Hallo Trojaner-Board,
ich hatte folgendes Problem:
Beim Hochladen von Bewerbungsunterlagen (PDF) habe ich auf einem Bewerberportal die Fehlermeldung erhalten:
"Dokument wurde nicht gespeichert, da es einen Virus enthält."
Dementsprechend aufgeregt bin ich im Moment.
Ich mache mal die Checks und poste hier die Logfiles und hoffe auf eure Hilfe.
Ich poste das ganze in Teilen, da ich mich immer wieder an- und abmelden muss, um den Virenscaner auszuschalten.
Danke für Eure Hilfe !!!
LG
Timo

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:20-08-2015
durchgeführt von Scheer (Administrator) auf SCHEER-PC (20-08-2015 20:27:06)
Gestartet von C:\Users\beTheFellowBee\Downloads
Geladene Profile: Scheer & beTheFellowBee (Verfügbare Profile: Scheer & beTheFellowBee)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: Chrome)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Comodo Security Solutions, Inc.) C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfemms.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect 3\creator-ws.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Intel(R) Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
() C:\ExpressGateUtil\VAWinService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(McAfee, Inc.) C:\Program Files\McAfee\MSC\McAPExe.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\CSP\1.5.495.0\McCSPServiceHost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
() C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(ASUS) C:\Windows\AsScrPro.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(ELAN Microelectronic Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Boingo Wireless, Inc.) C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\ExpressGateUtil\VAWinAgent.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McUICnt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera_crashreporter.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Opera Software) C:\Program Files (x86)\Opera\31.0.1889.174\opera.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [ASUS WebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [1754448 2010-03-16] ()
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2121320 2010-09-28] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-05-03] (Alcor Micro Corp.)
HKLM\...\Run: [ETDWare] => C:\Program Files\Elantech\ETDCtrl.exe [649608 2010-06-10] (ELAN Microelectronic Corp.)
HKLM\...\Run: [IntelWireless] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2531472 2014-12-13] (NVIDIA Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170280 2015-07-11] (Apple Inc.)
HKLM-x32\...\Run: [UpdatePSTShortCut] => C:\Program Files (x86)\Cyberlink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2010-06-25] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] => C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [Boingo Wi-Fi] => C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk [2429 2010-11-13] ()
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-05-04] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [VAWinAgent] => C:\ExpressGateUtil\VAWinAgent.exe [21504 2010-08-13] ()
HKLM-x32\...\Run: [mcui_exe] => C:\Program Files\McAfee.com\Agent\mcagent.exe [616272 2015-05-13] (McAfee, Inc.)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-23] ()
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-05-15] (Apple Inc.)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46952 2011-08-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [30568 2011-08-02] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139776 2014-01-27] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [4513792 2013-12-19] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2015-06-17] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-02-10] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [NoFolderOptions] 0
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKU\S-1-5-21-1560831024-780671805-4130521857-1001\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1560831024-780671805-4130521857-1001\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [1435136 2014-10-03] ()
HKU\S-1-5-21-1560831024-780671805-4130521857-1001\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [784392 2014-05-29] (Sandboxie Holdings, LLC)
HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [7404312 2015-01-20] (Piriform Ltd)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs:  C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs: , C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [178632 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\Windows\SysWOW64\nvinit.dll => c:\Windows\SysWOW64\nvinit.dll [165760 2014-12-13] (NVIDIA Corporation)
AppInit_DLLs-x32:  C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [165760 2014-12-13] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2012-09-02]
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  Keine Datei
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  Keine Datei
ShellIconOverlayIdentifiers: [AsusWSShellExt_B] -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll [2009-11-26] (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: [AsusWSShellExt_O] -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll [2009-11-26] (eCareme Technologies, Inc.)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt..)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Richtlinienbeschränkung <======= ACHTUNG
HKU\S-1-5-21-1560831024-780671805-4130521857-1001\SOFTWARE\Policies\Microsoft\Internet Explorer: Richtlinienbeschränkung <======= ACHTUNG
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1560831024-780671805-4130521857-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1560831024-780671805-4130521857-1002\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-1560831024-780671805-4130521857-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://asus.msn.com
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKU\S-1-5-21-1560831024-780671805-4130521857-1002 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1560831024-780671805-4130521857-1002 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-1560831024-780671805-4130521857-1002 -> {43E97C7C-1B2C-4CDF-848F-CD608BD0BCEC} URL = hxxp://www.search.ask.com/web?tpid=ORJ-SPE&o=APN11406&pf=V7&p2=^BBE^OSJ000^YY^DE&gct=&itbv=12.16.2.53&apn_uid=888A9DBA-B531-422B-90E9-76DA63E5B12A&apn_ptnrs=BBE&apn_dtid=^OSJ000^YY^DE&apn_dbr=launcher.exe_0_24.0.1558.53&doi=2014-09-17&trgb=IE&q={searchTerms}&psv=&pt=tb
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-05-10] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-05-10] (Oracle Corporation)
BHO-x32: PDF Architect 3 Helper -> {06E08260-0695-4EC1-A74B-1310D8899D93} -> C:\Program Files (x86)\PDF Architect 3\creator-ie-helper.dll [2015-04-24] (pdfforge GmbH)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\ssv.dll [2015-07-24] (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\jp2ssv.dll [2015-07-24] (Oracle Corporation)
Toolbar: HKLM-x32 - PDF Architect 3 Toolbar - {2DFF3579-5AA7-45B9-9328-1D38EA230861} - C:\Program Files (x86)\PDF Architect 3\creator-ie-plugin.dll [2015-04-24] (pdfforge GmbH)
Toolbar: HKU\S-1-5-21-1560831024-780671805-4130521857-1002 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  Keine Datei
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll [2015-05-13] (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll [2015-05-13] (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{C6B0554D-3B83-4622-BA80-0C0B398F0844}: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_18_0_0_232.dll [2015-08-20] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-05-10] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-05-10] (Oracle Corporation)
FF Plugin: @mcafee.com/MSC,version=10 -> c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL [2015-05-13] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_18_0_0_232.dll [2015-08-20] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-01-06] ()
FF Plugin-x32: @innoplus.de/ino3DViewer -> C:\Program Files (x86)\innoplus\3D-Viewer-innoPlus\npIno3DViewer.dll [2014-05-14] (INNOVA-engineering GmbH Dresden)
FF Plugin-x32: @java.com/DTPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\dtplugin\npDeployJava1.dll [2015-07-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.51.2 -> C:\Program Files (x86)\Java\jre1.8.0_51\bin\plugin2\npjp2.dll [2015-07-24] (Oracle Corporation)
FF Plugin-x32: @mcafee.com/MSC,version=10 -> c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL [2015-05-13] ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2013-02-05] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2014-12-13] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2014-12-13] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.28.1\npGoogleUpdate3.dll [2015-07-16] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-07-03] (Adobe Systems Inc.)
FF Plugin-x32: PDF Architect 3 -> C:\Program Files (x86)\PDF Architect 3\np-previewer.dll [2015-04-24] (pdfforge GmbH)
FF HKLM-x32\...\Firefox\Extensions: [pdf_architect_3_conv@pdfarchitect.org] - C:\Program Files (x86)\PDF Architect 3\resources\pdfarchitect3firefoxextension
FF Extension: PDF Architect 3 Creator - C:\Program Files (x86)\PDF Architect 3\resources\pdfarchitect3firefoxextension [2015-06-20]
FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK
FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK [2012-05-29]

Chrome: 
=======
CHR Profile: C:\Users\Scheer\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Bookmark Manager) - C:\Users\Scheer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-26]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Scheer\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-04]
CHR Extension: (Google Wallet) - C:\Users\Scheer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-03-05]
CHR HKLM\...\Chrome\Extension: [aaaaaiabcopkplhgaedhbloeejhhankf] - https://clients2.google.com/service/update2/crx

Opera: 
=======
StartMenuInternet: (HKU\S-1-5-21-1560831024-780671805-4130521857-1001) OperaStable - "C:\Program Files (x86)\Opera\Launcher.exe"
StartMenuInternet: (HKU\S-1-5-21-1560831024-780671805-4130521857-1002) OperaStable - "C:\Program Files (x86)\Opera\Launcher.exe"

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-05-29] (Apple Inc.)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [282112 2013-09-25] (Brother Industries, Ltd.) [Datei ist nicht signiert]
R2 DragonUpdater; C:\Program Files (x86)\Comodo\Dragon\dragon_updater.exe [2370240 2015-03-11] (Comodo Security Solutions, Inc.)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1148560 2014-12-13] (NVIDIA Corporation)
R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-05-06] (McAfee, Inc.)
R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [Datei ist nicht signiert]
R2 McAPExe; C:\Program Files\McAfee\MSC\McAPExe.exe [754280 2015-05-13] (McAfee, Inc.)
R2 mccspsvc; C:\Program Files\Common Files\McAfee\CSP\1.5.495.0\McCSPServiceHost.exe [207344 2015-06-04] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-05-06] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-05-06] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [609592 2015-05-05] (McAfee, Inc.)
R2 mcpltsvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-05-06] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-05-06] (McAfee, Inc.)
R3 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [232656 2015-06-29] (McAfee, Inc.)
R2 mfemms; C:\Program Files\Common Files\McAfee\SystemCore\\mfemms.exe [373704 2015-07-06] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [254792 2015-06-29] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [340744 2015-05-06] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1701520 2014-12-13] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [19823248 2014-12-13] (NVIDIA Corporation)
S3 PDF Architect 3; C:\Program Files (x86)\PDF Architect 3\ws.exe [2244312 2015-04-24] (pdfforge GmbH)
S3 PDF Architect 3 CrashHandler; C:\Program Files (x86)\PDF Architect 3\crash-handler-ws.exe [901336 2015-04-24] (pdfforge GmbH)
R2 PDF Architect 3 Creator; C:\Program Files (x86)\PDF Architect 3\creator-ws.exe [740568 2015-04-24] (pdfforge GmbH)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [145256 2011-08-02] (Nuance Communications, Inc.)
R3 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2010-04-06] () [Datei ist nicht signiert]
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [174088 2014-05-29] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [994360 2011-10-14] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [399416 2011-10-14] (Secunia)
R2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [Datei ist nicht signiert]
R2 VideAceWindowsService; C:\ExpressGateUtil\VAWinService.exe [77312 2010-08-21] () [Datei ist nicht signiert]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R5 ACPI; C:\Windows\System32\drivers\ACPI.sys [334208 2010-11-20] (Microsoft Corporation)
R5 amdxata; C:\Windows\System32\drivers\amdxata.sys [27008 2011-03-11] (Advanced Micro Devices)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R5 atapi; C:\Windows\System32\drivers\atapi.sys [24128 2009-07-14] (Microsoft Corporation)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [77536 2015-07-02] (McAfee, Inc.)
R5 CLFS; C:\Windows\System32\CLFS.sys [367552 2015-03-04] (Microsoft Corporation)
R5 CNG; C:\Windows\System32\Drivers\cng.sys [459336 2015-01-31] (Microsoft Corporation)
R5 Compbatt; C:\Windows\System32\DRIVERS\compbatt.sys [21584 2009-07-14] (Microsoft Corporation)
R5 Disk; C:\Windows\System32\DRIVERS\disk.sys [73280 2009-07-14] (Microsoft Corporation)
R5 FileInfo; C:\Windows\System32\drivers\fileinfo.sys [70224 2009-07-14] (Microsoft Corporation)
R5 FltMgr; C:\Windows\System32\drivers\fltmgr.sys [289664 2010-11-20] (Microsoft Corporation)
R3 FLxHCIh; C:\Windows\System32\DRIVERS\FLxHCIh.sys [69120 2010-09-25] (Fresco Logic)
U5 Fs_Rec; C:\Windows\System32\Drivers\Fs_Rec.sys [23408 2012-03-01] (Microsoft Corporation)
R5 fvevol; C:\Windows\System32\DRIVERS\fvevol.sys [223752 2013-01-24] (Microsoft Corporation)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [198448 2015-04-27] (McAfee, Inc.)
R5 hwpolicy; C:\Windows\System32\drivers\hwpolicy.sys [14720 2010-11-20] (Microsoft Corporation)
R5 iaStor; C:\Windows\System32\DRIVERS\iaStor.sys [540696 2010-03-03] (Intel Corporation)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
R5 KSecDD; C:\Windows\System32\Drivers\ksecdd.sys [95680 2015-07-15] (Microsoft Corporation)
R5 KSecPkg; C:\Windows\System32\Drivers\ksecpkg.sys [155584 2015-07-15] (Microsoft Corporation)
R3 mfeaack; C:\Windows\System32\drivers\mfeaack.sys [412440 2015-07-02] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [347800 2015-07-02] (McAfee, Inc.)
R5 mfedisk; C:\Windows\System32\DRIVERS\mfedisk.sys [101872 2015-02-17] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [496888 2015-07-02] (McAfee, Inc.)
R5 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [875928 2015-07-02] (McAfee, Inc.)
R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [483240 2015-03-26] (McAfee, Inc.)
S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [100720 2015-03-26] (McAfee, Inc.)
R5 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344704 2015-07-02] (McAfee, Inc.)
R5 mountmgr; C:\Windows\System32\drivers\mountmgr.sys [94656 2015-07-15] (Microsoft Corporation)
R5 msahci; C:\Windows\System32\drivers\msahci.sys [31104 2010-11-20] (Microsoft Corporation)
R5 msisadrv; C:\Windows\System32\drivers\msisadrv.sys [15424 2009-07-14] (Microsoft Corporation)
R5 Mup; C:\Windows\System32\Drivers\mup.sys [60496 2009-07-14] (Microsoft Corporation)
R5 NDIS; C:\Windows\System32\drivers\ndis.sys [950128 2012-08-22] (Microsoft Corporation)
R5 nvpciflt; C:\Windows\System32\DRIVERS\nvpciflt.sys [31376 2014-12-13] (NVIDIA Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2014-12-13] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R5 partmgr; C:\Windows\System32\drivers\partmgr.sys [75120 2012-03-17] (Microsoft Corporation)
R5 pci; C:\Windows\System32\drivers\pci.sys [184704 2010-11-20] (Microsoft Corporation)
R5 pciide; C:\Windows\System32\drivers\pciide.sys [12352 2009-07-14] (Microsoft Corporation)
R5 pcw; C:\Windows\System32\drivers\pcw.sys [50768 2009-07-14] (Microsoft Corporation)
R5 rdyboost; C:\Windows\System32\drivers\rdyboost.sys [213888 2010-11-20] (Microsoft Corporation)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [185352 2014-05-29] (Sandboxie Holdings, LLC)
R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1800192 2009-08-20] ()
R5 spldr; C:\Windows\System32\Drivers\spldr.sys [19008 2009-07-14] (Microsoft Corporation)
R5 Tcpip; C:\Windows\System32\drivers\tcpip.sys [1903552 2014-04-05] (Microsoft Corporation)
R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13832 2010-04-17] ()
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2014-07-28] (Apple, Inc.) [Datei ist nicht signiert]
R5 vdrvroot; C:\Windows\System32\drivers\vdrvroot.sys [36432 2009-07-14] (Microsoft Corporation)
R5 volmgr; C:\Windows\System32\drivers\volmgr.sys [71552 2010-11-20] (Microsoft Corporation)
R5 volmgrx; C:\Windows\System32\drivers\volmgrx.sys [363392 2010-11-20] (Microsoft Corporation)
R5 volsnap; C:\Windows\System32\drivers\volsnap.sys [295808 2010-11-20] (Microsoft Corporation)
R5 Wdf01000; C:\Windows\System32\drivers\Wdf01000.sys [785624 2013-06-26] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]
U3 ufdiqpow; \??\C:\Users\Scheer\AppData\Local\Temp\ufdiqpow.sys [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-20 20:20 - 2015-08-20 20:20 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2015-08-20 19:18 - 2015-08-20 19:18 - 00380416 _____ C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe
2015-08-20 19:17 - 2015-08-20 19:17 - 02173952 _____ (Farbar) C:\Users\beTheFellowBee\Downloads\FRST64 (1).exe
2015-08-20 19:17 - 2015-08-20 19:17 - 00380416 _____ C:\Users\beTheFellowBee\Downloads\l2uuo67o.exe
2015-08-20 19:17 - 2015-08-20 19:17 - 00380416 _____ C:\Users\beTheFellowBee\Downloads\Gmer-19357.exe
2015-08-20 19:07 - 2015-08-20 19:10 - 00045735 _____ C:\Users\beTheFellowBee\Downloads\Addition.txt
2015-08-20 19:04 - 2015-08-20 20:27 - 00031425 _____ C:\Users\beTheFellowBee\Downloads\FRST.txt
2015-08-20 19:04 - 2015-08-20 19:04 - 02173952 _____ (Farbar) C:\Users\beTheFellowBee\Downloads\FRST64.exe
2015-08-20 19:03 - 2015-08-20 20:26 - 00000474 _____ C:\Users\beTheFellowBee\Downloads\defogger_disable.log
2015-08-20 19:03 - 2015-08-20 19:03 - 00050477 _____ C:\Users\beTheFellowBee\Downloads\Defogger (1).exe
2015-08-20 19:01 - 2015-08-20 19:01 - 00050477 _____ C:\Users\beTheFellowBee\Downloads\Defogger.exe
2015-08-19 19:26 - 2015-08-11 03:20 - 25191936 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-08-19 19:26 - 2015-08-11 03:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-08-19 19:26 - 2015-08-11 02:33 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-08-19 19:26 - 2015-08-11 02:20 - 19871232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-08-19 18:04 - 2015-08-19 18:04 - 00000032 _____ C:\Users\beTheFellowBee\Desktop\Nachsendeauftragnummer.txt
2015-08-18 22:36 - 2015-08-18 22:36 - 01033572 _____ C:\Users\beTheFellowBee\Downloads\Scheer, Timo Hubert - Bewerbungsunterlagen
2015-08-14 17:31 - 2015-07-30 15:13 - 00124624 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-08-14 17:31 - 2015-07-30 15:13 - 00103120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-08-14 15:31 - 2015-07-21 02:39 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-08-14 15:31 - 2015-07-21 02:12 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-08-14 15:31 - 2015-07-16 22:54 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-08-14 15:31 - 2015-07-16 22:37 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-08-14 15:31 - 2015-07-16 22:36 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-08-14 15:31 - 2015-07-16 22:36 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-08-14 15:31 - 2015-07-16 22:36 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-08-14 15:31 - 2015-07-16 22:35 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-08-14 15:31 - 2015-07-16 22:35 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-08-14 15:31 - 2015-07-16 22:27 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-08-14 15:31 - 2015-07-16 22:26 - 05923328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-08-14 15:31 - 2015-07-16 22:26 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-08-14 15:31 - 2015-07-16 22:23 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-08-14 15:31 - 2015-07-16 22:21 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-08-14 15:31 - 2015-07-16 22:21 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-08-14 15:31 - 2015-07-16 22:21 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-08-14 15:31 - 2015-07-16 22:21 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-08-14 15:31 - 2015-07-16 22:12 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-08-14 15:31 - 2015-07-16 22:08 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-08-14 15:31 - 2015-07-16 22:00 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-08-14 15:31 - 2015-07-16 21:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-08-14 15:31 - 2015-07-16 21:54 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-08-14 15:31 - 2015-07-16 21:51 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-08-14 15:31 - 2015-07-16 21:51 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-08-14 15:31 - 2015-07-16 21:51 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-08-14 15:31 - 2015-07-16 21:50 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-08-14 15:31 - 2015-07-16 21:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-08-14 15:31 - 2015-07-16 21:49 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-08-14 15:31 - 2015-07-16 21:45 - 02279424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-08-14 15:31 - 2015-07-16 21:43 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-08-14 15:31 - 2015-07-16 21:43 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-08-14 15:31 - 2015-07-16 21:41 - 00479232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-08-14 15:31 - 2015-07-16 21:39 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-08-14 15:31 - 2015-07-16 21:39 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-08-14 15:31 - 2015-07-16 21:38 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-08-14 15:31 - 2015-07-16 21:36 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-08-14 15:31 - 2015-07-16 21:35 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-08-14 15:31 - 2015-07-16 21:34 - 14451200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-08-14 15:31 - 2015-07-16 21:33 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-08-14 15:31 - 2015-07-16 21:32 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-08-14 15:31 - 2015-07-16 21:29 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-08-14 15:31 - 2015-07-16 21:24 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-08-14 15:31 - 2015-07-16 21:20 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-08-14 15:31 - 2015-07-16 21:19 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-08-14 15:31 - 2015-07-16 21:17 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-08-14 15:31 - 2015-07-16 21:12 - 04520448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-08-14 15:31 - 2015-07-16 21:12 - 02427904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-08-14 15:31 - 2015-07-16 21:10 - 12856832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-08-14 15:31 - 2015-07-16 21:06 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-08-14 15:31 - 2015-07-16 21:06 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-08-14 15:31 - 2015-07-16 21:05 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-08-14 15:31 - 2015-07-16 21:01 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-08-14 15:31 - 2015-07-16 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-08-14 15:31 - 2015-07-16 20:42 - 01951232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-08-14 15:31 - 2015-07-16 20:38 - 01310720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-08-14 15:31 - 2015-07-16 20:37 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-08-14 15:28 - 2015-07-28 22:09 - 00017344 _____ (Microsoft Corporation) C:\Windows\system32\CompatTelRunner.exe
2015-08-14 15:28 - 2015-07-28 22:05 - 01116672 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-08-14 15:28 - 2015-07-28 22:05 - 00774656 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-08-14 15:28 - 2015-07-28 22:05 - 00743424 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-08-14 15:28 - 2015-07-28 22:05 - 00437760 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-08-14 15:28 - 2015-07-28 22:05 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-08-14 15:28 - 2015-07-28 22:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-08-14 15:28 - 2015-07-28 21:55 - 01148416 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-08-14 15:28 - 2015-07-15 20:15 - 05568960 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-08-14 15:28 - 2015-07-15 20:15 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-08-14 15:28 - 2015-07-15 20:15 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-08-14 15:28 - 2015-07-15 20:15 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-08-14 15:28 - 2015-07-15 20:12 - 01730496 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-08-14 15:28 - 2015-07-15 20:11 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-08-14 15:28 - 2015-07-15 20:11 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-08-14 15:28 - 2015-07-15 20:11 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-08-14 15:28 - 2015-07-15 20:11 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-08-14 15:28 - 2015-07-15 20:11 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 01743360 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 01216512 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00315392 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-08-14 15:28 - 2015-07-15 20:10 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-08-14 15:28 - 2015-07-15 20:10 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\cryptbase.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-08-14 15:28 - 2015-07-15 20:10 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-08-14 15:28 - 2015-07-15 20:10 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-08-14 15:28 - 2015-07-15 20:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-08-14 15:28 - 2015-07-15 20:09 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-08-14 15:28 - 2015-07-15 20:05 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-08-14 15:28 - 2015-07-15 20:05 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 20:00 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:59 - 03989952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-08-14 15:28 - 2015-07-15 19:59 - 03934656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-08-14 15:28 - 2015-07-15 19:56 - 01311768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-08-14 15:28 - 2015-07-15 19:55 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-08-14 15:28 - 2015-07-15 19:55 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-08-14 15:28 - 2015-07-15 19:55 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-08-14 15:28 - 2015-07-15 19:55 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-08-14 15:28 - 2015-07-15 19:55 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-08-14 15:28 - 2015-07-15 19:54 - 00552960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-08-14 15:28 - 2015-07-15 19:54 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-08-14 15:28 - 2015-07-15 19:54 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-08-14 15:28 - 2015-07-15 19:54 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptbase.dll
2015-08-14 15:28 - 2015-07-15 19:54 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-08-14 15:28 - 2015-07-15 19:54 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-08-14 15:28 - 2015-07-15 19:54 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-08-14 15:28 - 2015-07-15 19:53 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-08-14 15:28 - 2015-07-15 19:53 - 00665088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2015-08-14 15:28 - 2015-07-15 19:53 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-08-14 15:28 - 2015-07-15 19:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-08-14 15:28 - 2015-07-15 19:53 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-08-14 15:28 - 2015-07-15 19:53 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-08-14 15:28 - 2015-07-15 19:49 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-08-14 15:28 - 2015-07-15 19:48 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 19:44 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 18:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2015-08-14 15:28 - 2015-07-15 18:46 - 00159232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2015-08-14 15:28 - 2015-07-15 18:46 - 00129024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2015-08-14 15:28 - 2015-07-15 18:37 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-08-14 15:28 - 2015-07-15 18:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-08-14 15:28 - 2015-07-15 18:34 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 18:34 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 18:34 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-08-14 15:28 - 2015-07-15 18:34 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-08-14 14:57 - 2015-07-15 05:19 - 02004992 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2015-08-14 14:57 - 2015-07-15 05:19 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2015-08-14 14:57 - 2015-07-15 05:14 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2015-08-14 14:57 - 2015-07-15 05:13 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2015-08-14 14:57 - 2015-07-15 04:55 - 01390592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2015-08-14 14:57 - 2015-07-15 04:55 - 01241088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2015-08-14 14:57 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2015-08-14 14:57 - 2015-07-15 04:51 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2015-08-14 14:45 - 2015-07-10 19:51 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-08-14 14:45 - 2015-07-10 19:51 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2015-08-14 14:45 - 2015-07-10 19:51 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2015-08-14 14:45 - 2015-07-10 19:34 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-08-14 14:45 - 2015-07-10 19:34 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2015-08-14 14:45 - 2015-07-10 19:33 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2015-08-14 14:44 - 2015-07-15 05:19 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\basesrv.dll
2015-08-14 14:43 - 2015-07-30 20:06 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2015-08-14 14:43 - 2015-07-30 20:06 - 01648128 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-08-14 14:43 - 2015-07-30 20:06 - 01180160 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-08-14 14:43 - 2015-07-30 20:06 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-08-14 14:43 - 2015-07-30 20:06 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-08-14 14:43 - 2015-07-30 20:06 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-08-14 14:43 - 2015-07-30 20:06 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-08-14 14:43 - 2015-07-30 19:57 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2015-08-14 14:43 - 2015-07-30 19:57 - 01251328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-08-14 14:43 - 2015-07-30 19:57 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-08-14 14:43 - 2015-07-30 19:57 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-08-14 14:43 - 2015-07-30 19:57 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-08-14 14:43 - 2015-07-30 19:55 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-08-14 14:43 - 2015-07-30 18:56 - 03208192 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-08-14 14:43 - 2015-07-30 18:52 - 00372736 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-08-14 14:43 - 2015-07-30 18:49 - 00299520 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-08-14 14:43 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\notepad.exe
2015-08-14 14:43 - 2015-07-09 19:57 - 00193536 _____ (Microsoft Corporation) C:\Windows\notepad.exe
2015-08-14 14:43 - 2015-07-09 19:42 - 00179712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
2015-08-14 14:43 - 2015-07-01 22:49 - 00260096 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2015-08-14 14:43 - 2015-07-01 22:48 - 00102912 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2015-08-14 14:43 - 2015-07-01 22:30 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2015-08-14 14:43 - 2015-07-01 22:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2015-08-14 14:41 - 2015-07-10 19:51 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-08-14 14:41 - 2015-07-10 19:34 - 12875776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 03154944 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 02606080 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 00696320 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2015-08-14 14:40 - 2015-07-20 20:12 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\WinSetupUI.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 00037888 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2015-08-14 14:40 - 2015-07-20 20:12 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2015-08-14 14:40 - 2015-07-20 20:12 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\wu.upgrade.ps.dll
2015-08-14 14:40 - 2015-07-20 19:56 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2015-08-14 14:40 - 2015-07-20 19:56 - 00173056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2015-08-14 14:40 - 2015-07-20 19:56 - 00093184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2015-08-14 14:40 - 2015-07-20 19:56 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2015-08-14 14:40 - 2015-07-20 19:56 - 00030208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2015-08-09 20:18 - 2015-08-13 14:56 - 00372550 _____ C:\Users\beTheFellowBee\Desktop\Hausregeln.odt
2015-08-02 22:07 - 2015-08-02 22:08 - 00025202 _____ C:\Users\beTheFellowBee\Desktop\English CV.odt
2015-07-27 20:27 - 2015-04-27 08:02 - 00198448 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\HipShieldK.sys
2015-07-26 18:44 - 2015-07-26 20:48 - 00000128 _____ C:\Users\beTheFellowBee\Desktop\Neues Textdokument.txt
2015-07-26 17:35 - 2015-07-26 17:35 - 00017946 _____ C:\Users\beTheFellowBee\Desktop\Tätigkeitsbeschreibung.odt
2015-07-25 16:09 - 2015-07-25 16:09 - 00000000 ____D C:\Users\Scheer\AppData\Local\GWX
2015-07-24 18:10 - 2015-07-24 18:09 - 00097888 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2015-07-21 16:15 - 2015-07-21 16:15 - 00000000 ____D C:\Program Files\Common Files\AV
2015-07-21 15:07 - 2015-07-21 15:07 - 00095600 _____ C:\Users\beTheFellowBee\Desktop\Untitled 1.odt
2015-07-21 14:58 - 2015-07-21 14:58 - 00000000 ____D C:\Users\beTheFellowBee\AppData\Local\CEF

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2015-08-20 20:27 - 2015-04-14 22:33 - 00000000 ____D C:\FRST
2015-08-20 20:24 - 2010-11-13 18:00 - 00000000 ____D C:\Program Files\P4G
2015-08-20 20:24 - 2010-11-13 17:31 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-08-20 20:23 - 2012-08-16 22:45 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-08-20 20:22 - 2009-07-14 06:45 - 00018832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-08-20 20:22 - 2009-07-14 06:45 - 00018832 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-08-20 20:15 - 2010-11-13 17:31 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-08-20 20:08 - 2010-11-13 17:04 - 02042362 _____ C:\Windows\WindowsUpdate.log
2015-08-20 19:57 - 2015-04-12 18:19 - 00040880 _____ C:\Windows\setupact.log
2015-08-20 19:57 - 2010-11-13 17:50 - 00000000 ____D C:\ProgramData\NVIDIA
2015-08-20 19:57 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-08-20 17:23 - 2012-08-16 22:45 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-08-20 17:23 - 2012-06-08 10:43 - 00778440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-08-20 17:23 - 2012-05-29 16:32 - 00142536 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-08-20 14:53 - 2012-05-29 16:22 - 00000000 ____D C:\Program Files (x86)\McAfee
2015-08-19 19:03 - 2010-11-13 18:00 - 00003088 _____ C:\Windows\system32\ServiceFilter.ini
2015-08-19 18:48 - 2009-08-04 11:51 - 00711546 _____ C:\Windows\system32\perfh007.dat
2015-08-19 18:48 - 2009-08-04 11:51 - 00153736 _____ C:\Windows\system32\perfc007.dat
2015-08-19 18:48 - 2009-07-14 07:13 - 01653060 _____ C:\Windows\system32\PerfStringBackup.INI
2015-08-19 14:22 - 2012-05-29 16:25 - 00000000 ____D C:\Program Files (x86)\Opera
2015-08-18 21:39 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2015-08-18 21:37 - 2012-05-29 15:47 - 00000000 ____D C:\Users\Scheer
2015-08-15 14:01 - 2015-06-14 14:55 - 00000000 ____D C:\Users\beTheFellowBee\Desktop\FeWo
2015-08-14 22:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-08-14 17:50 - 2009-07-14 06:45 - 00297664 _____ C:\Windows\system32\FNTCACHE.DAT
2015-08-14 17:48 - 2014-12-12 18:17 - 00000000 ____D C:\Windows\system32\appraiser
2015-08-14 17:48 - 2014-05-07 16:43 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-08-14 17:31 - 2013-03-13 14:32 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-08-14 17:30 - 2013-03-13 14:31 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-08-14 17:30 - 2013-03-13 14:31 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-08-14 17:25 - 2013-08-14 23:50 - 00000000 ____D C:\Windows\system32\MRT
2015-08-14 17:19 - 2012-05-29 17:29 - 132483416 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-08-14 16:13 - 2015-06-20 15:03 - 00000000 ____D C:\Users\beTheFellowBee\Downloads\Bew. 06-15
2015-08-11 09:34 - 2012-05-30 14:58 - 00004346 _____ C:\Windows\Sandboxie.ini
2015-08-05 14:34 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-08-01 19:55 - 2013-06-18 15:51 - 00000000 ___RD C:\Users\beTheFellowBee\SkyDrive
2015-07-29 21:20 - 2009-07-29 08:03 - 00000000 ____D C:\Windows\Panther
2015-07-29 21:15 - 2015-07-10 19:28 - 00000000 ___HD C:\$Windows.~BT
2015-07-27 20:28 - 2012-05-29 16:22 - 00000000 ____D C:\Program Files\Common Files\McAfee
2015-07-25 16:03 - 2015-04-14 22:37 - 00005750 _____ C:\Windows\PFRO.log
2015-07-25 11:17 - 2015-04-04 23:58 - 00000000 ___SD C:\Windows\system32\GWX
2015-07-24 18:09 - 2014-05-31 23:04 - 00000000 ____D C:\Program Files (x86)\Java
2015-07-21 16:15 - 2012-05-29 16:09 - 00000000 ____D C:\ProgramData\McAfee

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2014-04-10 09:33 - 2014-04-10 09:33 - 0000037 _____ () C:\Users\Scheer\AppData\Roaming\WB.CFG
2012-07-16 02:45 - 2012-07-16 02:45 - 0000870 _____ () C:\Users\Scheer\AppData\Local\recently-used.xbel
2010-11-13 17:19 - 2010-11-13 17:20 - 0000109 _____ () C:\ProgramData\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}.log
2010-11-13 17:21 - 2010-11-13 17:21 - 0000105 _____ () C:\ProgramData\{40BF1E83-20EB-11D8-97C5-0009C5020658}.log
2010-11-13 17:18 - 2010-11-13 17:19 - 0000106 _____ () C:\ProgramData\{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}.log
2010-11-13 17:21 - 2010-11-13 17:21 - 0000107 _____ () C:\ProgramData\{C59C179C-668D-49A9-B6EA-0121CCFC1243}.log
2010-11-13 17:15 - 2010-11-13 17:18 - 0000110 _____ () C:\ProgramData\{CB099890-1D5F-11D5-9EA9-0050BAE317E1}.log
2010-11-13 17:20 - 2010-11-13 17:20 - 0000105 _____ () C:\ProgramData\{d36dd326-7280-11d8-97c8-000129760cbe}.log
2010-11-13 17:13 - 2010-11-13 17:14 - 0000115 _____ () C:\ProgramData\{E3739848-5329-48E3-8D28-5BBD6E8BE384}.log

==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2015-08-12 00:26

==================== Ende von Ergebnis ============================
         

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:20-08-2015
durchgeführt von Scheer (2015-08-20 19:07:51)
Gestartet von C:\Users\beTheFellowBee\Downloads
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1560831024-780671805-4130521857-500 - Administrator - Disabled)
beTheFellowBee (S-1-5-21-1560831024-780671805-4130521857-1002 - Limited - Enabled) => C:\Users\beTheFellowBee
Gast (S-1-5-21-1560831024-780671805-4130521857-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1560831024-780671805-4130521857-1004 - Limited - Enabled)
Scheer (S-1-5-21-1560831024-780671805-4130521857-1001 - Administrator - Enabled) => C:\Users\Scheer

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {DA9F8ED0-D0DE-39CC-F55A-51AB4CC1B556}
AS: McAfee Anti-Virus und Anti-Spyware (Enabled - Up to date) {61FE6F34-F6E4-3642-CFEA-6AD93746FFEB}
FW: McAfee Firewall (Enabled) {E2A40FF5-9AB1-3894-DE05-F89EB212F22D}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

3D-Viewer-innoplus (HKLM-x32\...\{B96DB037-DBEA-4186-9081-9CBD537F82E8}) (Version: 14.00.302 - INNOVA-engineering GmbH)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat Reader DC - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.008.20082 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 17.0.0.144 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Adobe Flash Player 18 PPAPI (HKLM-x32\...\Adobe Flash Player PPAPI) (Version: 18.0.0.232 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (HKLM-x32\...\InstallShield_{1F7424F8-F992-48BC-90EF-7C4DB0405E3F}) (Version: 1.7.17.25416 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.7.17.25416 - Alcor Micro Corp.) Hidden
Apple Application Support (32-Bit) (HKLM-x32\...\{7FE25256-B7C1-480D-B736-10A67A833AEA}) (Version: 3.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{B255D495-4734-4E9B-B4F5-96702FD4A7B9}) (Version: 3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{5D61F006-168C-4B8B-B7FD-F113C10AE0E4}) (Version: 8.2.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ASUS AI Recovery (HKLM-x32\...\{D39F0676-163E-4595-A917-E28F99BBD4D2}) (Version: 1.0.24 - ASUS)
ASUS AP Bank (HKLM-x32\...\ASUS AP Bank_is1) (Version: 1.0.0.0 - ASUSTEK)
ASUS FancyStart (HKLM-x32\...\{2B81872B-A054-48DA-BE3B-FA5C164C303A}) (Version: 1.0.8 - ASUSTeK Computer Inc.)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.1.9 - ASUS)
ASUS Live Update (HKLM-x32\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.9 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 1.1.40 - ASUS)
ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0008 - ASUS)
ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0031 - ASUS)
ASUS Video Magic (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.4015 - CyberLink Corp.)
ASUS Video Magic (x32 Version: 6.0.4015 - CyberLink Corp.) Hidden
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.20 - asus)
ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 2.0.46.1429 - eCareme Technologies, Inc.)
ASUS_N3_Series (HKLM-x32\...\ASUS_N3_Series) (Version: 1.0.0002 - ASUS)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0006 - ASUS)
Boingo Wi-Fi (HKLM-x32\...\{B653A2EC-D816-4498-A4FD-651047AB9DC9}) (Version: 1.7.0048 - Boingo Wireless, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Brother MFL-Pro Suite DCP-L2520DW series (HKLM-x32\...\{F8ECC2FD-CE2B-4ED4-BDCC-90D0D34206FD}) (Version: 0.0.20.0 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.02 - Piriform)
Comodo Dragon (HKLM-x32\...\Comodo Dragon) (Version: 36.1.1.22 - Comodo)
ControlDeck (HKLM-x32\...\{5B65EF64-1DFA-414A-8C94-7BB726158E21}) (Version: 1.0.9 - ASUS)
CyberLink PhotoNow (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.2609a - CyberLink Corp.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )
ETDWare PS/2-x64 7.0.5.16_WHQL (HKLM\...\Elantech) (Version: 7.0.5.16 - ELAN Microelectronics Corp.)
ExpressGate Cloud (HKLM-x32\...\InstallShield_{499DED08-6FA8-4749-8E94-8526CC9D1CA8}) (Version: 2.1.76.380 - Asus)
ExpressGate Cloud (x32 Version: 2.1.76.380 - Asus) Hidden
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.6 - ASUS)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
Fotogalerie (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Fresco Logic USB3.0 Host Controller (HKLM\...\{7F2540AD-FD82-427A-8FDC-33EC53C8B17A}) (Version: 3.0.105.11 - Fresco Logic Inc.)
Game Park Console (HKLM-x32\...\{E71E60C1-533E-45A5-8D80-E475E88D2B17}_is1) (Version: 6.2.1.1 - Oberon Media, Inc.)
Google Chrome (HKLM-x32\...\{69BDE82E-C14F-3309-9813-E5F4E6111920}) (Version: 65.61.49247 - Google, Inc.)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 44.0.2403.155 - Google Inc.)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.28.1 - Google Inc.) Hidden
Governor of Poker (HKLM-x32\...\Governor of Poker) (Version:  - Oberon Media Inc.)
Grand Theft Auto IV (x32 Version: 1.0.0013.131 - Rockstar Games Inc.) Hidden
Hotel Dash Suite Success (HKLM-x32\...\Hotel Dash Suite Success) (Version:  - Oberon Media Inc.)
iCloud (HKLM\...\{709A2D23-C25E-47B5-9268-CB6FEE648504}) (Version: 4.1.1.53 - Apple Inc.)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2189 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{D16A2127-B927-4379-B153-3DEC091E4EEB}) (Version: 13.02.1000 - Intel Corporation)
Intel(R) Turbo Boost Technology Monitor (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.400.4 - Intel)
Intel(R) Wireless Display (HKLM\...\{0D9917CE-1C77-4B58-A153-DCB5A854ED82}) (Version: 1.2.15.0 - Intel Corporation)
iTunes (HKLM\...\{6CF1A7E2-8001-4870-9F18-3C6CDD6FE9E3}) (Version: 12.2.1.16 - Apple Inc.)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
Java 8 Update 40 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218040F0}) (Version: 8.0.400 - Oracle Corporation)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Java 8 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Java 8 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218051F0}) (Version: 8.0.510 - Oracle Corporation)
Jewel Quest 3 (HKLM-x32\...\Jewel Quest 3) (Version:  - Oberon Media Inc.)
Junk Mail filter update (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
Luxor 3 (HKLM-x32\...\Luxor 3) (Version:  - Oberon Media Inc.)
Mahjongg dimensions (HKLM-x32\...\Mahjongg dimensions) (Version:  - Oberon Media Inc.)
McAfee SecurityCenter (HKLM-x32\...\MSC) (Version: 14.0.1076 - McAfee, Inc.)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Starter 2010 - Deutsch (HKLM-x32\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)
Microsoft SkyDrive (HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Movie Maker (x32 Version: 16.4.3508.0205 - Microsoft Corporation) Hidden
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)
Nuance PaperPort 12 (HKLM-x32\...\{869FCC6C-5669-4B0B-827E-2BBAACD88A87}) (Version: 12.1.0006 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 347.09 - NVIDIA Corporation)
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5942 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.1.5 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1.5 - NVIDIA Corporation)
NVIDIA Grafiktreiber 347.09 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 347.09 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.32.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.32.1 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.14.0702 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.14.0702 - NVIDIA Corporation)
OpenOffice 4.1.1 (HKLM-x32\...\{9395F41D-0F80-432E-9A59-B8E477E7E163}) (Version: 4.11.9775 - Apache Software Foundation)
Opera 12.17 (HKLM-x32\...\Opera 12.17.1863) (Version: 12.17.1863 - Opera Software ASA)
Opera Stable 24.0.1558.53 (HKU\S-1-5-21-1560831024-780671805-4130521857-1001\...\Opera 24.0.1558.53) (Version: 24.0.1558.53 - Opera Software ASA)
Opera Stable 24.0.1558.61 (HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\Opera 24.0.1558.61) (Version: 24.0.1558.61 - Opera Software ASA)
Opera Stable 25.0.1614.50 (HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\Opera 25.0.1614.50) (Version: 25.0.1614.50 - Opera Software ASA)
Opera Stable 25.0.1614.71 (HKU\S-1-5-21-1560831024-780671805-4130521857-1001\...\Opera 25.0.1614.71) (Version: 25.0.1614.71 - Opera Software ASA)
Opera Stable 27.0.1689.76 (HKU\S-1-5-21-1560831024-780671805-4130521857-1001\...\Opera 27.0.1689.76) (Version: 27.0.1689.76 - Opera Software ASA)
Opera Stable 28.0.1750.51 (HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\Opera 28.0.1750.51) (Version: 28.0.1750.51 - Opera Software ASA)
Opera Stable 29.0.1795.47 (HKU\S-1-5-21-1560831024-780671805-4130521857-1001\...\Opera 29.0.1795.47) (Version: 29.0.1795.47 - Opera Software ASA)
Opera Stable 31.0.1889.174 (HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\Opera 31.0.1889.174) (Version: 31.0.1889.174 - Opera Software)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 14.00.0000 - Nuance Communications, Inc.)
PDF Architect 3 (HKLM-x32\...\PDF Architect 3) (Version: 3.0.45.22485 - pdfforge GmbH)
PDF Architect 3 Create Module (x32 Version: 3.0.13.22993 - pdfforge GmbH) Hidden
PDF Architect 3 Edit Module (x32 Version: 3.0.13.22993 - pdfforge GmbH) Hidden
PDF Architect 3 View Module (x32 Version: 3.0.13.22993 - pdfforge GmbH) Hidden
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 2.1.2 - pdfforge)
Plants vs Zombies (HKLM-x32\...\Plants vs Zombies) (Version:  - Oberon Media Inc.)
QuickTime 7 (HKLM-x32\...\{627FFC10-CE0A-497F-BA2B-208CAC638010}) (Version: 7.77.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6210 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Sandboxie 4.12 (64-bit) (HKLM\...\Sandboxie) (Version: 4.12 - Sandboxie Holdings, LLC)
Scansoft PDF Professional (x32 Version:  - ) Hidden
Secunia PSI (2.0.0.4003) (HKLM-x32\...\Secunia PSI) (Version: 2.0.0.4003 - Secunia)
Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)
SHIELD Streaming (Version: 3.1.3000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 16.18.9 - NVIDIA Corporation) Hidden
SonicMaster (HKLM-x32\...\{09BCB9CE-964B-4BDA-AE46-B5A0ABEF1D3F}) (Version: 1.00.0000 - Virage Logic, Corp.)
Sweet Home 3D version 4.5 (HKLM\...\Sweet Home 3D_is1) (Version:  - eTeks)
syncables desktop SE (HKLM-x32\...\{341697D8-9923-445E-B42A-529E5A99CB7A}) (Version: 5.5.746.11492 - syncables)
TreeSize Free V3.3.2 (HKLM-x32\...\TreeSize Free_is1) (Version: 3.3.2 - JAM Software)
Update for Image Editor (HKU\S-1-5-21-1560831024-780671805-4130521857-1002\...\DSite) (Version:  - ) <==== ACHTUNG
USB2.0 UVC 2M WebCam (HKLM\...\USB2.0 UVC 2M WebCam) (Version: 5.8.54000.206 - Sonix)
Visual Studio C++ 10.0 Runtime (HKLM-x32\...\{4412F224-3849-4461-A3E9-DEEF8D252790}) (Version: 10.0.0 - TomTom International B.V.)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3508.0205 - Microsoft Corporation)
Windows Live Sync (HKLM-x32\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.31.0 - ASUS)
Wireless Console 3 (HKLM-x32\...\{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}) (Version: 3.0.19 - ASUS)

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

CustomCLSID: HKU\S-1-5-21-1560831024-780671805-4130521857-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\beTheFellowBee\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1560831024-780671805-4130521857-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\beTheFellowBee\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1560831024-780671805-4130521857-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\beTheFellowBee\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1560831024-780671805-4130521857-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\beTheFellowBee\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Wiederherstellungspunkte =========================

14-08-2015 13:57:10 Windows Update
14-08-2015 17:17:24 Windows Update
18-08-2015 03:00:18 Windows Update
19-08-2015 19:26:13 Windows Update

==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2014-10-18 01:41 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {010E47F2-1E11-450B-9C01-E64A2C2BCFA6} - System32\Tasks\{33A56B08-821C-41BE-91DA-E0757A0B6BF6} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\GTAIV.exe
Task: {057B6E30-2EF0-480D-87CE-A1842CD4E456} - System32\Tasks\{068AAA21-0641-41C1-8EAA-0F75EDAA58A7} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {0FAD9CCC-6D64-4ABD-8CA1-A63D08BB8971} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16] (Google Inc.)
Task: {1BA2B7AF-B7A6-4C37-AE7D-2999BBA53278} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {1BD752A2-F961-4D5F-AE70-BF57C132F6F3} - System32\Tasks\{506CDB96-827C-4455-80CA-5C28799140B7} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {1E0BFC3A-29DB-4F8D-B8D6-2BDE62BADC6D} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-07-07] (Adobe Systems Incorporated)
Task: {2715573E-9B56-4827-A121-13233C59B3DB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-08-20] (Adobe Systems Incorporated)
Task: {278A6EF8-8137-4B9F-B0EB-A074259E2860} - System32\Tasks\{0EC522C9-12AC-4CC4-AA7E-14DB8E765F8D} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {33B9BA4A-8479-44AD-B11F-3199060A9B9A} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-09-30] (asus)
Task: {3EED291C-754F-4163-AABD-9986A5CED9E0} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-08-12] (ASUS)
Task: {405F7652-C710-4A14-ABD3-301651AD8555} - System32\Tasks\{6098EE44-C6B1-4824-8CF5-9399326AAFAC} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {4562B44D-9046-4073-8071-BF24923C91CE} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {58473D1D-D439-46F9-A8AE-4ECF13D834B6} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {5F1321C1-7D5A-422B-AAE7-3EA8CF5C26ED} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-01-20] (Piriform Ltd)
Task: {6A7FCCF1-9EF0-4C97-AF70-80EE1C5A1752} - System32\Tasks\Opera scheduled Autoupdate 1384201802 => C:\Program Files (x86)\Opera\launcher.exe [2015-08-17] (Opera Software)
Task: {6E3DCC2D-50A6-4B9E-BBAA-038C0F5AA541} - System32\Tasks\ASUS Patch 10430001 => C:\Windows\AsPatch10430001.exe
Task: {6F865EEE-93EF-4E3C-AF58-81EFA798B330} - System32\Tasks\{08E77359-8A61-4574-B619-03877F12F806} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {8F5A7594-7B88-4096-894A-F33E91AB4E55} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-16] (Google Inc.)
Task: {B4B188EB-FDFA-4E4D-820C-455DF7E3DEF2} - System32\Tasks\{C56502D8-BB5B-438C-B517-CBC10E7761B3} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {B54F92A0-6539-48EE-AC1F-481B374D3DBE} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-18] (ASUS)
Task: {D4936DF1-99E0-4299-AE98-2CBBEC279E6D} - System32\Tasks\{FF87EAD2-778A-40BD-8AB4-A0E065A0B2D6} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {D4F9C756-319B-4B2B-A642-018A245B23F0} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: {D5827A25-5A4E-4631-AB1D-40F854EA43CA} - System32\Tasks\AIRecoveryRemind => C:\Program Files (x86)\ASUS\AI Recovery\AIRecoveryRemind.exe [2012-03-09] (ASUSTek Computer Inc.)
Task: {DBC594AE-80B1-4F90-AB9B-63D1E37831B9} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2010-08-02] (ASUS)
Task: {DCEA0B5F-367B-4738-AF31-BFEC3FC2B471} - System32\Tasks\{4CB84E3F-20D6-4B54-9251-67B94C378009} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {DF3D12A0-889B-4A95-AE6A-8AC8C129BEB0} - System32\Tasks\{D34710BD-9198-4C15-BC12-AE7686DE31F4} => pcalua.exe -a C:\Users\Scheer\AppData\Local\Temp\jre-8u20-windows-au.exe -d C:\Windows\SysWOW64 -c /installmethod=jau FAMILYUPGRADE=1
Task: {E9C5A23A-33BE-46EC-BC3D-11D816C2E6E5} - System32\Tasks\{75584341-387B-4507-B002-6FE4A73EAB8D} => C:\Program Files (x86)\Rockstar Games\Grand Theft Auto IV\LaunchGTAIV.exe
Task: {F05F5C35-94BB-432F-B9DE-409766EF26D2} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2015-02-10] (Oracle Corporation)
Task: {F8AF292A-8587-4F12-A219-D2BFA73F71D8} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2012-10-13 14:09 - 2014-12-13 10:03 - 00117576 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-03-05 19:21 - 2010-03-05 19:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2015-01-20 23:35 - 2015-01-20 23:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-05-15 16:26 - 2015-05-15 16:26 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-20 16:59 - 2005-04-22 06:36 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2010-08-21 04:47 - 2010-08-21 04:47 - 00077312 _____ () C:\ExpressGateUtil\VAWinService.exe
2010-03-16 03:48 - 2010-03-16 03:48 - 00148816 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\EcaremeDLL.dll
2010-11-13 17:34 - 2010-11-13 17:34 - 00030032 _____ () C:\Windows\assembly\GAC_MSIL\SqliteShared\1.0.3726.20828__0d0f4b69e50e559b\SqliteShared.dll
2010-11-13 17:34 - 2010-11-13 17:34 - 00931840 _____ () C:\Windows\assembly\GAC_64\System.Data.SQLite\1.0.60.0__db937bc2d44ff139\System.Data.SQLite.dll
2010-11-13 17:14 - 2010-04-06 08:29 - 00244904 _____ () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
2010-03-16 03:48 - 2010-03-16 03:48 - 01754448 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe
2010-03-05 19:21 - 2010-03-05 19:21 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-04-10 17:40 - 2011-04-10 17:40 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2010-08-13 03:52 - 2010-08-13 03:52 - 00021504 _____ () C:\ExpressGateUtil\VAWinAgent.exe
2010-09-23 17:53 - 2010-09-23 17:53 - 01601536 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
2010-08-13 03:52 - 2010-08-13 03:52 - 00151552 _____ () C:\ExpressGateUtil\libexpat.dll
2010-08-13 03:52 - 2010-08-13 03:52 - 00057344 _____ () C:\ExpressGateUtil\netProfileDatabase.DLL
2014-07-29 20:02 - 2014-12-13 12:08 - 00012104 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2009-11-03 00:20 - 2009-11-03 00:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-03 00:23 - 2009-11-03 00:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2015-08-19 14:22 - 2015-08-19 13:32 - 58600568 _____ () C:\Program Files (x86)\Opera\31.0.1889.174\opera.dll
2010-07-01 12:21 - 2010-07-01 12:21 - 00204800 _____ () C:\Program Files (x86)\asus\VirtualCamera\virtualCamera.ax
2015-08-19 14:22 - 2015-08-19 13:32 - 01781368 _____ () C:\Program Files (x86)\Opera\31.0.1889.174\libglesv2.dll
2015-08-19 14:22 - 2015-08-19 13:32 - 00081528 _____ () C:\Program Files (x86)\Opera\31.0.1889.174\libegl.dll
2015-08-20 17:23 - 2015-08-20 17:23 - 16392904 _____ () C:\Windows\SysWOW64\Macromed\Flash\pepflashplayer32_18_0_0_232.dll

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)


==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeaack.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfeavfk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfemms => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfetdi2k.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1560831024-780671805-4130521857-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Scheer\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-1560831024-780671805-4130521857-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\beTheFellowBee\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{CB35A907-6B0D-4108-9653-91792E586B1C}] => (Allow) LPort=5353
FirewallRules: [{C45C989B-AE92-4D6A-B893-1C91EDAD8C92}] => (Allow) LPort=8182
FirewallRules: [{1171780A-BDC6-4B28-B841-41BBD020E27C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{00DE9BF0-3163-4017-AD7F-2AF099C90706}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{6330F768-46D5-41C9-8B88-DFD9FA76B376}] => (Allow) C:\Program Files (x86)\Intel Corporation\Intel Wireless Display\WiDiApp.exe
FirewallRules: [{551EFA13-3F21-4420-9C9F-F35E73756B7D}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{4986DF40-29EC-4D97-AADA-8BBD22D89CCB}] => (Allow) svchost.exe
FirewallRules: [{FB256BCA-B5EA-459B-BA8A-FBAAFCDC5584}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe
FirewallRules: [{CC0D0680-3E4D-4A48-B2CB-FFC6D074781A}] => (Allow) C:\Program Files (x86)\Opera\opera.exe
FirewallRules: [{39EAFFB4-7D45-4E20-AA15-D89AC23B90A8}] => (Allow) C:\Program Files (x86)\Opera\opera.exe
FirewallRules: [{05E9281C-9A92-482B-88A1-A2331F7BC402}] => (Allow) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
FirewallRules: [{62EEC5AC-9720-4318-8800-B5CD40EF119C}] => (Allow) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
FirewallRules: [{54E1C881-BE93-44A5-A19A-08E53F51BD48}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{52E3DA42-C2A3-4BB2-8A65-F409CC6A1F9E}] => (Allow) LPort=2869
FirewallRules: [{CF172D31-DD47-4B34-A275-8864F08C89AB}] => (Allow) LPort=1900
FirewallRules: [{EBE2BC4E-4DA1-400B-B3AF-BD16ABFE9EB8}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{BBE96445-B5CE-4335-88FD-D938D35A954A}] => (Allow) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe
FirewallRules: [{5A8F780E-C2C2-42B3-BABD-C1F77B310E65}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9CC83EA6-6AD7-4E27-9E52-56510CD25AA8}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{4ED1F8F2-7EBD-4124-BFEB-39C2B71CE56D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{4346ED67-7093-4241-B25F-89461FBE9B73}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{97B380B5-37CF-4364-883F-DBCBA71DBCF8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{164BBEBF-16D3-47C4-8ED0-A2B02D94EE4A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{B37AA034-E6F7-45D9-A90E-CBAF4DB0AA37}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{01CEB317-AAE8-451A-9909-FE9ED07A49CA}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{62E470FE-7C78-4E47-8F16-7AFEE6C706FE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{E596E586-3D56-4F08-9585-027C69D287C7}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{1B85F07A-A34D-4218-8AF5-805B621D18C6}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
FirewallRules: [{940A52BF-AAE4-438C-A7B4-F5252D90BF41}] => (Allow) LPort=54925
FirewallRules: [{A79AA92C-2992-4790-9558-E82C291D4FC1}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{2321C4A3-7F0A-4B5E-9842-1FE3C019C69C}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (08/20/2015 06:30:03 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (08/20/2015 06:29:16 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (08/20/2015 02:56:00 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (08/20/2015 02:55:30 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (08/19/2015 06:44:11 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Stream product id=0x0066): Streaming Failed

Error: (08/19/2015 06:43:40 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Too many failures while downloading ranges: 2

Error: (08/19/2015 01:25:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 52487410

Error: (08/19/2015 01:25:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 52487410

Error: (08/19/2015 01:25:40 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/18/2015 09:32:52 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:


Systemfehler:
=============
Error: (08/20/2015 06:43:08 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80240020 fehlgeschlagen: Upgrade auf Windows 10 Home

Error: (08/20/2015 06:26:14 PM) (Source: SbieDrv) (EventID: 1412) (User: )
Description: SBIE1412 Im Text: [ReasonSandboxInstaller] \??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%

Error: (08/20/2015 06:26:14 PM) (Source: SbieDrv) (EventID: 1406) (User: )
Description: SBIE1406 Falsche oder ungültige Erweiterung für SystemDrive: [C0000189]

Error: (08/20/2015 06:26:14 PM) (Source: SbieDrv) (EventID: 1412) (User: )
Description: SBIE1412 Im Text: [DefaultBox] \??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%

Error: (08/20/2015 06:26:14 PM) (Source: SbieDrv) (EventID: 1406) (User: )
Description: SBIE1406 Falsche oder ungültige Erweiterung für SystemDrive: [C0000189]

Error: (08/20/2015 06:26:14 PM) (Source: SbieDrv) (EventID: 1412) (User: )
Description: SBIE1412 Im Text: [ReasonSandboxInstaller] \??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%

Error: (08/20/2015 06:26:14 PM) (Source: SbieDrv) (EventID: 1406) (User: )
Description: SBIE1406 Falsche oder ungültige Erweiterung für SystemDrive: [C0000189]

Error: (08/20/2015 06:26:13 PM) (Source: SbieDrv) (EventID: 1412) (User: )
Description: SBIE1412 Im Text: [DefaultBox] \??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%

Error: (08/20/2015 06:26:13 PM) (Source: SbieDrv) (EventID: 1406) (User: )
Description: SBIE1406 Falsche oder ungültige Erweiterung für SystemDrive: [C0000189]

Error: (08/20/2015 06:26:12 PM) (Source: SbieDrv) (EventID: 1412) (User: )
Description: SBIE1412 Im Text: [ReasonSandboxInstaller] \??\%SystemDrive%\Sandbox\%USER%\%SANDBOX%


Microsoft Office:
=========================
Error: (08/20/2015 06:30:03 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (08/20/2015 06:29:16 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Too many failures while downloading ranges: 2

Error: (08/20/2015 02:56:00 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (08/20/2015 02:55:30 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Too many failures while downloading ranges: 2

Error: (08/19/2015 06:44:11 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Stream product id=0x0066): Streaming Failed

Error: (08/19/2015 06:43:40 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Too many failures while downloading ranges: 2

Error: (08/19/2015 01:25:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 52487410

Error: (08/19/2015 01:25:42 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 52487410

Error: (08/19/2015 01:25:40 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/18/2015 09:32:52 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed:


CodeIntegrity:
===================================
  Date: 2014-10-18 01:35:12.484
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-10-18 01:35:12.421
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-10-18 01:35:12.343
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-10-18 01:35:12.265
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-10 19:51:38.769
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-10 19:51:38.754
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-10 19:51:38.754
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Common Files\McAfee\VSCore\mfeelamk.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-09 23:32:53.928
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-09 23:32:53.819
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Speicherinformationen =========================== 

Processor: Intel(R) Core(TM) i5 CPU M 460 @ 2.53GHz
Prozentuale Nutzung des RAM: 86%
Installierter physikalischer RAM: 3884.48 MB
Verfügbarer physikalischer RAM: 542.99 MB
Summe virtueller Speicher: 7767.16 MB
Verfügbarer virtueller Speicher: 2998.52 MB

==================== Laufwerke ================================

Drive c: (OS) (Fixed) (Total:116.44 GB) (Free:43.14 GB) NTFS ==>[System mit Startkomponenten (eingeholt von lesen Laufwerk)]
Drive d: (Data) (Fixed) (Total:327.83 GB) (Free:175.85 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E0C5913D)
Partition 1: (Not Active) - (Size=21.5 GB) - (Type=1C)
Partition 2: (Active) - (Size=116.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=327.8 GB) - (Type=OF Extended)

==================== Ende von Ergebnis ============================
         

Hi,

Dokument Bitte zippen und anhaengen.

Downloade dir bitte Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

• Starte bitte die mbar.exe.
• Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
• Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
• Klicke auf den CleanUp Button und erlaube den Neustart.
• Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
• Nach dem Neustart starte die mbar.exe erneut.
• Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-08-21 10:34:26
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0003 465,76GB
Running: Gmer-19357 (1).exe; Driver: C:\Users\Scheer\AppData\Local\Temp\ufdiqpow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17           0000000075281401 2 bytes JMP 772eb20b C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17             0000000075281419 2 bytes JMP 772eb336 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17           0000000075281431 2 bytes JMP 77368f39 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42           000000007528144a 2 bytes CALL 772c4885 C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                                               * 9
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17              00000000752814dd 2 bytes JMP 77368832 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17       00000000752814f5 2 bytes JMP 77368a08 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17              000000007528150d 2 bytes JMP 77368728 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17       0000000075281525 2 bytes JMP 77368af2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17             000000007528153d 2 bytes JMP 772dfc98 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                  0000000075281555 2 bytes JMP 772e68df C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17           000000007528156d 2 bytes JMP 77368ff1 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17             0000000075281585 2 bytes JMP 77368b52 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                000000007528159d 2 bytes JMP 773686ec C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17             00000000752815b5 2 bytes JMP 772dfd31 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17           00000000752815cd 2 bytes JMP 772eb2cc C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20       00000000752816b2 2 bytes JMP 77368eb4 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2344] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31       00000000752816bd 2 bytes JMP 77368681 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe[4428] C:\Windows\system32\kernel32.dll!LoadLibraryW                          00000000774464a0 5 bytes JMP 000000016d70ebf0
.text   C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe[4428] C:\Windows\system32\kernel32.dll!LoadLibraryA                          0000000077446590 5 bytes JMP 000000016d70ead0
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      0000000075281401 2 bytes JMP 772eb20b C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        0000000075281419 2 bytes JMP 772eb336 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      0000000075281431 2 bytes JMP 77368f39 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      000000007528144a 2 bytes CALL 772c4885 C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                                               * 9
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000752814dd 2 bytes JMP 77368832 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000752814f5 2 bytes JMP 77368a08 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         000000007528150d 2 bytes JMP 77368728 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  0000000075281525 2 bytes JMP 77368af2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        000000007528153d 2 bytes JMP 772dfc98 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             0000000075281555 2 bytes JMP 772e68df C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      000000007528156d 2 bytes JMP 77368ff1 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        0000000075281585 2 bytes JMP 77368b52 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           000000007528159d 2 bytes JMP 773686ec C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000752815b5 2 bytes JMP 772dfd31 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000752815cd 2 bytes JMP 772eb2cc C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000752816b2 2 bytes JMP 77368eb4 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000752816bd 2 bytes JMP 77368681 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                       00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                         00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                         00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                        00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                  000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                     0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                   0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                       0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                          0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\USER32.dll!CreateWindowExW                          0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                      0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                      000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                 00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo               00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                  0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                    0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                         0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\ole32.dll!CoCreateInstance                          0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                 0000000075281401 2 bytes JMP 772eb20b C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                   0000000075281419 2 bytes JMP 772eb336 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                 0000000075281431 2 bytes JMP 77368f39 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                 000000007528144a 2 bytes CALL 772c4885 C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                                               * 9
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                    00000000752814dd 2 bytes JMP 77368832 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17             00000000752814f5 2 bytes JMP 77368a08 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                    000000007528150d 2 bytes JMP 77368728 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17             0000000075281525 2 bytes JMP 77368af2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                   000000007528153d 2 bytes JMP 772dfc98 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                        0000000075281555 2 bytes JMP 772e68df C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                 000000007528156d 2 bytes JMP 77368ff1 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                   0000000075281585 2 bytes JMP 77368b52 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                      000000007528159d 2 bytes JMP 773686ec C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                   00000000752815b5 2 bytes JMP 772dfd31 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                 00000000752815cd 2 bytes JMP 772eb2cc C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20             00000000752816b2 2 bytes JMP 77368eb4 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31             00000000752816bd 2 bytes JMP 77368681 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                                   00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                                     00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                     00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                                    00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                            0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                            0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                              000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                 0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                               0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                   0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                      0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                              0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                      0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                  0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                                  000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                                             00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                           00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                     0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                      0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                             0000000075281401 2 bytes JMP 772eb20b C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                               0000000075281419 2 bytes JMP 772eb336 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                             0000000075281431 2 bytes JMP 77368f39 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                             000000007528144a 2 bytes CALL 772c4885 C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                                               * 9
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                00000000752814dd 2 bytes JMP 77368832 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                         00000000752814f5 2 bytes JMP 77368a08 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                000000007528150d 2 bytes JMP 77368728 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                         0000000075281525 2 bytes JMP 77368af2 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                               000000007528153d 2 bytes JMP 772dfc98 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                    0000000075281555 2 bytes JMP 772e68df C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                             000000007528156d 2 bytes JMP 77368ff1 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                               0000000075281585 2 bytes JMP 77368b52 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                  000000007528159d 2 bytes JMP 773686ec C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                               00000000752815b5 2 bytes JMP 772dfd31 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                             00000000752815cd 2 bytes JMP 772eb2cc C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                         00000000752816b2 2 bytes JMP 77368eb4 C:\Windows\syswow64\kernel32.dll
.text   C:\Windows\AsScrPro.exe[4932] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                         00000000752816bd 2 bytes JMP 77368681 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                           00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                             00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                             00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                            00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                    0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                    0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                      000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                         0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                       0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                           0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                              0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                     0000000075281401 2 bytes JMP 772eb20b C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                       0000000075281419 2 bytes JMP 772eb336 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                     0000000075281431 2 bytes JMP 77368f39 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                     000000007528144a 2 bytes CALL 772c4885 C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                                               * 9
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                        00000000752814dd 2 bytes JMP 77368832 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                 00000000752814f5 2 bytes JMP 77368a08 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                        000000007528150d 2 bytes JMP 77368728 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                 0000000075281525 2 bytes JMP 77368af2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                       000000007528153d 2 bytes JMP 772dfc98 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                            0000000075281555 2 bytes JMP 772e68df C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                     000000007528156d 2 bytes JMP 77368ff1 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                       0000000075281585 2 bytes JMP 77368b52 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                          000000007528159d 2 bytes JMP 773686ec C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                       00000000752815b5 2 bytes JMP 772dfd31 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                     00000000752815cd 2 bytes JMP 772eb2cc C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                 00000000752816b2 2 bytes JMP 77368eb4 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                 00000000752816bd 2 bytes JMP 77368681 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                              0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                          0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                          000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                     00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                   00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                      0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                        0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                             0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[5336] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                              0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                               00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                 00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                 00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                        0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                        0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                          000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                             0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                           0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                               0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                  0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                  0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                              0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                              000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                         00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                       00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                          0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                            0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                 0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo Wi-Fi.exe[2372] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                  0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                               00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                 00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                 00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                        0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                        0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                          000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                             0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                           0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                               0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                  0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                 0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                  0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                          0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                            0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                  0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                              0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                              000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                         00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\ASUS\SonicMaster\SonicMasterTray.exe[8352] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                       00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                              00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                               00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                       0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                       0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                         000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                            0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                          0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                              0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                 0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                 0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                             0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                             000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                        00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                      00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                         0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                           0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe[8240] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                 0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                       00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                         00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                         00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                        00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                  000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                     0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                   0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                       0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                          0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\USER32.dll!CreateWindowExW                          0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                      0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                      000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                 00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo               00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                  0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                    0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                         0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe[7060] C:\Windows\syswow64\ole32.dll!CoCreateInstance                          0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                         00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                           00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                           00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                          00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                  0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                  0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                    000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                       0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                     0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                         0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                            0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                            0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                        0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                        000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                                   00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                                 00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                    0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                      0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                           0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\ExpressGateUtil\VAWinAgent.exe[3468] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                            0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                               00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                 00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                 00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                        0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                        0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                          000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                             0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                           0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                               0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                  0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                  0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                              0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                              000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                         00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                       00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                          0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                            0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                 0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe[4776] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                  0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                      00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                        00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                        00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                       00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                               0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                               0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                 000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                    0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                  0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                      0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                         0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                         0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                     0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                     000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                              00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                 0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                   0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                        0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[3760] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                         0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                             00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                               00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                               00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                              00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                      0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                      0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                        000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                           0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                         0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                             0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\user32.DLL!CreateWindowExW                                0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\user32.DLL!EnumDisplayDevicesA                            0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\user32.DLL!EnumDisplayDevicesW                            000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\user32.DLL!ChangeDisplaySettingsExW                       00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\user32.DLL!DisplayConfigGetDeviceInfo                     00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                               0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[6376] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                        00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                          00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                          00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                         00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                 0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                 0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                   000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                      0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                    0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                        0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                           0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                           0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                       0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                       000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                  00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                   0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                     0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                  0000000075281401 2 bytes JMP 772eb20b C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                    0000000075281419 2 bytes JMP 772eb336 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                  0000000075281431 2 bytes JMP 77368f39 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                  000000007528144a 2 bytes CALL 772c4885 C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                                               * 9
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                     00000000752814dd 2 bytes JMP 77368832 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                              00000000752814f5 2 bytes JMP 77368a08 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                     000000007528150d 2 bytes JMP 77368728 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                              0000000075281525 2 bytes JMP 77368af2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                    000000007528153d 2 bytes JMP 772dfc98 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                         0000000075281555 2 bytes JMP 772e68df C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                  000000007528156d 2 bytes JMP 77368ff1 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                    0000000075281585 2 bytes JMP 77368b52 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                       000000007528159d 2 bytes JMP 773686ec C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                    00000000752815b5 2 bytes JMP 772dfd31 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                  00000000752815cd 2 bytes JMP 772eb2cc C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                              00000000752816b2 2 bytes JMP 77368eb4 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                              00000000752816bd 2 bytes JMP 77368681 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                          0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe[5128] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                           0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                     00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                       00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                       00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                      00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                              0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                              0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                   0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                 0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                     0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                        0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                        0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                    0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                    000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                               00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                             00000000770b7a5c 5 bytes JMP 0000000173d934d0
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                  0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                       0000000076af5ea5 5 bytes JMP 0000000173d92c10
.text   C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[5152] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                        0000000076b29d0b 5 bytes JMP 0000000173d92ba0
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                      00000000772c1eee 7 bytes JMP 0000000173d93d10
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                        00000000772c5b85 7 bytes JMP 0000000173d946b0
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                        00000000772d13e1 7 bytes JMP 0000000173d94050
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                       00000000772dea35 7 bytes JMP 0000000173d93d00
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                               0000000077368eb4 7 bytes JMP 0000000173d937c0
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                               0000000077368f39 5 bytes JMP 0000000173d93870
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                 000000007736928f 5 bytes JMP 0000000173d937d0
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                    0000000076411d29 5 bytes JMP 0000000173d93780
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                  0000000076411dd7 5 bytes JMP 0000000173d93740
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                      0000000076412ab1 5 bytes JMP 0000000173d93880
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                         0000000076412d1d 5 bytes JMP 0000000173d93560
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                 0000000076ead2b4 5 bytes JMP 0000000173d92d70
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                   0000000076ead4ee 5 bytes JMP 0000000173d92d80
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                         0000000077058a29 5 bytes JMP 0000000173d92c50
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                     0000000077064572 5 bytes JMP 0000000173d934e0
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                     000000007707e567 5 bytes JMP 0000000173d93550
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                00000000770a07d7 5 bytes JMP 0000000173d92a60
.text   C:\Users\beTheFellowBee\Downloads\Gmer-19357 (1).exe[1220] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                              00000000770b7a5c 5 bytes JMP 0000000173d934d0

---- Threads - GMER 2.1 ----

Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3816:4288]                                                        000000006e77785a
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3816:4296]                                                        000000006e4bff83
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3816:4344]                                                        000000006e4bff83
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3816:4348]                                                        000000006e4b6447
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3816:4420]                                                        000000006e72247a
Thread  C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [3816:6412]                                                        000000006e4bff83

---- EOF - GMER 2.1 ----
         

Malwarebytes Anti-Rootkit BETA 1.9.2.1008
www.malwarebytes.org

Database version:
  main:    v2015.08.21.03
  rootkit: v2015.08.16.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17959
Scheer :: SCHEER-PC [administrator]

21.08.2015 10:50:41
mbar-log-2015-08-21 (10-50-41).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 430348
Time elapsed: 41 minute(s), 4 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

Dokument Bitte zippen und anhaengen.

???

Habe es jetzt mal versucht.
VG

Ich meinte das Bewerbungsdokument, welches angeblich verseucht sein soll

Hallo,
das kann ich nicht tun, das sind ja meine Bewerbungsunterlagen.

Ich versuche aber, da ich die ja selber erstellt habe, ein identisches Dokument zu erstellen (welches ich dann auf betreffender Homepage versuche hochzuladen) und bei Fehlermeldung bei deren System hier zu posten.

VG
timo

Ok, mach das. Kannst ja auch einfach das bestehende editieren und hochladen

Hi Schrauber,

die Upload-Funktion stand leider nicht mehr zur Verfügung. Deswegen funktioniert das wohl nicht, wie angedacht.

Evtl. muss ich jetzt einfach mal abwarten. Die durchgeführten Scans brachten ja auch bisher kein Ergebnis.

Vielen Dank für Deine Hilfe.

Viele Grüße
Timo

ok.