Firefox stellt permanent neue Verbindung zu Werbeseiten her

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:30-09-2015
durchgeführt von Henrik (2015-10-01 12:25:41)
Gestartet von C:\Users\Henrik\Downloads
Windows 8.1 (X64) (2014-04-22 16:32:55)
Start-Modus: Normal
==========================================================
 
 
==================== Konten: =============================
 
Administrator (S-1-5-21-3422952177-23914602-504830955-500 - Administrator - Disabled)
Gast (S-1-5-21-3422952177-23914602-504830955-501 - Limited - Disabled)
Henrik (S-1-5-21-3422952177-23914602-504830955-1002 - Administrator - Enabled) => C:\Users\Henrik
HomeGroupUser$ (S-1-5-21-3422952177-23914602-504830955-1004 - Limited - Enabled)
UpdatusUser (S-1-5-21-3422952177-23914602-504830955-1001 - Limited - Enabled) => C:\Users\UpdatusUser
Vanessa (S-1-5-21-3422952177-23914602-504830955-1005 - Limited - Enabled) => C:\Users\Vanessa
 
==================== Sicherheits-Center ========================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 
AV: Kaspersky Total Security (Enabled - Up to date) {179979E8-273D-D14E-0543-2861940E4886}
AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Kaspersky Total Security (Enabled - Up to date) {ACF8980C-0107-DEC0-3FF3-1313EF89023B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Total Security (Enabled) {2FA2F8CD-6D52-D016-2E1C-81546ADD0FFD}
 
==================== Installierte Programme ======================
 
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Amazon Music (HKU\S-1-5-21-3422952177-23914602-504830955-1002\...\Amazon Amazon Music) (Version: 3.10.0.928 - Amazon Services LLC)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 5.10 - Piriform)
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.65.2.0 - Conexant)
DTS Studio Sound (HKLM-x32\...\{2DFA9084-CEB3-4A48-B9F7-9038FEF1B8F4}) (Version: 1.01.2700 - DTS, Inc.)
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )
Evernote (HKLM-x32\...\Evernote) (Version: 1.0.0 - Evernote Launcher by Toshiba Europe GmbH)
Google Earth (HKLM-x32\...\{817750FA-EC6A-485D-9901-0683AE6FFDF1}) (Version: 7.1.5.1557 - Google)
Google Update Helper (x32 Version: 1.3.28.15 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.14.1724 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3308 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM\...\{409CB30E-E457-4008-9B1A-ED1B9EA21140}) (Version: 12.8.2.1000 - Intel Corporation)
Intel(R) Wireless Bluetooth(R) 4.0 (HKLM-x32\...\{DB7DE66A-4D70-400A-8895-EE113B12968A}) (Version: 3.0.1339.04 - Intel Corporation)
Intel® PROSet/Wireless Software (HKLM-x32\...\{72814a2c-2e03-4a50-b30a-43e7884b3934}) (Version: 16.5.1 - Intel Corporation)
Internet Download Manager² 1.0 (HKLM-x32\...\IDMSQ) (Version: 1.0 - OR Interactive Ltd)
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Kaspersky Total Security (HKLM-x32\...\InstallWIX_{02FECEE0-16B2-43DB-BC3B-C844477FC142}) (Version: 15.0.2.361 - Kaspersky Lab)
Kaspersky Total Security (x32 Version: 15.0.2.361 - Kaspersky Lab) Hidden
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Media Go (HKLM-x32\...\{F66C4A41-C3A8-4523-AB6C-BAA1DB38305C}) (Version: 2.7.357 - Sony)
Media Go Network Downloader (HKLM-x32\...\{5562F05F-908C-4F15-9B3C-98D5FD32DCAB}) (Version: 1.5.19.0 - Sony)
Media Go Video Playback Engine 2.4.128.12060 (HKLM-x32\...\{7C5AEEE1-6D7C-8922-4548-7BF9096077EC}) (Version: 2.4.128.12060 - Sony)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4753.1003 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3422952177-23914602-504830955-1002\...\OneDriveSetup.exe) (Version: 17.3.5951.0827 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{d07b0db5-8dad-40e1-be90-88026298a46b}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{2749c485-3a8b-4533-92ff-7cf6e8221cff}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)
Microsoft-Maus- und Tastatur-Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)
Mozilla Firefox 39.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 39.0 (x86 de)) (Version: 39.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
NVIDIA GeForce Experience 1.6.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.6.1 - NVIDIA Corporation)
NVIDIA Graphics Driver 326.60 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 326.60 - NVIDIA Corporation)
NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NWZ-W270S WALKMAN Guide (HKLM-x32\...\{2DD336BD-D504-4AD7-AA03-201114C24495}) (Version: 2.2.0.07230 - Sony Corporation)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4753.1003 - Microsoft Corporation) Hidden
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29068 - Realtek Semiconductor Corp.)
Shopping Helper Smartbar Engine (HKU\S-1-5-21-3422952177-23914602-504830955-1002\...\{f978ce17-ec3c-4d9d-b7e9-2f0a9d22db9b}) (Version: 10.215.63.15249 - ReSoft Ltd.) <==== ACHTUNG
Spotify (HKLM-x32\...\Spotify) (Version: 0.8.5.1333.g822e0de8 - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.10.1 - Synaptics Incorporated)
TOSHIBA Addendum (HKLM-x32\...\{C1569944-FAD6-4B3B-85E5-C213C2FF8EFC}) (Version: 1.00 - TOSHIBA)
TOSHIBA Blu-ray Disc Player (HKLM\...\{FF07604E-C860-40E9-A230-E37FA41F103A}) (Version: 1.0.5.175 - Toshiba Corporation)
TOSHIBA Desktop Assist (HKLM\...\{95CCACF0-010D-45F0-82BF-858643D8BC02}) (Version: 1.02.01.6407 - Toshiba Corporation)
TOSHIBA Display Utility (HKLM\...\{5F6AC07E-50EF-422E-B56E-6521E5B35139}) (Version: 1.1.12.0 - Toshiba Corporation)
TOSHIBA eco Utility (HKLM\...\{5944B9D4-3C2A-48DE-931E-26B31714A2F7}) (Version: 2.2.0.6404 - Toshiba Corporation)
TOSHIBA Function Key (HKLM\...\{16562A90-71BC-41A0-B890-D91B0C267120}) (Version: 1.1.0001.6403 - Toshiba Corporation)
TOSHIBA Gesture Controller (HKLM-x32\...\{8C5B4504-3996-4F30-8F01-DA7A8455430B}) (Version: 4.0.110.2 - Toshiba Corporation)
TOSHIBA HDD Protection (HKLM\...\{94A90C69-71C1-470A-88F5-AA47ECC96B40}) (Version: 2.5.0003.64001 - Toshiba Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.10 - TOSHIBA)
TOSHIBA Password Utility (HKLM-x32\...\InstallShield_{26BB68BB-CF93-4A12-BC6D-A3B6F53AC8D9}) (Version: 5.0.1.0 - Toshiba Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.9.09.6400 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 3.1.02.55065006 - Toshiba Corporation)
TOSHIBA Service Station (HKLM\...\{FBFCEEA5-96EA-4C8E-9262-43CBBEBAE413}) (Version: 2.6.8 - Toshiba Corporation)
TOSHIBA Start Screen Option (HKLM\...\{06B71035-F19F-4F76-9875-FFCCD4FC3F83}) (Version: 1.00.00.6403 - Toshiba Corporation)
TOSHIBA System Driver (HKLM-x32\...\{1E6A96A1-2BAB-43EF-8087-30437593C66C}) (Version: 1.00.0030 - Toshiba Corporation)
TOSHIBA System Settings (HKLM-x32\...\{05A55927-DB9B-4E26-BA44-828EBFF829F0}) (Version: 1.1.2.32001 - Toshiba Corporation)
Toshiba TEMPRO (HKLM-x32\...\{F76F5214-83A8-4030-80C9-1EF57391D72A}) (Version: 4.5.0 - Toshiba Europe GmbH)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden
 
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 
==================== Wiederherstellungspunkte =========================
 
09-09-2015 17:46:12 Windows Update
17-09-2015 20:43:06 Windows Update
24-09-2015 17:55:32 Windows Modules Installer
01-10-2015 09:38:15 JRT Pre-Junkware Removal
 
==================== Hosts Inhalt: ===============================
 
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 
2013-08-22 15:25 - 2014-04-27 20:17 - 00000867 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1            d3oxij66pru1i3.cloudfront.net
 
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
Task: {011F1C8F-D6F1-4AE2-B65E-2F40341B9892} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {06793298-ADF9-4557-893C-D6B20439050F} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => Rundll32.exe invagent.dll,RunUpdate -noappraiser
Task: {085ECB3F-B002-404D-A020-08D9FF814FF7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-09-16] (Piriform Ltd)
Task: {14B26089-9423-4DC4-892E-3FCA95F9D256} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-19] (Toshiba Europe GmbH)
Task: {17FEA841-C6AC-41F6-8E4B-3517E0B4C3C2} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-22] (Synaptics Incorporated)
Task: {2050FA15-DEA2-486B-A531-601768E7A520} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-09-12] (Microsoft Corporation)
Task: {301C0A08-8BF4-4DAB-9676-DEC95BDB0E63} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2015-08-26] (Microsoft Corporation)
Task: {3092DD9E-0950-41C6-B3BA-FB152D545B6A} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)
Task: {453C4D8A-8609-477A-BF47-5CA6AE7C19EF} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-28] (Google Inc.)
Task: {531643C9-610B-4919-932E-AE26ECA97E06} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3422952177-23914602-504830955-1002 => %localappdata%\Microsoft\OneDrive\OneDrive.exe
Task: {7EE7CF50-C8F9-4FB6-8F4B-B46F975DA54B} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\Toshiba Service Station\ToshibaServiceStation.exe [2013-07-31] (TOSHIBA Corporation)
Task: {876A100D-8DA8-41C3-86F7-76EA1D3BDAE2} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {A8584356-1A20-43B3-86AD-58058893C088} - System32\Tasks\GenericSettingsHandler\Windows-Credentials\RetrySyncTask_for_S-1-5-21-3422952177-23914602-504830955-1002
Task: {B78614B4-C987-4F61-BFF9-6E2BE6D9D717} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-06-28] (Google Inc.)
Task: {BE4BE35F-69DA-4129-9EC3-FFBD3E1739E8} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)
Task: {CF24BCBF-0920-4F76-BA5E-C167AA9FE028} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)
Task: {E30BE1D1-50B5-4AA9-957D-37C166997349} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {E77C3C79-B7AC-480A-80A9-0C223874F373} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-09-11] (Microsoft Corporation)
Task: {FC17EEF2-1C48-4825-A29C-798833818957} - System32\Tasks\Resolution+ Setting Task => C:\Program Files\Toshiba\TOSHIBA Smart View Utility\Plugins\ResolutionPlus\TosRegPermissionChg.exe [2013-11-09] (TOSHIBA Corporation)
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
 
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 
2014-01-08 20:28 - 2013-08-10 05:36 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2012-07-19 04:38 - 2012-07-19 04:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2014-10-26 15:23 - 2014-10-26 15:23 - 01459712 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Windows.UI\4bd80968bf666252841ca7792faaff11\Windows.UI.ni.dll
2014-10-26 15:23 - 2014-10-26 15:23 - 00521216 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Windows.Data\fae2b750f87849ca11806d20b2504bf2\Windows.Data.ni.dll
2014-10-26 15:22 - 2014-10-26 15:22 - 00363520 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\6382e6f5ad8b7a9db4f5cd4817e70319\Windows.Foundation.ni.dll
2015-09-16 21:33 - 2015-09-16 21:33 - 00057344 _____ () C:\Program Files\CCleaner\lang\lang-1031.dll
2014-12-10 18:25 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 01272616 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\kpcengine.2.3.dll
2014-01-08 20:21 - 2013-09-03 17:53 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 00338216 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\online_banking@kaspersky.com\nponlinebanking.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 00502056 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\content_blocker@kaspersky.com\npcontentblocker.dll
2014-12-23 16:54 - 2014-12-23 16:54 - 00608040 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\FFExt\virtual_keyboard@kaspersky.com\npvkplugin.dll
2014-12-10 18:25 - 2014-12-10 18:25 - 00316576 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll
2015-06-24 15:47 - 2015-09-12 01:47 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll
 
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
AlternateDataStreams: C:\Users\Henrik\SkyDrive:ms-properties
 
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
 
==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 
==================== Andere Bereiche ============================
 
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 
HKU\S-1-5-21-3422952177-23914602-504830955-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\Henrik\AppData\Local\Microsoft\Windows\Themes\RoamedThemeFiles\DesktopBackground\1_charlesbergman_whalehumpbackicegarden.jpg
DNS Servers: 82.163.143.172 - 82.163.142.174
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.
 
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 
 
==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 
==================== Fehlerhafte Geräte im Gerätemanager =============
 
 
==================== Fehlereinträge in der Ereignisanzeige: =========================
 
Applikationsfehler:
==================
Error: (10/01/2015 11:55:41 AM) (Source: ESENT) (EventID: 455) (User: )
Description: DllHost (14616) WebCacheLocal: Fehler -1811 (0xfffff8ed) beim Öffnen von Protokolldatei C:\Users\Henrik\AppData\Local\Microsoft\Windows\WebCache\V0100520.log.
 
Error: (10/01/2015 11:46:36 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
 
Error: (10/01/2015 11:31:44 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
 
Error: (10/01/2015 11:31:44 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
 
Error: (10/01/2015 11:31:44 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
 
Error: (10/01/2015 11:31:42 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
 
Error: (10/01/2015 11:31:31 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_6240b9c7ecbd0bda.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.17810_none_a9edf09f013934e0.manifest.
 
Error: (10/01/2015 09:51:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1464
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
 
Error: (10/01/2015 09:51:17 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1440
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
 
Error: (10/01/2015 09:51:01 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 39.0.0.5659, Zeitstempel: 0x55934d06
Name des fehlerhaften Moduls: mozalloc.dll, Version: 39.0.0.5659, Zeitstempel: 0x55933a83
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001aa1
ID des fehlerhaften Prozesses: 0x1284
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3
Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4
Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
 
 
Systemfehler:
=============
Error: (10/01/2015 11:54:45 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TEMPRO Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:44 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TMachInfo" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:43 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TPCH Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:42 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 30000 Millisekunden durchgeführt: Neustart des Diensts.
 
Error: (10/01/2015 11:54:41 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) Dynamic Application Loader Host Interface Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:40 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) ME Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:40 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "GamesAppIntegrationService" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:38 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TOSHIBA eco Utility Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:38 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Intel(R) PROSet/Wireless Zero Configuration Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
Error: (10/01/2015 11:54:38 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TOSHIBA Optical Disc Drive Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 
 
==================== Speicherinformationen =========================== 
 
Prozessor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Prozentuale Nutzung des RAM: 33%
Installierter physikalischer RAM: 8116.09 MB
Verfügbarer physikalischer RAM: 5394.92 MB
Summe virtueller Speicher: 9396.09 MB
Verfügbarer virtueller Speicher: 6540.37 MB
 
==================== Laufwerke ================================
 
Drive c: (TI31250700A) (Fixed) (Total:919.53 GB) (Free:755.88 GB) NTFS
Drive d: (Aida 07) (CDROM) (Total:0.42 GB) (Free:0 GB) CDFS
 
==================== MBR & Partitionstabelle ==================
 
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 00000000)
 
Partition: GPT.
 
==================== Ende von Addition.txt ============================
         

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-10-01 12:31:26
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000035 TOSHIBA_MQ01ABD100 rev.AX0A4M 931,51GB
Running: dj2ylys0.exe; Driver: C:\Users\Henrik\AppData\Local\Temp\uxldypod.sys
 
 
---- User code sections - GMER 2.1 ----
 
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!K32GetModuleInformation 00007ffd7f843e10 7 bytes JMP 00007ffe7e6802d0
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!RegQueryValueExW 00007ffd7f843e20 7 bytes JMP 00007ffe7e680308
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!RegSetValueExW 00007ffd7f8f39b0 7 bytes JMP 00007ffe7e6803b0
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!RegDeleteValueW 00007ffd7f8f3ef0 7 bytes JMP 00007ffe7e680340
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!RegSetValueExA 00007ffd7f8f3fe0 7 bytes JMP 00007ffe7e680378
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007ffd7f9206c0 7 bytes JMP 00007ffe7e680228
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007ffd7f920730 7 bytes JMP 00007ffe7e680298
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007ffd7f920760 7 bytes JMP 00007ffe7e680260
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 00007ffd7e6921d0 5 bytes JMP 00007ffe7e680180
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 00007ffd7e6929d0 7 bytes JMP 00007ffe7e6800d8
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 00007ffd7e694310 5 bytes JMP 00007ffe7e680110
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 00007ffd7e698d80 5 bytes JMP 00007ffe7e680148
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\USER32.dll!CreateWindowExW 00007ffd7f4a6d90 10 bytes JMP 00007ffe7e680490
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\USER32.dll!EnumDisplayDevicesW 00007ffd7f4b74a0 5 bytes JMP 00007ffe7e680458
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007ffd7f4b7560 1 byte JMP 00007ffe7e6803e8
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\USER32.dll!DisplayConfigGetDeviceInfo + 2 00007ffd7f4b7562 7 bytes {JMP 0xffffffffff1c8e88}
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\USER32.dll!EnumDisplayDevicesA 00007ffd7f4c6b10 5 bytes JMP 00007ffe7e680420
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007ffd7efc1500 8 bytes JMP 00007ffe7e6801b8
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007ffd7efc1750 8 bytes JMP 00007ffe7e6801f0
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 00007ffd7c3a7750 5 bytes JMP 00007ffe7c1000d8
.text C:\Windows\system32\dwm.exe[520] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 00007ffd7c3a8ee0 5 bytes JMP 00007ffe7c100110
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!ShowScrollBar 00007ffd7f4a1150 5 bytes JMP 00007ffdff510018
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!SetScrollInfo 00007ffd7f4ac770 5 bytes JMP 00007ffdff4c0018
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!GetScrollInfo 00007ffd7f4b66f0 5 bytes JMP 00007ffdff4d0018
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!SetScrollRange 00007ffd7f4b90c0 5 bytes JMP 00007ffdff4e0018
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!SetScrollPos 00007ffd7f4d50d0 5 bytes JMP 00007ffdff550018
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!EnableScrollBar 00007ffd7f4d7340 5 bytes JMP 00007ffdff4f0018
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!GetScrollPos 00007ffd7f4dfcc0 5 bytes JMP 00007ffdff500018
.text C:\Program Files\CCleaner\CCleaner64.exe[7636] C:\Windows\system32\USER32.dll!GetScrollRange 00007ffd7f52ed20 5 bytes JMP 00007ffdff540018
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffd81374b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffd81374f3c 8 bytes [60, 6E, 1F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffd81375216 8 bytes [50, 6E, 1F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffd8137540f 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffd813757af 8 bytes [30, 6E, 1F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffd81375964 8 bytes [20, 6E, 1F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffd81375f01 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffd81375f5e 8 bytes [F0, 6D, 1F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffd813f12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffd813f1420 8 bytes {JMP QWORD [RIP-0x7bac2]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffd813f1450 8 bytes {JMP QWORD [RIP-0x7c51a]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffd813f1570 8 bytes {JMP QWORD [RIP-0x7c167]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffd813f1620 8 bytes {JMP QWORD [RIP-0x7c410]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffd813f1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffd813f1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffd813f2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077da13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077da1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077da1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077da1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077da16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077da16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\firefox.exe[20788] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077da1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffd81374b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffd81374f3c 8 bytes [60, 6E, A7, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffd81375216 8 bytes [50, 6E, A7, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffd8137540f 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffd813757af 8 bytes [30, 6E, A7, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffd81375964 8 bytes [20, 6E, A7, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffd81375f01 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffd81375f5e 8 bytes [F0, 6D, A7, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffd813f12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffd813f1420 8 bytes {JMP QWORD [RIP-0x7bac2]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffd813f1450 8 bytes {JMP QWORD [RIP-0x7c51a]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffd813f1570 8 bytes {JMP QWORD [RIP-0x7c167]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffd813f1620 8 bytes {JMP QWORD [RIP-0x7c410]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffd813f1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffd813f1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffd813f2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077da13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077da1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077da1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077da1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077da16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077da16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21228] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077da1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffd81374b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffd81374f3c 8 bytes [60, 6E, 0F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffd81375216 8 bytes [50, 6E, 0F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffd8137540f 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffd813757af 8 bytes [30, 6E, 0F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffd81375964 8 bytes [20, 6E, 0F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffd81375f01 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffd81375f5e 8 bytes [F0, 6D, 0F, FF, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffd813f12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffd813f1420 8 bytes {JMP QWORD [RIP-0x7bac2]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffd813f1450 8 bytes {JMP QWORD [RIP-0x7c51a]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffd813f1570 8 bytes {JMP QWORD [RIP-0x7c167]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffd813f1620 8 bytes {JMP QWORD [RIP-0x7c410]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffd813f1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffd813f1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffd813f2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077da13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077da1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077da1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077da1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077da16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077da16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21312] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077da1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffd81374b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffd81374f3c 8 bytes [60, 6E, 96, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffd81375216 8 bytes [50, 6E, 96, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffd8137540f 8 bytes {JMP 0xffffffffffffffee}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffd813757af 8 bytes [30, 6E, 96, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffd81375964 8 bytes [20, 6E, 96, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffd81375f01 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffd81375f5e 8 bytes [F0, 6D, 96, FE, 00, 00, 00, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffd813f12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffd813f1420 8 bytes {JMP QWORD [RIP-0x7bac2]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffd813f1450 8 bytes {JMP QWORD [RIP-0x7c51a]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffd813f1570 8 bytes {JMP QWORD [RIP-0x7c167]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffd813f1620 8 bytes {JMP QWORD [RIP-0x7c410]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffd813f1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffd813f1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffd813f2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077da13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077da1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077da1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077da1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077da16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077da16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe[21376] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077da1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132 00007ffd81374b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!RtlPrefixString + 316 00007ffd81374f3c 8 bytes [60, 6E, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710 00007ffd81375216 8 bytes [50, 6E, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479 00007ffd8137540f 8 bytes {JMP 0xffffffffffffffee}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911 00007ffd813757af 8 bytes [30, 6E, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!TpAllocWork + 420 00007ffd81375964 8 bytes [20, 6E, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657 00007ffd81375f01 8 bytes {JMP 0xffffffffffffff9e}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78 00007ffd81375f5e 8 bytes [F0, 6D, F8, 7F, 00, 00, 00, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00007ffd813f12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00007ffd813f1420 8 bytes {JMP QWORD [RIP-0x7bac2]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00007ffd813f1450 8 bytes {JMP QWORD [RIP-0x7c51a]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00007ffd813f1570 8 bytes {JMP QWORD [RIP-0x7c167]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00007ffd813f1620 8 bytes {JMP QWORD [RIP-0x7c410]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00007ffd813f1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00007ffd813f1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00007ffd813f2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\system32\wow64cpu.dll!CpuSetContext + 438 0000000077da13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\system32\wow64cpu.dll!CpuGetContext + 387 0000000077da1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\system32\wow64cpu.dll!CpuSetInstructionPointer + 49 0000000077da1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\system32\wow64cpu.dll!CpuProcessInit + 68 0000000077da1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\system32\wow64cpu.dll!CpuGetStackPointer + 23 0000000077da16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9 0000000077da16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Henrik\Downloads\dj2ylys0.exe[15632] C:\Windows\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71 0000000077da1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
 
---- Threads - GMER 2.1 ----
 
Thread C:\Windows\system32\csrss.exe [756:780] fffff960008712d0
---- Processes - GMER 2.1 ----
 
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\avengine.dll.9ee8bd3c2dfe2b51237b1662e1c9ede4 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000071720000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\uds.dll.000000000006b1b8-01d0917eed704167-01d0a3841c837391 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 00000000716b0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\intctrl.kdl.0000000000090000-01d0917ee8a41cbc-01d01db8ebbd8b00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000071610000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\kavbase.kdl.ec30a0e81f3e302a0b46ce9429e61be5 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000070eb0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\klavemu.kdl.b6b6dd223ad2aad28374217a028b59b0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000070830000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\kjim.kdl.e30a2afa3b21fc3c867bdf51ac89005f (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006f440000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\mark.kdl.597a1bbcce8e23cf2060e0a21e06a70c (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006f330000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\qscan.kdl.89bd1edb57886f51d3590523e14d4224 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006f030000
Library c:\programdata\kaspersky lab\avp15.0.2\data\wlengine.dll (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006efd0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\arkmon.kdl.3bf204b5e28c84adbd4852316eec8772 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006ba00000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\kavsys.kdl.4fb19e4b45a692ec6162c3262cdf2636 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006b950000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\swmon.kdl.000000000001b200-01d0917ee99d501f-01d0f6e43410b2b5 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006b8e0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\swmon_drv.kdl.0000000000024200-01d0917ee9cd426f-01d0f6e4349cdff2 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006b870000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\vlns.kdl.50b550767fe2caad4d144452d53b2d78 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006ea40000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\klavasyswatch.dll.000000000012e600-01d0917ee8ad461f-01d0a9f0ea38a951 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006db60000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\pbs.kdl.eefcc4c76375abb2b40e8e5c00c7eccf (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 000000006e260000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\heurap.dll.7aaa0a24800a0898e1e21547cd09831d (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000063280000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\pdm.kdl.0000000000069740-01d0917ee92cc69d-01d01db8f7a94d00 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000062ff0000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\bsshlp2.kdl.7b5ed3ca6d3d7225b866af3c09484fec (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000062f70000
Library C:\ProgramData\Kaspersky Lab\AVP15.0.2\Bases\Cache\sys_critical_obj.dll.0000000000023c00-01d0917ee9e3b4bb-01d0f062e4e26e20 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Total Security 15.0.2\avp.exe [1684] (FILE NOT FOUND) 0000000062b40000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\mso.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [11188] 0000000065050000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\riched20.dll (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [11188] 0000000063b40000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\Office15\MSPTLS.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [11188] 0000000063490000
Library C:\Program Files (x86)\Common Files\SYSTEM\MSMAPI\1031\MSMAPI32.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [11188] 000000006bba0000
Library C:\Program Files (x86)\Common Files\Microsoft Shared\PROOF\MSLID.DLL (*** suspicious ***) @ C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE [11188] 0000000060070000
 
---- Disk sectors - GMER 2.1 ----
 
Disk \Device\Harddisk0\DR0 unknown MBR code
 
---- EOF - GMER 2.1 ----