07-02 21:55 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-07-15 17:18 - 2015-07-02 21:20 - 14453248 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-07-15 17:18 - 2015-07-02 20:59 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-07-15 17:18 - 2015-06-27 04:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-07-15 17:18 - 2015-06-27 04:43 - 05923840 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-07-15 17:18 - 2015-06-27 03:58 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-07-15 17:18 - 2015-06-27 03:39 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-07-15 17:18 - 2015-06-25 20:09 - 00389832 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-07-15 17:18 - 2015-06-25 19:43 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-07-15 17:18 - 2015-06-25 10:57 - 03207168 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-07-15 17:18 - 2015-06-20 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-07-15 17:18 - 2015-06-20 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-07-15 17:18 - 2015-06-20 21:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-07-15 17:18 - 2015-06-20 21:49 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-07-15 17:18 - 2015-06-20 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-07-15 17:18 - 2015-06-20 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-07-15 17:18 - 2015-06-20 21:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-07-15 17:18 - 2015-06-20 21:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-07-15 17:18 - 2015-06-20 21:34 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-07-15 17:18 - 2015-06-20 21:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-07-15 17:18 - 2015-06-20 21:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-07-15 17:18 - 2015-06-20 21:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-07-15 17:18 - 2015-06-20 21:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-07-15 17:18 - 2015-06-20 21:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-07-15 17:18 - 2015-06-20 21:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-07-15 17:18 - 2015-06-20 21:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-07-15 17:18 - 2015-06-20 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-07-15 17:18 - 2015-06-20 20:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-07-15 17:18 - 2015-06-20 20:48 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-07-15 17:18 - 2015-06-20 20:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-07-15 17:18 - 2015-06-20 20:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-07-15 17:18 - 2015-06-20 20:26 - 02427392 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-07-15 17:18 - 2015-06-20 20:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-07-15 17:18 - 2015-06-19 20:25 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-07-15 17:18 - 2015-06-19 20:25 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-07-15 17:18 - 2015-06-19 20:24 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-07-15 17:18 - 2015-06-19 20:24 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-07-15 17:18 - 2015-06-19 20:23 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-07-15 17:18 - 2015-06-19 20:17 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-07-15 17:18 - 2015-06-19 20:16 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-07-15 17:18 - 2015-06-19 20:13 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-07-15 17:18 - 2015-06-19 20:13 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-07-15 17:18 - 2015-06-19 20:03 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-07-15 17:18 - 2015-06-19 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-07-15 17:18 - 2015-06-19 19:53 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-07-15 17:18 - 2015-06-19 19:52 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-07-15 17:18 - 2015-06-19 19:51 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-07-15 17:18 - 2015-06-19 19:40 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-07-15 17:18 - 2015-06-19 19:40 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-07-15 17:18 - 2015-06-19 19:39 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-07-15 17:18 - 2015-06-19 19:15 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-07-15 17:18 - 2015-06-19 19:11 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-07-15 17:18 - 2015-06-17 19:47 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2015-07-15 17:18 - 2015-06-17 19:37 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2015-07-15 17:18 - 2015-06-09 20:03 - 03180544 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-07-15 17:18 - 2015-06-09 20:03 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-07-15 17:18 - 2015-06-02 02:07 - 00254976 _____ (Microsoft Corporation) C:\Windows\system32\cewmdm.dll
2015-07-15 17:18 - 2015-06-02 01:47 - 00210432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cewmdm.dll
2015-07-15 17:17 - 2015-07-04 20:07 - 02087424 _____ (Microsoft Corporation) C:\Windows\system32\ole32.dll
2015-07-15 17:17 - 2015-07-04 19:48 - 01414656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ole32.dll
2015-07-15 17:17 - 2015-07-01 22:56 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-07-15 17:17 - 2015-07-01 22:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-07-15 17:17 - 2015-07-01 22:49 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-07-15 17:17 - 2015-07-01 22:49 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-07-15 17:17 - 2015-07-01 22:48 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-07-15 17:17 - 2015-07-01 22:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-07-15 17:17 - 2015-07-01 22:47 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-07-15 17:17 - 2015-07-01 22:47 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-07-15 17:17 - 2015-07-01 22:43 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-07-15 17:17 - 2015-07-01 22:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-07-15 17:17 - 2015-07-01 22:39 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-07-15 17:17 - 2015-07-01 22:30 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-07-15 17:17 - 2015-07-01 22:29 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-07-15 17:17 - 2015-07-01 22:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-07-15 17:17 - 2015-07-01 22:29 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-07-15 17:17 - 2015-07-01 22:27 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-07-15 17:17 - 2015-07-01 22:26 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-07-15 17:17 - 2015-07-01 22:24 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-07-15 17:17 - 2015-07-01 21:27 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-07-15 17:17 - 2015-07-01 21:26 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-07-15 17:17 - 2015-07-01 21:26 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-07-15 17:17 - 2015-06-15 23:50 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2015-07-15 17:17 - 2015-06-15 23:45 - 03242496 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-07-15 17:17 - 2015-06-15 23:45 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2015-07-15 17:17 - 2015-06-15 23:45 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2015-07-15 17:17 - 2015-06-15 23:45 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2015-07-15 17:17 - 2015-06-15 23:44 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\msiexec.exe
2015-07-15 17:17 - 2015-06-15 23:43 - 02364416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2015-07-15 17:17 - 2015-06-15 23:43 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2015-07-15 17:17 - 2015-06-15 23:43 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2015-07-15 17:17 - 2015-06-15 23:42 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msiexec.exe
2015-07-15 17:17 - 2015-06-15 23:42 - 00025088 _____ (Microsoft Corporation) C:\Windows\system32\msimsg.dll
2015-07-15 17:17 - 2015-06-15 23:37 - 00025088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msimsg.dll
2015-07-15 17:17 - 2015-06-11 19:57 - 06131200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-07-15 17:17 - 2015-06-11 19:57 - 00856064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2015-07-15 17:17 - 2015-06-11 19:57 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-07-15 17:17 - 2015-06-11 19:56 - 07077376 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-07-15 17:17 - 2015-06-11 19:56 - 01057792 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2015-07-15 17:17 - 2015-06-11 19:56 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-07-15 17:17 - 2015-06-11 15:15 - 00429568 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2015-07-15 17:17 - 2015-04-27 21:23 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-07-15 17:17 - 2015-04-27 21:23 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-07-15 17:17 - 2015-04-27 21:23 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-07-15 17:17 - 2015-04-27 21:23 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-07-15 17:17 - 2015-04-27 21:05 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-07-15 17:17 - 2015-04-27 21:04 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-07-15 17:17 - 2015-04-27 21:04 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-07-15 17:17 - 2015-04-27 21:04 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-12 10:15 - 2015-04-11 21:17 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-12 10:15 - 2014-07-10 21:58 - 00000000 ____D C:\Users\****
2015-08-12 10:14 - 2014-07-11 21:01 - 00000000 ____D C:\Users\****\AppData\Local\Battle.net
2015-08-12 10:06 - 2009-07-14 06:45 - 00031984 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-12 10:06 - 2009-07-14 06:45 - 00031984 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-12 09:51 - 2014-07-10 21:55 - 01550165 _____ C:\Windows\WindowsUpdate.log
2015-08-12 09:47 - 2014-07-11 21:01 - 00000000 ____D C:\Program Files (x86)\Battle.net
2015-08-12 09:46 - 2015-04-01 17:53 - 00119296 _____ C:\Windows\SysWOW64\zlib.dll
2015-08-12 09:46 - 2014-07-10 17:10 - 00000372 _____ C:\Windows\Tasks\DriverToolkit Autorun.job
2015-08-12 09:46 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-12 09:46 - 2009-07-14 06:51 - 00110114 _____ C:\Windows\setupact.log
2015-08-10 17:42 - 2014-07-11 13:04 - 00000000 ____D C:\Program Files (x86)\Steam
2015-08-10 14:50 - 2014-07-10 22:20 - 00000000 ____D C:\Users\****\Documents\Bluetooth Folder
2015-08-09 20:12 - 2011-04-12 09:43 - 00699342 _____ C:\Windows\system32\perfh007.dat
2015-08-09 20:12 - 2011-04-12 09:43 - 00149450 _____ C:\Windows\system32\perfc007.dat
2015-08-09 20:12 - 2009-07-14 07:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-08 08:07 - 2014-11-11 01:05 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-08-08 08:07 - 2010-11-21 05:47 - 00519462 _____ C:\Windows\PFRO.log
2015-08-04 19:47 - 2015-01-15 14:35 - 00000000 ____D C:\Users\****\Desktop\Unterlagen Janine
2015-08-02 14:46 - 2014-07-10 20:58 - 00499958 _____ C:\Windows\DirectX.log
2015-08-01 17:28 - 2015-07-10 19:29 - 00000000 ___HD C:\$Windows.~BT
2015-08-01 16:53 - 2014-07-10 22:50 - 00000000 ____D C:\Windows\Panther
2015-08-01 15:33 - 2014-07-11 14:14 - 00000000 ____D C:\Users\****\Documents\My Games
2015-07-31 23:51 - 2014-08-30 17:29 - 00000000 ____D C:\Users\****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2015-07-31 21:33 - 2014-07-16 18:28 - 00000000 ____D C:\Users\****\AppData\Local\CrashDumps
2015-07-31 21:25 - 2009-07-14 07:32 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-07-30 19:10 - 2014-07-10 19:18 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-07-30 19:10 - 2014-07-10 16:44 - 00000000 ____D C:\ProgramData\Package Cache
2015-07-30 17:15 - 2014-07-11 21:02 - 00000000 ____D C:\Program Files (x86)\Hearthstone
2015-07-28 17:03 - 2014-07-10 20:43 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-07-25 15:16 - 2014-07-10 19:17 - 00162528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-07-25 15:16 - 2014-07-10 19:17 - 00141416 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-07-25 11:48 - 2014-08-31 15:45 - 00000000 ____D C:\Users\****\AppData\Roaming\MediaMonkey
2015-07-25 10:22 - 2015-04-04 18:45 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-24 17:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-07-22 12:39 - 2009-07-14 06:45 - 00316408 _____ C:\Windows\system32\FNTCACHE.DAT
2015-07-19 13:24 - 2014-07-14 15:52 - 00000000 ____D C:\ProgramData\Origin
2015-07-18 00:44 - 2015-04-04 18:45 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-07-18 00:44 - 2014-12-12 13:05 - 00000000 ____D C:\Windows\system32\appraiser
2015-07-18 00:44 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-07-17 14:17 - 2014-07-11 13:42 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-07-17 14:11 - 2014-07-10 19:48 - 00000000 ____D C:\Windows\system32\MRT
2015-07-16 11:56 - 2014-07-12 10:21 - 00002441 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-07-16 11:55 - 2015-01-03 11:31 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-07-15 17:15 - 2015-04-11 21:17 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-07-15 17:15 - 2014-07-10 21:41 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-07-15 17:15 - 2014-07-10 21:41 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

Einige Dateien in TEMP:
====================
C:\Users\****\AppData\Local\Temp\avgnt.exe
C:\Users\****\AppData\Local\Temp\WZCPlugin_VISTA.exe


==================== Bamital & volsnap Check =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-08 10:25

==================== Ende von Ergebnis ============================

Code:

ATTFilter

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:11-08-2015 02
durchgeführt von **** (2015-08-12 10:17:10)
Gestartet von C:\Users\****\Downloads
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-2636122418-664884286-3338874239-500 - Administrator - Disabled)
**** (S-1-5-21-2636122418-664884286-3338874239-1000 - Administrator - Enabled) => C:\Users\****
Gast (S-1-5-21-2636122418-664884286-3338874239-501 - Limited - Disabled)

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

3DMark 11 (HKLM-x32\...\{f9e83b9c-ab7e-4005-8f32-4ea69703a5e4}) (Version: 1.0.132.0 - Futuremark)
3DMark 11 (Version: 1.0.132.0 - Futuremark) Hidden
Adobe Connect 9 Add-in (HKU\S-1-5-21-2636122418-664884286-3338874239-1000\...\Adobe Connect 9 Add-in) (Version: 11.9.972.8 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.12) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.12 - Adobe Systems Incorporated)
Amazon Kindle (HKU\S-1-5-21-2636122418-664884286-3338874239-1000\...\Amazon Kindle) (Version:  - Amazon)
Apple Application Support (32-Bit) (HKLM-x32\...\{AFA1153A-F547-409B-B837-3A0D6C5A3FEC}) (Version: 3.1.3 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{D7B824DE-DA32-4772-9E5E-39C5158136A7}) (Version: 3.1.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{a5e00a72-db4a-4f77-8874-d1265b8fcd7e}) (Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.42.10415 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.12.408 - Avira Operations GmbH & Co. KG)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
BIT.TRIP Presents... Runner2: Future Legend of Rhythm Alien (HKLM-x32\...\Steam App 218060) (Version:  - Gaijin Games)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version:  - Gearbox Software)
Borderlands: The Pre-Sequel (HKLM-x32\...\Steam App 261640) (Version:  - 2K Australia)
Canon MP Navigator EX 1.2 (HKLM-x32\...\MP Navigator EX 1.2) (Version:  - )
Crawl (HKLM-x32\...\Steam App 293780) (Version:  - Powerhoof)
CyberGhost 5 (HKLM\...\CyberGhost 5_is1) (Version:  - CyberGhost S.R.L.)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.49.1.0356 - Disc Soft Ltd)
Dark Souls: Prepare to Die Edition (HKLM-x32\...\Steam App 211420) (Version:  - FromSoftware)
DayZ (HKLM-x32\...\Steam App 221100) (Version:  - Bohemia Interactive)
Dead Space™ 2 (HKLM-x32\...\{C549C2A2-574F-4ABC-933C-BD11D027C16A}) (Version: 1.0.941.0 - Electronic Arts)
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dolphin (HKLM-x32\...\Dolphin) (Version: 4.0.2 - Dolphin Development Team)
Dragon Age: Origins (HKLM-x32\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.05.0.0 - Electronic Arts)
Far Cry 2 (HKLM-x32\...\Steam App 19900) (Version:  - Ubisoft Montreal)
Fraps (HKLM-x32\...\Fraps) (Version:  - )
FTL: Faster Than Light (HKLM-x32\...\Steam App 212680) (Version:  - Subset Games)
Futuremark SystemInfo (HKLM-x32\...\{4115C9AA-35E0-45D8-9363-47635B8750C7}) (Version: 4.29.438.0 - Futuremark)
Gang Beasts (HKLM-x32\...\Steam App 285900) (Version:  - Boneloaf)
Gone Home (HKLM-x32\...\Steam App 232430) (Version:  - The Fullbright Company)
HD Webcam (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.2.9200.10253 - Realtek Semiconductor Corp.)
Hearthstone (HKLM-x32\...\Hearthstone) (Version:  - Blizzard Entertainment)
Heroes of the Storm (HKLM-x32\...\Heroes of the Storm) (Version:  - Blizzard Entertainment)
Heroes of the Storm Public Test (HKLM-x32\...\Heroes of the Storm Public Test) (Version:  - Blizzard Entertainment)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.23.1766 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3621 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.3.34 - Intel Corporation)
Invisible, Inc. (HKLM-x32\...\Steam App 243970) (Version:  - Klei Entertainment)
iTunes (HKLM\...\{93F2A022-6C37-48B8-B241-FFABD9F60C30}) (Version: 12.1.2.27 - Apple Inc.)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
MediaMonkey 4.1 (HKLM-x32\...\MediaMonkey_is1) (Version: 4.1 - Ventis Media Inc.)
Mercenary Kings (HKLM-x32\...\Steam App 218820) (Version:  - Tribute Games Inc.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{59E4543A-D49D-4489-B445-473D763C79AF}) (Version: 2.0.672.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-001B-0000-0000-0000000FF1CE}_WordR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Word 2007 (HKLM-x32\...\WordR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.21005 (HKLM-x32\...\{7f51bdb9-ee21-49ee-94d6-90afc321780e}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
Microsoft XNA Framework Redistributable 3.1 (HKLM-x32\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM-x32\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Mount Your Friends (HKLM-x32\...\Steam App 296470) (Version:  - Stegersaurus Software Inc.)
Mozilla Firefox 39.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0.3 (x86 de)) (Version: 39.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1 - Mozilla)
Nidhogg (HKLM-x32\...\Steam App 94400) (Version:  - Messhof)
NVIDIA GeForce Experience 2.4.1.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.1.21 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.88 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
One Finger Death Punch (HKLM-x32\...\Steam App 264200) (Version:  - Silver Dollar Games)
OpenAL (HKLM-x32\...\OpenAL) (Version:  - )
OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Origin (HKLM-x32\...\Origin) (Version: 9.4.11.2806 - Electronic Arts, Inc.)
PAYDAY 2 (HKLM-x32\...\Steam App 218620) (Version:  - OVERKILL - a Starbreeze Studio.)
Pinnacle Game Profiler (HKLM-x32\...\{49BF48CC-ABB6-4795-9B35-B5DE005D8612}) (Version: 8.1.3 - PowerUp Software)
Project 64 version 2.1.0.1 (HKLM-x32\...\Project 64_is1) (Version: 2.1.0.1 - )
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.986 - Even Balance, Inc.)
Quake Live (HKLM-x32\...\Quake Live) (Version:  - id Software)
Qualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.1.314 - Qualcomm Atheros Communications)
Qualcomm Atheros WLAN and Bluetooth Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 12.23 - Qualcomm Atheros)
Rayman Legends (HKLM-x32\...\Steam App 242550) (Version:  - )
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.3.273.37 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.80.218.2014 - Realtek)
resident evil 4 / biohazard 4 (HKLM-x32\...\Steam App 254700) (Version:  - Capcom)
Rockstar Games Social Club (HKLM-x32\...\Rockstar Games Social Club) (Version: 1.1.5.8 - Rockstar Games)
SecureW2 EAP Suite 1.1.3 for Windows (HKLM-x32\...\SecureW2 EAP Suite) (Version:  - )
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.1.21 - NVIDIA Corporation) Hidden
Skype™ 7.7 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.7.102 - Skype Technologies S.A.)
Sonic & All-Stars Racing Transformed (HKLM-x32\...\Steam App 212480) (Version:  - Sumo Digital)
Sportsfriends (HKLM-x32\...\Steam App 277850) (Version:  - Die Gute Fabrik)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)
Startfenster (HKLM-x32\...\Startfenster) (Version:  - Startfenster)
Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 18.0.9.0 - Synaptics Incorporated)
TAP-Windows 9.9.2 (HKLM\...\TAP-Windows) (Version: 9.9.2 - )
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
Teleglitch: Die More Edition (HKLM-x32\...\Steam App 234390) (Version:  - Test3 Projects)
The Binding of Isaac: Rebirth (HKLM-x32\...\Steam App 250900) (Version:  - Nicalis, Inc.)
The Incredible Adventures of Van Helsing (HKLM-x32\...\Steam App 215530) (Version:  - NeocoreGames)
Titanfall™ (HKLM-x32\...\{347EE0C3-0690-48F6-A231-53853C2A80D6}) (Version: 1.0.10.1 - Electronic Arts)
TowerFall Ascension (HKLM-x32\...\Steam App 251470) (Version:  - Matt Thorson)
Trials Fusion (HKLM-x32\...\Uplay Install 297) (Version:  - Ubisoft)
Unity Web Player (HKU\S-1-5-21-2636122418-664884286-3338874239-1000\...\UnityWebPlayer) (Version: 4.5.2f1 - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-001B-0000-0000-0000000FF1CE}_WordR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_WordR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Uplay (HKLM-x32\...\Uplay) (Version: 4.4 - Ubisoft)
Valkyria Chronicles™ (HKLM-x32\...\Steam App 294860) (Version:  - SEGA)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Winamp (HKLM-x32\...\Winamp) (Version: 5.666  - Nullsoft, Inc)
WinRAR 5.10 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-2636122418-664884286-3338874239-1000_Classes\CLSID\{820D63D5-8CFF-46DE-86AF-4997DEDD6DB5}\localserver32 -> C:\Windows\system32\igfxEM.exe (Intel Corporation)

==================== Wiederherstellungspunkte =========================

02-08-2015 14:44:55 DirectX wurde installiert
04-08-2015 15:04:13 Windows Update
08-08-2015 16:49:37 Windows Update

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {060F1291-8CF8-4E4C-AA21-054405E6494D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {37134F21-76AC-4CF4-80A7-C0C67AA962BD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-07-15] (Adobe Systems Incorporated)
Task: {38DF05AF-36EA-46B2-A639-80FF598B153F} - System32\Tasks\DriverToolkit Autorun => C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe
Task: {4FA7504F-9F06-4FDC-B195-C72660B36B43} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {670CC824-2200-43BB-9783-1DB2F5E22DF2} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe [2014-06-24] (Safer-Networking Ltd.)
Task: {6D878F80-C27E-4049-B635-9C05B286D6DB} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe [2014-06-27] (Safer-Networking Ltd.)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DriverToolkit Autorun.job => C:\Program Files (x86)\DriverToolkit\DriverToolkit.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-04-09 13:15 - 2015-03-13 18:16 - 00118472 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-03-20 18:12 - 2015-03-20 18:12 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-04-09 13:06 - 2015-03-13 21:41 - 00011920 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2014-10-16 20:00 - 2015-06-16 19:13 - 00066872 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2014-10-16 20:00 - 2015-06-16 19:14 - 00107832 _____ () C:\Windows\SysWOW64\PnkBstrB.exe
2013-12-24 02:20 - 2013-12-24 02:20 - 00086016 _____ () C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\Modules\Map\MAP.dll
2015-08-12 10:14 - 2015-08-12 10:14 - 00050477 _____ () C:\Users\****\Downloads\Defogger.exe
2014-07-10 17:25 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-07-10 17:25 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-07-10 17:25 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-07-10 17:25 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-07-10 17:25 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2015-04-09 12:58 - 2015-03-28 05:45 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2015-04-09 13:06 - 2015-03-13 21:41 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 26065408 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\libcef.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00739840 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\libGLESv2.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00909312 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\platforms\qwindows.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00130048 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\libEGL.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00020992 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\imageformats\qgif.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00021504 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\imageformats\qico.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00205312 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\imageformats\qjpeg.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00225792 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\imageformats\qmng.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00015872 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\imageformats\qsvg.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00312832 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\imageformats\qtiff.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00010240 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\qml\QtQuick.2\qtquick2plugin.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00054272 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\qml\QtQuick\Layouts\qquicklayoutsplugin.dll
2015-08-11 19:53 - 2015-08-11 19:54 - 00010240 _____ () C:\Program Files (x86)\Battle.net\Battle.net.6075\qml\QtQml\Models.2\modelsplugin.dll
2014-07-10 18:23 - 2013-12-10 08:27 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:DocumentSummaryInformation
AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:SummaryInformation
AlternateDataStreams: C:\Windows\SysWOW64\zlib.dll:{4c8cc155-6c1e-11d1-8e41-00c04fb9386d}

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-2636122418-664884286-3338874239-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\****\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\startupreg: CyberGhost => "C:\Program Files\CyberGhost 5\CyberGhost.EXE" /autostart
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: RtsCM => RTSCM64.EXE
MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"
MSCONFIG\startupreg: Skype => "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: USB3MON => "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{72DB46A2-E6F4-4B65-B55B-4B59906E9CC1}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{CFE5E957-EE84-446D-B557-642DAC8219C5}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{B43C4776-1550-4443-95CD-0BEA40691C2A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{EF6BBB88-8809-4919-8879-D69BFFADFAA7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{76E0C846-8F8F-4DAC-8C58-4C60ED60827A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{ADD3D5A9-A6B7-4CF9-9240-C57FF7B46D26}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{C60B5757-9F2C-42DA-8C1F-B18C163CA866}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{680EBEBB-F570-4953-AFDD-DF1A771737C0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{1F4948B4-38D3-49DC-AD7B-BB64756E609A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dishonored\Binaries\Win32\Dishonored.exe
FirewallRules: [{BFEA709A-8DEF-4183-98AE-05EB705E1CED}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dishonored\Binaries\Win32\Dishonored.exe
FirewallRules: [{7DA2CE04-11E2-4973-8636-3821E777CF33}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Warframe.exe
FirewallRules: [{F79A66DA-D511-44CE-AC95-6D9D8D98AC8E}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Warframe.x64.exe
FirewallRules: [{C8FC52F2-BE3C-41E0-80F5-15BFDE47E223}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Warframe.exe
FirewallRules: [{9AAB507B-0059-4B82-9373-4E38C9451175}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Warframe.x64.exe
FirewallRules: [{B5401BA4-D2BF-4653-80A9-1D7CDC0D5398}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Warframe.exe
FirewallRules: [{39FB097A-4FE6-4A75-A03A-977845E6B384}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Warframe.x64.exe
FirewallRules: [{D009C7FE-C518-4353-9A17-C74C6A3DF05E}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Tools\Launcher.exe
FirewallRules: [{4B260A93-809A-408A-986F-6CBEB5AED6A8}] => (Allow) C:\Users\****\AppData\Local\Warframe\Downloaded\Public\Tools\RemoteCrashSender.exe
FirewallRules: [{81E024B4-5286-44D6-9B58-9E0E1D4EB8A6}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe
FirewallRules: [{16A6C8E6-995C-43E7-8BD0-CB64699006A4}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3109\Agent.exe
FirewallRules: [{779ACE37-E020-4E9B-AB1C-4C8F91F7BED3}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{0A5DFDAC-C8FD-4CA1-9A88-62FFAC742602}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{52D62567-3633-4429-8FBC-E11DAEBEA283}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [{475858BE-A8FD-4861-AAA6-E6E2CCFE592A}] => (Allow) C:\Program Files (x86)\Hearthstone\Hearthstone.exe
FirewallRules: [TCP Query User{84C70365-B228-423F-9632-DC77173A036A}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [UDP Query User{88BD34F0-689D-4593-9D9D-3ADD478E0B2E}C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\the witcher 2\bin\witcher2.exe
FirewallRules: [{62D02B34-041F-4CC2-B616-864185BB262C}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{585DE818-B8ED-4DD0-8AB2-12871B468976}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3147\Agent.exe
FirewallRules: [{3FAB8FD6-0B70-4D64-A97D-D5BC675AC50D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{2A7E2AA8-C583-46E5-9257-93CFBA3B480A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\FTL Faster Than Light\FTLGame.exe
FirewallRules: [{A4922D56-DB08-4B14-9ED6-D539768570A8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{5EDFBA0A-E2D8-4BB6-B6C3-D4CE846EF503}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3182\Agent.exe
FirewallRules: [{B9293C87-1ABD-449F-9DFA-BAC989CE0ADB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{E1564D0D-400C-43F8-A057-CB0DFAB5D57A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{5575F337-6D5B-43A0-8774-2CD2C0D078AB}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{0FC58392-6B24-4DD1-8EE7-4494EA10E94C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{E05551F3-F645-47C3-8001-D3A696A3F983}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{F2F3D34E-CDBF-4A86-8C64-BD8BB3764E51}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3235\Agent.exe
FirewallRules: [{D61CA0F2-DB5B-4874-A833-732BBB82D4AE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\mark_of_the_ninja\bin\game.exe
FirewallRules: [{BDBBBC30-F018-4BF4-80E1-DB0C2A13CC87}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\mark_of_the_ninja\bin\game.exe
FirewallRules: [{C39DB5F5-8358-4EEE-AF5E-DAE558A9EB7E}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{73B7DF93-788F-45EB-ADF9-B9FBB2A628F0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{035A6800-2846-4656-9BA2-A4E7DAF3FA3A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Deadlight\Binaries\Win32\LOTDGame.exe
FirewallRules: [{2A7C6C32-2708-4F39-97F7-24C2A63DC6C3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Deadlight\Binaries\Win32\LOTDGame.exe
FirewallRules: [{A55FED24-7C8C-462B-AB35-F54612D65FF5}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [{2DB4BC4D-FAB6-4338-9D7B-E46FF94D5265}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3286\Agent.exe
FirewallRules: [TCP Query User{CAFC890D-2059-4EB7-B06B-69393D6613BD}C:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe] => (Allow) C:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe
FirewallRules: [UDP Query User{E1C7A9FD-796D-436B-8DE4-74B71F0A5B1A}C:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe] => (Allow) C:\program files (x86)\mediamonkey\mediamonkey (non-skinned).exe
FirewallRules: [TCP Query User{D9D51810-0670-44FB-855B-C7913208A89C}C:\program files (x86)\ea games\mohaa\mohaa.exe] => (Allow) C:\program files (x86)\ea games\mohaa\mohaa.exe
FirewallRules: [UDP Query User{CA3278AF-F608-40D8-8DD8-6C8B5812EE22}C:\program files (x86)\ea games\mohaa\mohaa.exe] => (Allow) C:\program files (x86)\ea games\mohaa\mohaa.exe
FirewallRules: [{3E113DA5-C499-4E8A-AB7B-F13860BB8E74}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\bittriprunner2\runner2.exe
FirewallRules: [{12D90F95-0D6C-4C37-9A83-48719481CAB3}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\bittriprunner2\runner2.exe
FirewallRules: [{21B5D562-8D5A-4E30-91BD-E01D2E411665}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\TeleglitchDME\Teleglitch.exe
FirewallRules: [{BD72D3AC-C497-40DF-8633-7072E4506D53}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\TeleglitchDME\Teleglitch.exe
FirewallRules: [{967F02CE-1E26-4502-943F-82D19555FEFA}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{D18D38AD-69BA-42E0-B085-390B7CD8BE27}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3334\Agent.exe
FirewallRules: [{74BF3C59-FE36-4663-9F93-3DE3A8B1905D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Nidhogg\Nidhogg.exe
FirewallRules: [{5132ACD1-A18C-49DF-9F7F-86FBF4B55C7B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Nidhogg\Nidhogg.exe
FirewallRules: [{02ED5B60-931C-4FC4-99AB-40C1593348C0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil 4\Bin32\bio4.exe
FirewallRules: [{C5C65761-4E1A-40FB-BAEE-5B64114AD10E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Resident Evil 4\Bin32\bio4.exe
FirewallRules: [{282203A1-33A1-445B-914B-C86057E4848A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{9F1252F5-F65A-4903-B53A-79C27179E409}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3372\Agent.exe
FirewallRules: [{537AE8A0-37E1-4286-82F5-5A94C37141D4}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{4E784C88-9240-42F2-8A78-5C5A51DC8B3A}] => (Allow) C:\Program Files (x86)\Origin Games\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [TCP Query User{72873A95-7D61-48F7-8523-FD197D7267E8}C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3.exe] => (Block) C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3.exe
FirewallRules: [UDP Query User{889F8073-0AE2-4BCD-A6BC-49B5C9FA1F9F}C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3.exe] => (Block) C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3.exe
FirewallRules: [TCP Query User{CE2F287B-7FDC-477D-A719-3BC62D5CAC26}C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3_d3d11.exe] => (Allow) C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3_d3d11.exe
FirewallRules: [UDP Query User{A2327A9C-2B8F-4F4A-BEE6-4F0F0E98EFCA}C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3_d3d11.exe] => (Allow) C:\program files (x86)\ubisoft\ubisoft game launcher\games\far cry 3\bin\farcry3_d3d11.exe
FirewallRules: [{D8B1DA3C-AA39-4D29-AA81-8839064F744C}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [{51576DBB-6B38-451A-9E64-535F448DDD93}] => (Allow) C:\Program Files (x86)\Winamp\winamp.exe
FirewallRules: [TCP Query User{66997A15-FC6E-40CD-A676-10EE407CAC45}C:\users\****\desktop\openarena-0.8.8\openarena-0.8.8\openarena.exe] => (Allow) C:\users\****\desktop\openarena-0.8.8\openarena-0.8.8\openarena.exe
FirewallRules: [UDP Query User{E69D7D50-B7B0-431A-921C-12A631798024}C:\users\****\desktop\openarena-0.8.8\openarena-0.8.8\openarena.exe] => (Allow) C:\users\****\desktop\openarena-0.8.8\openarena-0.8.8\openarena.exe
FirewallRules: [TCP Query User{73FBA924-D280-4374-A13F-745760417121}C:\users\****\desktop\warcraft (clean)\war3.exe] => (Allow) C:\users\****\desktop\warcraft (clean)\war3.exe
FirewallRules: [UDP Query User{0EEF3E5B-DE6F-40AF-8005-733F74716442}C:\users\****\desktop\warcraft (clean)\war3.exe] => (Allow) C:\users\****\desktop\warcraft (clean)\war3.exe
FirewallRules: [{B7702FA6-2FE5-4C34-AB37-3620A2821933}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{A5ECE178-3F8C-4783-B56D-56A5439DF3B5}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3526\Agent.exe
FirewallRules: [{A96E43B8-4440-44A6-818B-47C0D6F6387A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{9DB102DB-F8B0-48AA-BFB5-D4EF6ABDAF28}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ.exe
FirewallRules: [{A8F73D6E-837A-42EA-B67E-A6F3E4AB2712}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sonic & All-Stars Racing Transformed\ASN_App_PcDx9_Final.exe
FirewallRules: [{087B2463-B831-498C-A242-3A867BCD8FF0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sonic & All-Stars Racing Transformed\ASN_App_PcDx9_Final.exe
FirewallRules: [{EC89C24A-B6BC-42F7-BCA2-88FAE54D9A3F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sonic & All-Stars Racing Transformed\Launcher.exe
FirewallRules: [{6049C2BA-1943-4A61-BF9A-B05F892AB0C6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sonic & All-Stars Racing Transformed\Launcher.exe
FirewallRules: [{F8AEC442-B3AD-4383-80EE-2E5D4715622C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{F8DFC269-2C98-4F6D-A046-883EB97CF35E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\DayZ\DayZ_BE.exe
FirewallRules: [{905D4E43-0DC7-4456-BDB5-00DE42D25157}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\mercenary_kings\MercenaryKings.exe
FirewallRules: [{60AAAB5B-38E3-4184-83F5-31B6BB70D001}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\mercenary_kings\MercenaryKings.exe
FirewallRules: [{23B7D32E-6ED9-4C07-8B23-7248D8E3D3D0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\TowerFall\TowerFall.exe
FirewallRules: [{78749559-E88B-45E0-AC85-B010116BDDFF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\TowerFall\TowerFall.exe
FirewallRules: [{F2625EF2-1A33-4084-A009-361739D50648}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\PAYDAY 2\payday2_win32_release.exe
FirewallRules: [{E89CE452-AC02-4BDB-919F-A24631C44A3B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\PAYDAY 2\payday2_win32_release.exe
FirewallRules: [{761B8E45-5F6D-40A6-91DF-468C5691A36D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mount Your Friends\MountYourFriends.exe
FirewallRules: [{6DD87F0E-ADBE-4288-80F6-60D2E9A15A2D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Mount Your Friends\MountYourFriends.exe
FirewallRules: [{584C2F8E-F56B-4C3B-95B1-647063DC6B0E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{E8A80132-C153-4696-9C67-2399AFA8790F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{DEA70D9E-262F-4B86-97EC-4468D2370293}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Valkyria Chronicles\Launcher.exe
FirewallRules: [{485D3639-C749-45DB-9A80-F250FE4063A6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Valkyria Chronicles\Launcher.exe
FirewallRules: [{6DE1C6BC-A007-4430-91FD-4E1A775A03F5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dark Forces\DosBox\dosbox.exe
FirewallRules: [{A55F3118-E595-4B52-AB0C-5B0413233DB8}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dark Forces\DosBox\dosbox.exe
FirewallRules: [{8A00D1BE-E0E0-481F-9942-63310BDC7618}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Gang Beasts\Gang Beasts.exe
FirewallRules: [{ABDCC71A-F3FA-491E-A7B8-D2EF47CD65BF}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Gang Beasts\Gang Beasts.exe
FirewallRules: [{746E8CE7-3275-4EDA-BCB7-8115DC1D62D5}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{BBCBB99A-733C-41FF-A40A-4813D842792E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\ShadowOfMordor\x64\ShadowOfMordor.exe
FirewallRules: [{CB7879FC-31BB-4FA7-9D5D-8A23EC11434F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Crawl\Crawl.exe
FirewallRules: [{B9FA9312-067A-490A-A5B8-C33FCC3AACDC}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Crawl\Crawl.exe
FirewallRules: [{B4F08692-2F54-42E8-A4C1-8B735D3D034E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\tbs\win32\The Banner Saga.exe
FirewallRules: [{2623A11C-FCD1-4BE6-9D91-A400FD1EB18C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\tbs\win32\The Banner Saga.exe
FirewallRules: [{DD19961C-2061-4F72-A354-5E541B72187A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sportsfriends\Sportsfriends.exe
FirewallRules: [{AE4C4430-02CB-4488-873E-E36323231930}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Sportsfriends\Sportsfriends.exe
FirewallRules: [TCP Query User{EF95B2EC-275A-4DC8-8A5D-113A3B26D1CE}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{A9198FD5-4C07-4C3E-AB68-C31E8017510B}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [{B5E5A389-47B5-42C9-A8AF-65B51C873B56}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{9169872B-A68D-4B42-BAE0-06BCB8AAA8CB}] => (Allow) C:\Program Files (x86)\Diablo III\Diablo III.exe
FirewallRules: [{A251F5F7-9040-47AD-AD6F-BDF438751666}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Joe Danger 2 The Movie\Bin\JD2Launcher.exe
FirewallRules: [{8F0F4759-B828-48F3-8A72-D5458E40D824}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Joe Danger 2 The Movie\Bin\JD2Launcher.exe
FirewallRules: [{2D0B2426-6D56-4974-B24A-957D2F5D7650}] => (Allow) C:\Program Files (x86)\Origin Games\Titanfall\Titanfall.exe
FirewallRules: [{978FA86A-3397-4A5A-A44C-CB67E1E063D8}] => (Allow) C:\Program Files (x86)\Origin Games\Titanfall\Titanfall.exe
FirewallRules: [{A58E0418-85A2-464D-859C-A94EA54D7A21}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dark Souls II\Game\DarkSoulsII.exe
FirewallRules: [{3E6BFA2C-F530-4F52-AB70-B2B37F777E65}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dark Souls II\Game\DarkSoulsII.exe
FirewallRules: [{424BC734-00B0-462A-B1C1-0B4025B8ACCE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\InvisibleInc\invisibleinc.exe
FirewallRules: [{945B8C4A-3247-403E-B63B-EABEAC26D30D}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\InvisibleInc\invisibleinc.exe
FirewallRules: [{CC036013-BC6D-4F60-B68A-3EC2143BA476}] => (Allow) C:\Program Files (x86)\Origin Games\Dead Space 2\deadspace2.exe
FirewallRules: [{35E8C85F-F6CD-416F-8145-19104F537381}] => (Allow) C:\Program Files (x86)\Origin Games\Dead Space 2\deadspace2.exe
FirewallRules: [{4DFBDF47-8D27-448B-9E56-2EA2B3AA91FD}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\games\Trials Fusion\datapack\trials_fusion.exe
FirewallRules: [{787496CC-D550-480F-AFBF-4BE5F70EED14}] => (Allow) C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\games\Trials Fusion\datapack\trials_fusion.exe
FirewallRules: [{C6A4A020-13A1-4A93-A0D1-98E4A0258DDA}] => (Allow) C:\Users\****\Desktop\Halo\OracleNetClient.exe
FirewallRules: [{5EE4D296-7D19-4936-A400-5B31BD070F39}] => (Allow) C:\Users\****\Desktop\Halo\OracleNetClient.exe
FirewallRules: [{85CC1E9F-5582-480E-BB55-B87E92121657}] => (Allow) LPort=500
FirewallRules: [{2ACEAF41-4D8A-4AA6-BD39-27EA5BCF562C}] => (Allow) LPort=1701
FirewallRules: [{D9FEA52E-B1CF-4A1D-B3B2-65DA71A018E3}] => (Allow) LPort=4500
FirewallRules: [TCP Query User{301770A8-0D24-4874-89AF-D51D2CA4BC17}C:\users\****\desktop\halo\eldorado.exe] => (Allow) C:\users\eric rinnelt\desktop\halo\eldorado.exe
FirewallRules: [UDP Query User{6B4AEAED-F9D5-46E7-82C6-8AEBBFC7E4A4}C:\users\****\desktop\halo\eldorado.exe] => (Allow) C:\users\eric rinnelt\desktop\halo\eldorado.exe
FirewallRules: [{3FB9AD9C-A633-43FA-A812-931FB87CEB49}] => (Block) C:\users\****\desktop\halo\eldorado.exe
FirewallRules: [{14099345-DD3A-4AA8-B167-456415C9D406}] => (Block) C:\users\****\desktop\halo\eldorado.exe
FirewallRules: [{3C5010DC-207A-4165-9A78-6F928B8F61E7}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{5869EEAC-C4FF-475E-A650-05086AAB6FB4}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{8F8C5162-6308-4B0A-9B9F-31DD462AB91F}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{42EC8D54-FB6E-4487-832B-EE38366486B8}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{969265AE-8FA4-40A3-92EF-8A87EC4BD332}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [TCP Query User{0320421B-35F7-463F-B1D7-3B884F92EFEB}C:\program files (x86)\heroes of the storm public test\versions\base34880\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm public test\versions\base34880\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{C0FE08A6-EAB5-42C5-B91B-C7322A13B080}C:\program files (x86)\heroes of the storm public test\versions\base34880\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm public test\versions\base34880\heroesofthestorm_x64.exe
FirewallRules: [TCP Query User{44392CE5-7E4A-4C50-9E5F-9856BE62DCD8}C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm_x64.exe
FirewallRules: [UDP Query User{EE95CE41-6F8D-4ADD-BEB3-1C9836AEF50A}C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm_x64.exe] => (Allow) C:\program files (x86)\heroes of the storm\versions\base35702\heroesofthestorm_x64.exe
FirewallRules: [{95AAF32F-3ADC-418B-ACF9-3F7A832C2514}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FarCry2.exe
FirewallRules: [{65CFAA5B-BD4F-41B0-9730-34F9722BEF6E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FarCry2.exe
FirewallRules: [{92AE35F6-5E15-47C0-9386-A343C41F739B}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FC2Editor.exe
FirewallRules: [{F5357BC7-4BA2-4534-8F84-20E15818DBE4}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FC2Editor.exe
FirewallRules: [{C74399B2-E1CA-471C-B11C-36D9284EE074}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FC2BenchmarkTool.exe
FirewallRules: [{F85E7352-4982-43CB-936F-80789AF9AFF6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FC2BenchmarkTool.exe
FirewallRules: [{42B5F0DD-8807-439E-8EEE-EF1673069408}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FC2ServerLauncher.exe
FirewallRules: [{5AF86A4B-DC46-42F0-89F4-79E53DCF240F}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Far Cry 2\bin\FC2ServerLauncher.exe
FirewallRules: [{67453BFC-5C77-4435-9FDF-A8E2E184E056}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{1EDAFB1E-0761-4DE8-9CCA-DA7B69CF87BE}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{ACC2369F-74E1-4501-A36C-51959AC96822}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{D9FE2FBF-2CCD-4D0D-BAA5-4412A190F7FA}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{533F27EB-F39A-4B0F-A360-28E9B6DD13F6}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rayman Legends\Rayman Legends.exe
FirewallRules: [{C710B1EC-968D-4AE0-A9DB-779946E5CE9C}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Rayman Legends\Rayman Legends.exe
FirewallRules: [TCP Query User{C64F66F6-FAE7-4BD5-9638-1714FC847A18}C:\program files (x86)\steam\steamapps\common\kane and lynch dead men\kaneandlynch.exe] => (Block) C:\program files (x86)\steam\steamapps\common\kane and lynch dead men\kaneandlynch.exe
FirewallRules: [UDP Query User{A46A68ED-ABBE-4D0C-9F53-C204DF7B7B42}C:\program files (x86)\steam\steamapps\common\kane and lynch dead men\kaneandlynch.exe] => (Block) C:\program files (x86)\steam\steamapps\common\kane and lynch dead men\kaneandlynch.exe
FirewallRules: [{31FAEDAE-50EC-4B31-A29A-1E7CAF7C3161}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [{E7526A6A-0A29-41C1-811A-7C3378713209}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Gone Home\GoneHome.exe
FirewallRules: [{C89CAD60-BD14-4F63-B080-1D014A1E4E9A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Gone Home\GoneHome.exe
FirewallRules: [{1340BE17-812C-4516-BA26-61807B826D97}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Incredible Adventures of Van Helsing\VanHelsing.exe
FirewallRules: [{E5DF45F0-8406-4C06-BC66-525B242BD90A}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\The Incredible Adventures of Van Helsing\VanHelsing.exe
FirewallRules: [{F7344134-C251-4C9A-82A0-4B77B2B07E73}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BorderlandsPreSequel\Binaries\Win32\Launcher.exe
FirewallRules: [{830D47E5-4CEF-4D25-9230-1A0B163E8AC0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\BorderlandsPreSequel\Binaries\Win32\Launcher.exe
FirewallRules: [TCP Query User{8BEED15E-41C7-453B-9F2A-FFA5B4FC890E}C:\program files (x86)\steam\steamapps\common\borderlandspresequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\borderlandspresequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [UDP Query User{A1AC0F7D-0C1E-4DE2-9683-17ACE85DA2DC}C:\program files (x86)\steam\steamapps\common\borderlandspresequel\binaries\win32\borderlandspresequel.exe] => (Allow) C:\program files (x86)\steam\steamapps\common\borderlandspresequel\binaries\win32\borderlandspresequel.exe
FirewallRules: [{15E3AEEB-9D3F-4797-B5BA-90E6412B9366}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
FirewallRules: [{C1D8259F-551E-468E-9E77-7ACF1AC8C71E}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Dark Souls Prepare to Die Edition\DATA\DARKSOULS.exe
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe] => Enabled:Spybot - Search & Destroy tray access
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe] => Enabled:Spybot-S&D 2 Scanner Service
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe] => Enabled:Spybot-S&D 2 Updater
StandardProfile\AuthorizedApplications: [C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe] => Enabled:Spybot-S&D 2 Background update service

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/12/2015 09:48:03 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: NvStreamNetworkService.exe, Version: 4.1.1943.6202, Zeitstempel: 0x551399be
Name des fehlerhaften Moduls: NvStreamNetworkService.exe, Version: 4.1.1943.6202, Zeitstempel: 0x551399be
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000004e920f
ID des fehlerhaften Prozesses: 0xa6c
Startzeit der fehlerhaften Anwendung: 0xNvStreamNetworkService.exe0
Pfad der fehlerhaften Anwendung: NvStreamNetworkService.exe1
Pfad des fehlerhaften Moduls: NvStreamNetworkService.exe2
Berichtskennung: NvStreamNetworkService.exe3

Error: (08/12/2015 09:47:37 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 4101) (User: )
Description: Fehler bei der automatischen Aktualisierung des Drittanbieterstammzertifikats von <hxxp://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/02FAF3E291435468607857694DF5E45B68851868.crt>. Fehler: Dieser Vorgang wurde wegen Zeitüberschreitung zurückgegeben.
.

Error: (08/12/2015 09:47:21 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2015 08:47:46 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcSSAU restarted too many times in a short period. Aborting. [0]

Error: (08/11/2015 03:50:22 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: NvStreamNetworkService.exe, Version: 4.1.1943.6202, Zeitstempel: 0x551399be
Name des fehlerhaften Moduls: NvStreamNetworkService.exe, Version: 4.1.1943.6202, Zeitstempel: 0x551399be
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000004e920f
ID des fehlerhaften Prozesses: 0x5a8
Startzeit der fehlerhaften Anwendung: 0xNvStreamNetworkService.exe0
Pfad der fehlerhaften Anwendung: NvStreamNetworkService.exe1
Pfad des fehlerhaften Moduls: NvStreamNetworkService.exe2
Berichtskennung: NvStreamNetworkService.exe3

Error: (08/11/2015 03:49:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2015 03:48:48 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD initialization failed [6]

Error: (08/11/2015 03:48:48 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcFailed to set NvVAD endpoint as default Audio endpoint [0]

Error: (08/11/2015 03:48:48 PM) (Source: NvStreamSvc) (EventID: 2001) (User: )
Description: NvStreamSvcNvVAD endpoint registration failed [0]

Error: (08/10/2015 01:33:01 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: NvStreamNetworkService.exe, Version: 4.1.1943.6202, Zeitstempel: 0x551399be
Name des fehlerhaften Moduls: NvStreamNetworkService.exe, Version: 4.1.1943.6202, Zeitstempel: 0x551399be
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00000000004e920f
ID des fehlerhaften Prozesses: 0xa40
Startzeit der fehlerhaften Anwendung: 0xNvStreamNetworkService.exe0
Pfad der fehlerhaften Anwendung: NvStreamNetworkService.exe1
Pfad des fehlerhaften Moduls: NvStreamNetworkService.exe2
Berichtskennung: NvStreamNetworkService.exe3


Systemfehler:
=============
Error: (08/12/2015 09:47:54 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PinnacleUpdate Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/12/2015 09:47:51 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CyberGhost 5 Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/12/2015 09:47:51 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CyberGhost 5 Client Service erreicht.

Error: (08/11/2015 03:56:49 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Pro

Error: (08/11/2015 03:50:10 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PinnacleUpdate Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/11/2015 03:50:07 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "CyberGhost 5 Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/11/2015 03:50:07 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst CyberGhost 5 Client Service erreicht.

Error: (08/10/2015 04:53:24 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Pro

Error: (08/10/2015 02:50:48 PM) (Source: BTHUSB) (EventID: 17) (User: )
Description: Der lokale Bluetooth-Adapter ist aus einem unbekannten Grund fehlgeschlagen und wird nicht verwendet. Der Treiber wurde entladen.

Error: (08/10/2015 01:32:41 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "PinnacleUpdate Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.


Microsoft Office:
=========================

CodeIntegrity:
===================================
  Date: 2014-11-25 19:16:58.043
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-11-25 19:16:57.977
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen =========================== 

Processor: Intel(R) Core(TM) i5-4200U CPU @ 1.60GHz
Prozentuale Nutzung des RAM: 29%
Installierter physikalischer RAM: 8076.36 MB
Verfügbarer physikalischer RAM: 5669.94 MB
Summe virtueller Speicher: 16150.93 MB
Verfügbarer virtueller Speicher: 13127.86 MB

==================== Laufwerke ================================

Drive c: () (Fixed) (Total:465.66 GB) (Free:49.6 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E3FFD563)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)

==================== Ende von Ergebnis ============================

Cier78 · 12.08.2015, 10:06

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-08-12 10:42:04
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST500LT012-9WS142 rev.0001SDM1 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\ERICRI~1\AppData\Local\Temp\uwdciuoc.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                             000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                                  000007fefd29a413 2 bytes [FE, FF]
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                       000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                     000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                             000007fef68ddc88 5 bytes JMP 000007fff68400d8
.text  C:\Windows\system32\Dwm.exe[2364] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                            000007fef68dde10 5 bytes JMP 000007fff6840110
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2780] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82                                                             000000006f1417fa 2 bytes CALL 770511a9 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2780] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88                                                         000000006f141860 2 bytes CALL 770511a9 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2780] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98                                                       000000006f141942 2 bytes JMP 75d37089 C:\Windows\syswow64\WS2_32.dll
.text  C:\Windows\SysWOW64\PnkBstrA.exe[2780] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109                                                      000000006f14194d 2 bytes JMP 75d3cba6 C:\Windows\syswow64\WS2_32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82                                                             000000006f1417fa 2 bytes CALL 770511a9 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88                                                         000000006f141860 2 bytes CALL 770511a9 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98                                                       000000006f141942 2 bytes JMP 75d37089 C:\Windows\syswow64\WS2_32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109                                                      000000006f14194d 2 bytes JMP 75d3cba6 C:\Windows\syswow64\WS2_32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                               0000000075751401 2 bytes JMP 7707b21b C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                 0000000075751419 2 bytes JMP 7707b346 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                               0000000075751431 2 bytes JMP 770f8f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                               000000007575144a 2 bytes CALL 7705489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                          * 9
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                  00000000757514dd 2 bytes JMP 770f8822 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                           00000000757514f5 2 bytes JMP 770f89f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                  000000007575150d 2 bytes JMP 770f8718 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                           0000000075751525 2 bytes JMP 770f8ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                 000000007575153d 2 bytes JMP 7706fca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                      0000000075751555 2 bytes JMP 770768ef C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                               000000007575156d 2 bytes JMP 770f8fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                 0000000075751585 2 bytes JMP 770f8b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                    000000007575159d 2 bytes JMP 770f86dc C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                 00000000757515b5 2 bytes JMP 7706fd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                               00000000757515cd 2 bytes JMP 7707b2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                           00000000757516b2 2 bytes JMP 770f8ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrB.exe[2804] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                           00000000757516bd 2 bytes JMP 770f8671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                 0000000075751401 2 bytes JMP 7707b21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                   0000000075751419 2 bytes JMP 7707b346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                 0000000075751431 2 bytes JMP 770f8f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                 000000007575144a 2 bytes CALL 7705489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                          * 9
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                    00000000757514dd 2 bytes JMP 770f8822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17             00000000757514f5 2 bytes JMP 770f89f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                    000000007575150d 2 bytes JMP 770f8718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17             0000000075751525 2 bytes JMP 770f8ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                   000000007575153d 2 bytes JMP 7706fca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                        0000000075751555 2 bytes JMP 770768ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                 000000007575156d 2 bytes JMP 770f8fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                   0000000075751585 2 bytes JMP 770f8b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                      000000007575159d 2 bytes JMP 770f86dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                   00000000757515b5 2 bytes JMP 7706fd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                 00000000757515cd 2 bytes JMP 7707b2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20             00000000757516b2 2 bytes JMP 770f8ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2824] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31             00000000757516bd 2 bytes JMP 770f8671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\kernel32.dll!RegSetValueExW                   000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\kernel32.dll!RegQueryValueExW                 0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\kernel32.dll!RegDeleteValueW                  000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW            000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx          00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\kernel32.dll!K32GetModuleInformation          00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\kernel32.dll!RegSetValueExA                   00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                    000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW               000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW             000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3         000007fefd29a413 2 bytes [FE, FF]
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                 000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo              000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList            000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\ole32.dll!CoCreateInstance                    000007feff2b74a0 11 bytes JMP 000007fffd280228
.text  C:\Program Files (x86)\Qualcomm Atheros\Bluetooth Suite\BtvStack.exe[2944] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                   000007feff2cbf10 7 bytes JMP 000007fffd280260
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                  0000000077051efe 7 bytes JMP 000000016f163d10
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                    0000000077055b9d 7 bytes JMP 000000016f1646b0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                    00000000770613f9 7 bytes JMP 000000016f164050
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                   000000007706ea45 7 bytes JMP 000000016f163d00
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx           00000000770f8ea4 7 bytes JMP 000000016f1637c0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation           00000000770f8f29 5 bytes JMP 000000016f163870
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW             00000000770f9281 5 bytes JMP 000000016f1637d0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                0000000075b51d29 5 bytes JMP 000000016f163780
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW              0000000075b51dd7 5 bytes JMP 000000016f163740
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                  0000000075b52ab1 5 bytes JMP 0000000100be2ac0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                     0000000075b52d1d 5 bytes JMP 000000016f163560
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\USER32.dll!CreateWindowExW                     0000000075788a29 5 bytes JMP 000000016f162c50
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                 0000000075794572 5 bytes JMP 000000016f1634e0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                 00000000757ae567 5 bytes JMP 000000016f163550
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW            00000000757d07d7 5 bytes JMP 000000016f162a60
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo          00000000757e7a5c 5 bytes JMP 000000016f1634d0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList             00000000751fd2b4 5 bytes JMP 000000016f162d70
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo               00000000751fd4ee 5 bytes JMP 000000016f162d80
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                    0000000076e65ea5 5 bytes JMP 000000016f162c10
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2952] C:\Windows\syswow64\ole32.dll!CoCreateInstance                     0000000076e99d0b 5 bytes JMP 000000016f162ba0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\kernel32.dll!RegSetValueExW                                          000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                        0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                         000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                   000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                 00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                 00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\kernel32.dll!RegSetValueExA                                          00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                           000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                      000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                    000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                000007fefd29a413 2 bytes [FE, FF]
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                        000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                     000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                   000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\ole32.dll!CoCreateInstance                                           000007feff2b74a0 11 bytes JMP 000007fffd280228
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2988] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                          000007feff2cbf10 7 bytes JMP 000007fffd280260
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2996] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                            000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                       000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                     000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                 000007fefd29a413 2 bytes [FE, FF]
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2996] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                         000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2996] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                      000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe[2996] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                    000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                               0000000077051efe 7 bytes JMP 000000016f163d10
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                 0000000077055b9d 7 bytes JMP 000000016f1646b0
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                 00000000770613f9 7 bytes JMP 000000016f164050
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                000000007706ea45 7 bytes JMP 000000016f163d00
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                        00000000770f8ea4 7 bytes JMP 000000016f1637c0
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                        00000000770f8f29 5 bytes JMP 000000016f163870
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                          00000000770f9281 5 bytes JMP 000000016f1637d0
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                             0000000075b51d29 5 bytes JMP 000000016f163780
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                           0000000075b51dd7 5 bytes JMP 000000016f163740
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                               0000000075b52ab1 5 bytes JMP 000000016f163880
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                  0000000075b52d1d 5 bytes JMP 000000016f163560
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                  0000000075788a29 5 bytes JMP 000000016f162c50
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                              0000000075794572 5 bytes JMP 000000016f1634e0
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                              00000000757ae567 5 bytes JMP 000000016f163550
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                         00000000757d07d7 5 bytes JMP 000000016f162a60
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                       00000000757e7a5c 5 bytes JMP 000000016f1634d0
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                          00000000751fd2b4 5 bytes JMP 000000016f162d70
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                            00000000751fd4ee 5 bytes JMP 000000016f162d80
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                 0000000076e65ea5 5 bytes JMP 000000016f162c10
.text  C:\Windows\System32\TiltWheelMouse.exe[3012] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  0000000076e99d0b 5 bytes JMP 000000016f162ba0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\kernel32.dll!RegSetValueExW                                 000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\kernel32.dll!RegQueryValueExW                               0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                          000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                        00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                        00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\kernel32.dll!RegSetValueExA                                 00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                  000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                             000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                           000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                       000007fefd29a413 2 bytes [FE, FF]
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                               000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                            000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[1712] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                          000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[4288] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW                              0000000077051efe 7 bytes JMP 000000016f163d10
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[4288] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW                                0000000077055b9d 7 bytes JMP 000000016f1646b0
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[4288] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                00000000770613f9 7 bytes JMP 000000016f164050
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[4288] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW                               000000007706ea45 7 bytes JMP 000000016f163d00
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[4288] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                       00000000770f8ea4 7 bytes JMP 000000016f1637c0
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[4288] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                       00000000770f8f29 5 bytes JMP 000000016f163870
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[4288] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                         00000000770f9281 5 bytes JMP 000000016f1637d0
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                 0000000077051efe 7 bytes JMP 000000016f163d10
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                   0000000077055b9d 7 bytes JMP 000000016f1646b0
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                   00000000770613f9 7 bytes JMP 000000016f164050
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                  000000007706ea45 7 bytes JMP 000000016f163d00
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                          00000000770f8ea4 7 bytes JMP 000000016f1637c0
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                          00000000770f8f29 5 bytes JMP 000000016f163870
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                            00000000770f9281 5 bytes JMP 000000016f1637d0
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                               0000000075b51d29 5 bytes JMP 000000016f163780
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                             0000000075b51dd7 5 bytes JMP 000000016f163740
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                 0000000075b52ab1 5 bytes JMP 000000016f163880
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                    0000000075b52d1d 5 bytes JMP 000000016f163560
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                            00000000751fd2b4 5 bytes JMP 000000016f162d70
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                              00000000751fd4ee 5 bytes JMP 000000016f162d80
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                    0000000075788a29 5 bytes JMP 000000016f162c50
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                0000000075794572 5 bytes JMP 000000016f1634e0
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                00000000757ae567 5 bytes JMP 000000016f163550
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                           00000000757d07d7 5 bytes JMP 000000016f162a60
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                         00000000757e7a5c 5 bytes JMP 000000016f1634d0
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                           0000000075751401 2 bytes JMP 7707b21b C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                             0000000075751419 2 bytes JMP 7707b346 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                           0000000075751431 2 bytes JMP 770f8f29 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                           000000007575144a 2 bytes CALL 7705489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                          * 9
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                              00000000757514dd 2 bytes JMP 770f8822 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                       00000000757514f5 2 bytes JMP 770f89f8 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                              000000007575150d 2 bytes JMP 770f8718 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                       0000000075751525 2 bytes JMP 770f8ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                             000000007575153d 2 bytes JMP 7706fca8 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                  0000000075751555 2 bytes JMP 770768ef C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                           000000007575156d 2 bytes JMP 770f8fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                             0000000075751585 2 bytes JMP 770f8b42 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                000000007575159d 2 bytes JMP 770f86dc C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                             00000000757515b5 2 bytes JMP 7706fd41 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                           00000000757515cd 2 bytes JMP 7707b2dc C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                       00000000757516b2 2 bytes JMP 770f8ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\Battle.net\Agent\Agent.4271\Agent.exe[4732] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                       00000000757516bd 2 bytes JMP 770f8671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                     0000000077051efe 7 bytes JMP 000000016f163d10
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                       0000000077055b9d 7 bytes JMP 000000016f1646b0
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                       00000000770613f9 7 bytes JMP 000000016f164050
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                      000000007706ea45 7 bytes JMP 000000016f163d00
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx              00000000770f8ea4 7 bytes JMP 000000016f1637c0
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation              00000000770f8f29 5 bytes JMP 000000016f163870
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                00000000770f9281 5 bytes JMP 000000016f1637d0
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                   0000000075b51d29 5 bytes JMP 000000016f163780
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                 0000000075b51dd7 5 bytes JMP 000000016f163740
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                     0000000075b52ab1 5 bytes JMP 000000016f163880
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                        0000000075b52d1d 5 bytes JMP 000000016f163560
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\USER32.dll!CreateWindowExW                        0000000075788a29 5 bytes JMP 000000016f162c50
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                    0000000075794572 5 bytes JMP 000000016f1634e0
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                    00000000757ae567 5 bytes JMP 000000016f163550
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW               00000000757d07d7 5 bytes JMP 000000016f162a60
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo             00000000757e7a5c 5 bytes JMP 000000016f1634d0
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                00000000751fd2b4 5 bytes JMP 000000016f162d70
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                  00000000751fd4ee 5 bytes JMP 000000016f162d80
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17               0000000075751401 2 bytes JMP 7707b21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                 0000000075751419 2 bytes JMP 7707b346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17               0000000075751431 2 bytes JMP 770f8f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42               000000007575144a 2 bytes CALL 7705489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                          * 9
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                  00000000757514dd 2 bytes JMP 770f8822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17           00000000757514f5 2 bytes JMP 770f89f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                  000000007575150d 2 bytes JMP 770f8718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17           0000000075751525 2 bytes JMP 770f8ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                 000000007575153d 2 bytes JMP 7706fca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                      0000000075751555 2 bytes JMP 770768ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17               000000007575156d 2 bytes JMP 770f8fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                 0000000075751585 2 bytes JMP 770f8b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                    000000007575159d 2 bytes JMP 770f86dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                 00000000757515b5 2 bytes JMP 7706fd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17               00000000757515cd 2 bytes JMP 7707b2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20           00000000757516b2 2 bytes JMP 770f8ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Battle.net\Battle.net.6075\Battle.net.exe[4952] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31           00000000757516bd 2 bytes JMP 770f8671 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                         000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                       0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                        000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                  000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                         00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                          000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                     000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                   000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                               000007fefd29a413 2 bytes [FE, FF]
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                       000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                    000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                  000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\ole32.dll!CoCreateInstance                                                          000007feff2b74a0 11 bytes JMP 000007fffd280228
.text  C:\Windows\system32\igfxEM.exe[5168] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                         000007feff2cbf10 7 bytes JMP 000007fffd280260
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\kernel32.dll!RegSetValueExW                                                         000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                                       0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                                        000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                  000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                         00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                          000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                     000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                   000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                               000007fefd29a413 2 bytes [FE, FF]
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                       000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                    000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                  000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\ole32.dll!CoCreateInstance                                                          000007feff2b74a0 11 bytes JMP 000007fffd280228
.text  C:\Windows\system32\igfxHK.exe[5248] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                         000007feff2cbf10 7 bytes JMP 000007fffd280260
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5684] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                        000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                   000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                 000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5684] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                             000007fefd29a413 2 bytes [FE, FF]
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5684] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                     000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5684] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                  000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[5684] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\kernel32.dll!RegSetValueExW                        000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\kernel32.dll!RegQueryValueExW                      0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\kernel32.dll!RegDeleteValueW                       000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                 000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx               00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\kernel32.dll!K32GetModuleInformation               00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\kernel32.dll!RegSetValueExA                        00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                         000007fefd292db0 5 bytes JMP 000007fffd280180
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                    000007fefd2937d0 7 bytes JMP 000007fffd2800d8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                  000007fefd29a410 2 bytes JMP 000007fffd280110
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3              000007fefd29a413 2 bytes [FE, FF]
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                      000007fefd29aec0 6 bytes JMP 000007fffd280148
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\ole32.dll!CoCreateInstance                         000007feff2b74a0 11 bytes JMP 000007fffd280228
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                        000007feff2cbf10 7 bytes JMP 000007fffd280260
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                   000007fefd5889d0 8 bytes JMP 000007fffd2801f0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                 000007fefd58be40 8 bytes JMP 000007fffd2801b8
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\d3d9.dll!Direct3DCreate9Ex                         000007fef7042460 5 bytes JMP 000007fefd2802d0
.text  C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[5864] C:\Windows\system32\d3d9.dll!Direct3DCreate9                           000007fef70796b0 6 bytes JMP 000007fefd280298

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{0C6B30C9-09F3-456F-82E1-9918FB731429}\Connection@Name  isatap.{340BEEC3-5F95-44B7-8B86-370D7500EBD5}
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind     \Device\{4E400E56-9143-4505-9DF1-FFCC312FDDEB}?\Device\{DEF25D6C-9A89-420E-A29F-3B5288DEFF12}?\Device\{64CC5CAA-9B8B-432B-B958-0E902081831B}?\Device\{0C6B30C9-09F3-456F-82E1-9918FB731429}?\Device\{3BF92251-A5D9-42F4-8082-0E4DC40AD6A4}?
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route    "{4E400E56-9143-4505-9DF1-FFCC312FDDEB}"?"{DEF25D6C-9A89-420E-A29F-3B5288DEFF12}"?"{64CC5CAA-9B8B-432B-B958-0E902081831B}"?"{0C6B30C9-09F3-456F-82E1-9918FB731429}"?"{3BF92251-A5D9-42F4-8082-0E4DC40AD6A4}"?
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export   \Device\TCPIP6TUNNEL_{4E400E56-9143-4505-9DF1-FFCC312FDDEB}?\Device\TCPIP6TUNNEL_{DEF25D6C-9A89-420E-A29F-3B5288DEFF12}?\Device\TCPIP6TUNNEL_{64CC5CAA-9B8B-432B-B958-0E902081831B}?\Device\TCPIP6TUNNEL_{0C6B30C9-09F3-456F-82E1-9918FB731429}?\Device\TCPIP6TUNNEL_{3BF92251-A5D9-42F4-8082-0E4DC40AD6A4}?
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\8056f22dd080                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\8056f22dd080@0025db138669                                                     0xAF 0xA0 0xF7 0x14 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{0C6B30C9-09F3-456F-82E1-9918FB731429}@InterfaceName                       isatap.{340BEEC3-5F95-44B7-8B86-370D7500EBD5}
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{0C6B30C9-09F3-456F-82E1-9918FB731429}@ReusableType                        0
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\8056f22dd080 (not active ControlSet)                                              
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\8056f22dd080@0025db138669                                                         0xAF 0xA0 0xF7 0x14 ...

---- EOF - GMER 2.1 ----

Code:

ATTFilter

Exportierte Ereignisse:

12.08.2015 09:51 [System-Scanner] Malware gefunden
      Die Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ignoriert.

12.08.2015 09:49 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan] 
      gefunden.
      Ausgeführte Aktion: Übergeben an Scanner

11.08.2015 20:47 [System-Scanner] Malware gefunden
      Die Datei 'C:\Users\Eric Rinnelt\AppData\Local\Temp\OCS\ocs_v71b.exe'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/DownloadSponsor.Gen' 
      [riskware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5023e040.qua' 
      verschoben!

11.08.2015 19:58 [System-Scanner] Malware gefunden
      Die Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '53aeaeeb.qua' 
      verschoben!

11.08.2015 19:54 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan] 
      gefunden.
      Ausgeführte Aktion: Übergeben an Scanner

11.08.2015 19:18 [System-Scanner] Malware gefunden
      Die Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '50378054.qua' 
      verschoben!

11.08.2015 18:54 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan] 
      gefunden.
      Ausgeführte Aktion: Übergeben an Scanner

11.08.2015 17:54 [System-Scanner] Malware gefunden
      Die Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '53de8d1f.qua' 
      verschoben!

11.08.2015 17:53 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan] 
      gefunden.
      Ausgeführte Aktion: Übergeben an Scanner

11.08.2015 17:18 [System-Scanner] Malware gefunden
      Die Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      enthielt einen Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '53db8014.qua' 
      verschoben!

11.08.2015 17:16 [Echtzeit-Scanner] Malware gefunden
      In der Datei 'C:\Program Files (x86)\Heroes of the Storm Public 
      Test\Support\Battle.net.dll'
      wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.EPACK.Gen2' [trojan] 
      gefunden.
      Ausgeführte Aktion: Übergeben an Scanner

Deathkid535 · 12.08.2015, 10:12

Ich habe dein Thema in Arbeit und melde mich so schnell als möglich mit weiteren Anweisungen.

Bitte beachte, dass alle meine Antworten zuerst von einem Ausbilder freigegeben werden müssen, bevor ich diese hier posten darf. Dies garantiert, dass Du Hilfe von einem ausgebildeten Helfer bekommst.

Ich bedanke mich für deine Geduld

Deathkid535 · 12.08.2015, 10:42

Hi,

Das ist ein Fehlalarm von Avira. Setz deinen "C:\Program Files (x86)\Heroes of the Storm Public Test" Ordner auf die Whitelist.

Spybot ist veraltet und brauchst du nicht mehr.

Dein Java ist übrigens auch Out of Date. Deinstallieren und von hier neu laden.

Cier78 · 12.08.2015, 11:20

Wow vielen Dank für die schnelle Antwort. Mein Rechner ist grad sehr langsam hochgefahren könnte das noch am defogger liegen? Soll ich da eig wieder auf "re-enable" klicken?

Deathkid535 · 12.08.2015, 11:20

Hat eh nix deaktiviert, kannst aber trotzdem versuchen

12.08.2015, 11:20	#6
Deathkid535 /// Malwareteam	Windows 7: Trojaner in Battlenet.dll Hat eh nix deaktiviert, kannst aber trotzdem versuchen __________________ --> Windows 7: Trojaner in Battlenet.dll

Windows 7: Trojaner in Battlenet.dll

Log-Analyse und Auswertung: Windows 7: Trojaner in Battlenet.dll