Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Win 7 laptop geht bei Virenscan aus (https://www.trojaner-board.de/157486-win-7-laptop-geht-virenscan.html)

eve2504 11.08.2014 18:20
Win 7 laptop geht bei Virenscan aus
 
Hallo,
mein laptop geht immer aus, wenn ich den Virenscanner laufen lasse (avira). Komplett ohne Vorwarnung.
Hoffe, ihr könnt mir helfen

Gruß



Schritt 2 FRST:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-08-2014 01
Ran by Silvija Sagolj at 2014-08-11 19:14:50
Running from C:\Users\Silvija Sagolj\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
AccelerometerP11 (HKLM-x32\...\{87434D51-51DB-4109-B68F-A829ECDCF380}) (Version: 2.00.11.22 - STMicroelectronics)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 14.0.0.110 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\{0099B484-C24C-4D5F-8167-B0F6DF196E72}) (Version: 12.0.3.133 - Adobe Systems, Inc)
Adobe Shockwave Player 12.1 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.1.0.150 - Adobe Systems, Inc.)
Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Amazon MP3-Downloader 1.0.18 (HKCU\...\Amazon MP3-Downloader) (Version: 1.0.18 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CyberLink PowerDVD 9.6 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.6.1.4418 - CyberLink Corp.)
CyberLink PowerDVD 9.6 (x32 Version: 9.6.1.4418 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5C78021E-3C8E-4EDF-97EA-E9B8D808FD6D}) (Version:  - Microsoft)
Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 9.4.61 - Dell Inc.)
Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.4.61 - Dell Inc.)
Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)
Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.)
Dell MusicStage (HKLM-x32\...\{3255BC3F-32BA-41ED-93A0-B9AEB6CDD9E6}) (Version: 1.5.201.0 - Fingertapps)
Dell PhotoStage (HKLM-x32\...\{E4335E82-17B3-460F-9E70-39D9BC269DB3}) (Version: 1.5.0.65 - ArcSoft)
Dell Stage (HKLM-x32\...\{56A0DD94-47D9-4AC8-B5A1-8A8CA77C4B89}) (Version: 1.5.201.0 - Fingertapps)
Dell Stage Remote (HKLM-x32\...\{2299EEBD-0A83-4B26-AA4A-057AE9E5BAE8}) (Version: 2.0.0.50 - ArcSoft)
Dell Stage Remote (HKLM-x32\...\{AF4D3C63-009B-4A17-B02E-D395065DD3F0}) (Version: 2.0.0.50 - ArcSoft)
Dell VideoStage  (HKLM-x32\...\InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}) (Version: 1.2.0.1712 - CyberLink Corp.)
Dell VideoStage  (x32 Version: 1.2.0.1712 - CyberLink Corp.) Hidden
Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 2.01.17 - Creative Technology Ltd)
DivX-Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.87 - DivX, LLC)
Dropbox (HKCU\...\Dropbox) (Version: 2.10.3 - Dropbox, Inc.)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
FormatFactory 3.1.1 (HKLM-x32\...\FormatFactory) (Version: 3.1.1 - Free Time)
GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden
Google Chrome (HKCU\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.)
Google Drive (HKLM-x32\...\{75939021-3B68-419D-8DC1-E9823BFF9658}) (Version: 1.16.7009.9618 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
HP Officejet Pro 8500 A910 - Grundlegende Software für das Gerät (HKLM\...\{E0FE1E14-3A7A-4DB0-9FFA-0DD945AE84DB}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Officejet Pro 8500 A910 Hilfe (HKLM-x32\...\{871B2A9D-0F12-44B3-88C1-E0CB10A232E4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM-x32\...\{B0069CFA-5BB9-4C03-B1C6-89CE290E5AFE}) (Version: 5.002.006.003 - Hewlett-Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
Inpaint 5.5 (HKLM\...\{2AEDC172-479F-47AE-8A48-A0524D4AED5B}_is1) (Version:  - Teorex)
Intel PROSet Wireless (Version:  - ) Hidden
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2455 - Intel Corporation)
Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (HKLM\...\{2ABA2E8D-23CF-418F-BC8F-2EC99FA51A3F}) (Version: 1.2.1.0608 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{295AEB79-B53A-4F1B-860F-7800BB7E3681}) (Version: 14.2.1000 - Intel Corporation)
Intel(R) WiDi (HKLM-x32\...\{0DD706AF-B542-438C-999E-B30C7F625C8D}) (Version: 2.1.39.0 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F06417065FF}) (Version: 7.0.650 - Oracle)
Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217065FF}) (Version: 7.0.650 - Oracle)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Marketsplash Schnellzugriffe (HKLM-x32\...\{7A108EBC-C9DF-4E14-93A8-42CF316F1ECF}) (Version: 1.0.1.7 - Hewlett-Packard)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (HKLM-x32\...\{820B6609-4C97-3A2B-B644-573B06A0F0CC}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.4 - F.J. Wechselberger)
NVIDIA 3D Vision Treiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 331.65 - NVIDIA Corporation)
NVIDIA GeForce Experience 1.8.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.1 - NVIDIA Corporation)
NVIDIA Grafiktreiber 331.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 331.65 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.26.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.26.4 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.142.992 - NVIDIA Corporation) Hidden
NVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.13.0725 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)
NVIDIA ShadowPlay 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.3165 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 331.65 (Version: 331.65 - NVIDIA Corporation) Hidden
NVIDIA Update 10.11.15 (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Update Core (Version: 10.11.15 - NVIDIA Corporation) Hidden
NVIDIA Virtual Audio 1.2.19 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.19 - NVIDIA Corporation)
PhotoScape (HKLM-x32\...\PhotoScape) (Version:  - )
PowerISO (HKLM-x32\...\PowerISO) (Version:  - )
Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 11.0.22 - Dell Inc.)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6449 - Realtek Semiconductor Corp.)
Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.)
Samsung Kies3 (x32 Version: 3.2.13114.22 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Secunia PSI (3.0.0.7009) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.7009 - Secunia)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
SHIELD Streaming (Version: 1.6.85 - NVIDIA Corporation) Hidden
Skype Click to Call (HKLM-x32\...\{6D1221A9-17BF-4EC0-81F2-27D30EC30701}) (Version: 7.3.16540.9015 - Microsoft Corporation)
Skype™ 6.18 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.18.106 - Skype Technologies S.A.)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Studie zur Verbesserung von HP Officejet Pro 8500 A910 Produkten (HKLM\...\{D7B11BA7-15D3-4E84-8974-20258D4A1701}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.22.0 - Synaptics Incorporated)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (HKLM\...\{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}) (Version: 2.1.23.0 - Intel)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Excel 2010 (KB2837600) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4ACD847E-547D-493F-9A86-F73EAE1B5174}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{C0BDC1DE-C35E-422B-8CBD-C1D555468720}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUSR_{794A0574-4E2F-4D58-B2A0-D7460ACDC85C}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{DCE104A1-1875-4469-A83D-A5BFA6C4640F}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{334AA0A1-2BB1-4D74-B66A-2B2C4D9C2C87}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version:  - Microsoft)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Visual C++ 9.0 CRT (x86) WinSXS MSM (x32 Version: 9.0 - Microsoft Corporation) Hidden
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No File
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll (Google Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-4120619775-2555974261-1378655148-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Silvija Sagolj\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File

==================== Restore Points  =========================

03-08-2014 17:00:24 Windows-Sicherung
05-08-2014 15:44:00 Windows Update
08-08-2014 17:26:25 avast! antivirus system restore point
10-08-2014 17:00:41 Windows-Sicherung
10-08-2014 17:34:21 Removed Skype™ 6.18
10-08-2014 22:09:48 avast! antivirus system restore point
11-08-2014 08:15:37 Windows-Sicherung
11-08-2014 08:39:13 avast! antivirus system restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2013-08-03 09:04 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {064520DC-6589-4358-B38D-50749F967D45} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {0902F0BC-5299-4C20-BE1F-7F6653E9B65E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3796880C-AE3A-41BA-B3E9-BBE849AC8154} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {390EF756-9F73-4EEF-9BC5-BB235AA3BB67} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {41C99EA1-9A46-48D7-AB79-D667B283571F} - System32\Tasks\AutoKMS => C:\Windows\AutoKMS.exe
Task: {77203526-2C54-4279-8BED-DA4F16CBA66F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-09] (Google Inc.)
Task: {7DBD8B30-15FB-44BF-A9A5-31A2003B4779} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4120619775-2555974261-1378655148-1001UA => C:\Users\Silvija Sagolj\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.)
Task: {8BFB85C9-FD48-491F-86DD-E1792489B074} - System32\Tasks\HPCustParticipation HP Officejet Pro 8500 A910 => C:\Program Files\HP\HP Officejet Pro 8500 A910\Bin\HPCustPartic.exe [2010-11-16] (Hewlett-Packard Co.)
Task: {BB7BC5A0-97BB-47BF-BD9E-324E70A828DF} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2014-01-31] (PC-Doctor, Inc.)
Task: {C2B32172-BCC2-4604-B6EA-3FA4E5C361C8} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4120619775-2555974261-1378655148-1001Core => C:\Users\Silvija Sagolj\AppData\Local\Google\Update\GoogleUpdate.exe [2012-11-29] (Google Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4120619775-2555974261-1378655148-1001Core.job => C:\Users\Silvija Sagolj\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4120619775-2555974261-1378655148-1001UA.job => C:\Users\Silvija Sagolj\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-09-16 01:46 - 2011-09-16 01:46 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2013-11-16 08:30 - 2013-10-23 10:20 - 00102176 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2011-12-08 19:58 - 2011-07-20 00:04 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-12-08 18:56 - 2010-12-17 18:25 - 00686704 _____ () C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
2011-09-16 01:46 - 2011-09-16 01:46 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2010-11-29 23:04 - 2010-11-29 23:04 - 00403968 _____ () C:\Program Files\Intel\TurboBoost\de\SignalIslandUi.resources.dll
2011-08-08 19:26 - 2011-08-08 19:26 - 00475200 _____ () C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
2013-08-29 02:23 - 2013-08-29 02:23 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
2011-08-08 19:26 - 2011-08-08 19:26 - 00891456 _____ () C:\Program Files (x86)\Dell\Stage Remote\DMR.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-07-24 11:50 - 2014-07-24 11:50 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-24 11:49 - 2014-07-24 11:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2013-08-29 02:25 - 2013-08-29 02:25 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2014-08-11 10:47 - 2014-07-24 11:50 - 00049744 _____ () C:\Users\Silvija Sagolj\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2010-03-16 21:28 - 2010-03-16 21:28 - 01926144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtCore4.dll
2010-03-22 16:52 - 2010-03-22 16:52 - 06776832 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtGui4.dll
2010-03-16 21:28 - 2010-03-16 21:28 - 00635904 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtNetwork4.dll
2010-03-16 21:28 - 2010-03-16 21:28 - 00326144 _____ () C:\Program Files (x86)\Dell\Stage Remote\QtXml4.dll
2011-06-25 00:20 - 2011-06-25 00:20 - 00565968 _____ () C:\Program Files (x86)\Dell\Stage Remote\sqlite3.dll
2007-04-13 10:39 - 2007-04-13 10:39 - 00252672 _____ () C:\Program Files (x86)\Dell\Stage Remote\kgl.dll
2011-07-17 11:35 - 2011-07-17 11:35 - 00058944 _____ () C:\Program Files (x86)\Dell\Stage Remote\DataService.dll
2011-07-06 17:53 - 2011-07-06 17:53 - 00068160 _____ () C:\Program Files (x86)\Dell\Stage Remote\de-DE\UI\DMRUI.dll
2010-03-11 20:52 - 2010-03-11 20:52 - 00028160 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qgif4.dll
2010-03-05 16:07 - 2010-03-05 16:07 - 00031744 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qico4.dll
2010-03-05 16:07 - 2010-03-05 16:07 - 00125952 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qjpeg4.dll
2010-03-11 20:52 - 2010-03-11 20:52 - 00225280 _____ () C:\Program Files (x86)\Dell\Stage Remote\plugins\imageformats\qmng4.dll
2007-04-19 09:28 - 2007-04-19 09:28 - 00436992 _____ () C:\Program Files (x86)\Dell\Stage Remote\fpxlib.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-07-18 21:52 - 2014-07-15 11:24 - 00718664 _____ () C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\libglesv2.dll
2014-07-18 21:52 - 2014-07-15 11:24 - 00126280 _____ () C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\libegl.dll
2014-07-18 21:52 - 2014-07-15 11:24 - 08537928 _____ () C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll
2014-07-18 21:52 - 2014-07-15 11:24 - 00353096 _____ () C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll
2014-07-18 21:52 - 2014-07-15 11:24 - 01732936 _____ () C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:5C321E34

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth-Peripheriegerät
Description: Bluetooth-Peripheriegerät
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/11/2014 07:00:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: StageRemote.exe, Version: 2.0.0.50, Zeitstempel: 0x4e3fb38b
Name des fehlerhaften Moduls: MP4Muxer.ax, Version: 1.0.0.87, Zeitstempel: 0x4e1bf1b1
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00002a95
ID des fehlerhaften Prozesses: 0x1660
Startzeit der fehlerhaften Anwendung: 0xStageRemote.exe0
Pfad der fehlerhaften Anwendung: StageRemote.exe1
Pfad des fehlerhaften Moduls: StageRemote.exe2
Berichtskennung: StageRemote.exe3

Error: (08/11/2014 06:58:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2014 03:21:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2014 03:21:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.Systray.exe, Version: 1.1.18.30000, Zeitstempel: 0x53d0d694
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x638
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.Systray.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.Systray.exe1
Pfad des fehlerhaften Moduls: Avira.OE.Systray.exe2
Berichtskennung: Avira.OE.Systray.exe3

Error: (08/11/2014 03:21:26 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.Systray.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Net.Sockets.SocketException
Stack:
  at System.Net.SafeCloseSocketAndEvent.CreateWSASocketWithEvent(System.Net.Sockets.AddressFamily, System.Net.Sockets.SocketType, System.Net.Sockets.ProtocolType, Boolean, Boolean)
  at System.Net.NetworkInformation.NetworkChange+AddressChangeListener.StartHelper(System.Net.NetworkInformation.NetworkAddressChangedEventHandler, Boolean, System.Net.NetworkInformation.StartIPOptions)
  at Avira.OE.WinCore.NetworkStatusListener..ctor()
  at Avira.OE.WinCore.InternetConnectionMonitor..ctor()
  at Avira.OE.Systray.SystrayIcon..ctor(Avira.OE.WinCore.Interface.IServiceStatusMonitor, Avira.OE.Communicator.Interface.ICommunicatorClientProxy, Avira.OE.MiniGui.IMiniGuiWindow)
  at Avira.OE.Systray.SystrayIcon..ctor()
  at Avira.OE.Systray.Program.Main(System.String[])

Error: (08/11/2014 03:21:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: Avira.OE.Systray.exe, Version: 1.1.18.30000, Zeitstempel: 0x53d0d694
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xe0434352
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x574
Startzeit der fehlerhaften Anwendung: 0xAvira.OE.Systray.exe0
Pfad der fehlerhaften Anwendung: Avira.OE.Systray.exe1
Pfad des fehlerhaften Moduls: Avira.OE.Systray.exe2
Berichtskennung: Avira.OE.Systray.exe3

Error: (08/11/2014 03:20:53 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.Systray.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Net.Sockets.SocketException
Stack:
  at System.Net.SafeCloseSocketAndEvent.CreateWSASocketWithEvent(System.Net.Sockets.AddressFamily, System.Net.Sockets.SocketType, System.Net.Sockets.ProtocolType, Boolean, Boolean)
  at System.Net.NetworkInformation.NetworkChange+AddressChangeListener.StartHelper(System.Net.NetworkInformation.NetworkAddressChangedEventHandler, Boolean, System.Net.NetworkInformation.StartIPOptions)
  at Avira.OE.WinCore.NetworkStatusListener..ctor()
  at Avira.OE.WinCore.InternetConnectionMonitor..ctor()
  at Avira.OE.Systray.SystrayIcon..ctor(Avira.OE.WinCore.Interface.IServiceStatusMonitor, Avira.OE.Communicator.Interface.ICommunicatorClientProxy, Avira.OE.MiniGui.IMiniGuiWindow)
  at Avira.OE.Systray.SystrayIcon..ctor()
  at Avira.OE.Systray.Program.Main(System.String[])

Error: (08/11/2014 03:17:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2014 03:14:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: StageRemote.exe, Version: 2.0.0.50, Zeitstempel: 0x4e3fb38b
Name des fehlerhaften Moduls: MP4Muxer.ax, Version: 1.0.0.87, Zeitstempel: 0x4e1bf1b1
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00002a95
ID des fehlerhaften Prozesses: 0x1364
Startzeit der fehlerhaften Anwendung: 0xStageRemote.exe0
Pfad der fehlerhaften Anwendung: StageRemote.exe1
Pfad des fehlerhaften Moduls: StageRemote.exe2
Berichtskennung: StageRemote.exe3

Error: (08/11/2014 03:12:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (08/11/2014 06:59:20 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.

Error: (08/11/2014 06:58:49 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst SftService erreicht.

Error: (08/11/2014 06:57:50 PM) (Source: Microsoft-Windows-TaskScheduler) (EventID: 413) (User: NT-AUTORITÄT)
Description: Beim Start des Aufgabenplanungsdiensts konnten Aufgaben nicht geladen werden. Zusätzliche Daten: Fehlerwert: 2147942402.

Error: (08/11/2014 03:58:23 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/11/2014 03:21:51 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/11/2014 03:21:23 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084Bluetooth Device Monitor{DABF28BE-F6B4-4E40-8F40-C4FB26F3116C}

Error: (08/11/2014 03:20:38 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/11/2014 03:20:38 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/11/2014 03:20:38 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068

Error: (08/11/2014 03:20:38 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068


Microsoft Office Sessions:
=========================
Error: (08/11/2014 07:00:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: StageRemote.exe2.0.0.504e3fb38bMP4Muxer.ax1.0.0.874e1bf1b1c000000500002a95166001cfb585919b7be5C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exeC:\Program Files (x86)\Dell\Stage Remote\Codec\MP4Muxer.axf7b33dad-2178-11e4-bccd-4c8093304b10

Error: (08/11/2014 06:58:15 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2014 03:21:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2014 03:21:41 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.18.3000053d0d694KERNELBASE.dll6.1.7601.1840953159a86e04343520000c42d63801cfb56726f4caadC:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exeC:\Windows\syswow64\KERNELBASE.dll6e00c0a2-215a-11e4-b046-e4668a48ad14

Error: (08/11/2014 03:21:26 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.Systray.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Net.Sockets.SocketException
Stack:
  at System.Net.SafeCloseSocketAndEvent.CreateWSASocketWithEvent(System.Net.Sockets.AddressFamily, System.Net.Sockets.SocketType, System.Net.Sockets.ProtocolType, Boolean, Boolean)
  at System.Net.NetworkInformation.NetworkChange+AddressChangeListener.StartHelper(System.Net.NetworkInformation.NetworkAddressChangedEventHandler, Boolean, System.Net.NetworkInformation.StartIPOptions)
  at Avira.OE.WinCore.NetworkStatusListener..ctor()
  at Avira.OE.WinCore.InternetConnectionMonitor..ctor()
  at Avira.OE.Systray.SystrayIcon..ctor(Avira.OE.WinCore.Interface.IServiceStatusMonitor, Avira.OE.Communicator.Interface.ICommunicatorClientProxy, Avira.OE.MiniGui.IMiniGuiWindow)
  at Avira.OE.Systray.SystrayIcon..ctor()
  at Avira.OE.Systray.Program.Main(System.String[])

Error: (08/11/2014 03:21:08 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Avira.OE.Systray.exe1.1.18.3000053d0d694KERNELBASE.dll6.1.7601.1840953159a86e04343520000c42d57401cfb5670e17ab10C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exeC:\Windows\syswow64\KERNELBASE.dll5aa4cfa7-215a-11e4-b046-e4668a48ad14

Error: (08/11/2014 03:20:53 PM) (Source: .NET Runtime) (EventID: 1026) (User: )
Description: Application: Avira.OE.Systray.exe
Framework Version: v4.0.30319
Description: The process was terminated due to an unhandled exception.
Exception Info: System.Net.Sockets.SocketException
Stack:
  at System.Net.SafeCloseSocketAndEvent.CreateWSASocketWithEvent(System.Net.Sockets.AddressFamily, System.Net.Sockets.SocketType, System.Net.Sockets.ProtocolType, Boolean, Boolean)
  at System.Net.NetworkInformation.NetworkChange+AddressChangeListener.StartHelper(System.Net.NetworkInformation.NetworkAddressChangedEventHandler, Boolean, System.Net.NetworkInformation.StartIPOptions)
  at Avira.OE.WinCore.NetworkStatusListener..ctor()
  at Avira.OE.WinCore.InternetConnectionMonitor..ctor()
  at Avira.OE.Systray.SystrayIcon..ctor(Avira.OE.WinCore.Interface.IServiceStatusMonitor, Avira.OE.Communicator.Interface.ICommunicatorClientProxy, Avira.OE.MiniGui.IMiniGuiWindow)
  at Avira.OE.Systray.SystrayIcon..ctor()
  at Avira.OE.Systray.Program.Main(System.String[])

Error: (08/11/2014 03:17:36 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (08/11/2014 03:14:04 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: StageRemote.exe2.0.0.504e3fb38bMP4Muxer.ax1.0.0.874e1bf1b1c000000500002a95136401cfb565fcea4ac4C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exeC:\Program Files (x86)\Dell\Stage Remote\Codec\MP4Muxer.ax5dd38b58-2159-11e4-8907-4c8093304b10

Error: (08/11/2014 03:12:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2013-08-03 08:58:47.329
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-03 08:58:47.236
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-03 08:58:47.142
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-08-03 08:58:47.049
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 07:00:45.676
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\SILVIJ~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 07:00:45.610
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Users\SILVIJ~1\AppData\Local\Temp\EverestDriver.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 07:00:45.460
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 07:00:45.393
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Lavalys\EVEREST Home Edition\kerneld.amd64" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-17 14:20:35.687
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-17 14:20:35.625
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 40%
Total physical RAM: 8086.17 MB
Available physical RAM: 4828.29 MB
Total Pagefile: 16170.52 MB
Available Pagefile: 12584.83 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:679 GB) (Free:545.62 GB) NTFS
Drive d: () (Fixed) (Total:698.63 GB) (Free:127.05 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 699 GB) (Disk ID: 07F2837E)
Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)
Partition 2: (Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=679 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: D9F697E1)
Partition 1: (Not Active) - (Size=699 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Code:

LastRegBack: 2014-08-08 19:15

==================== End Of Log ============================

Schritt 3 Scan mit GMER:
also die Logfiles sind zu groß, 7-zip funktioniert leider nicht wie angezeigt. wenn ich die logfiles markiere und dann rechts klick mache,steht da leider nicht 7 zip

Warlord711 11.08.2014 18:34
Hallo !

Das Hauptlog von FRST fehlt.

eve2504 11.08.2014 18:43
Verzeihung, hier ist es:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-08-2014 01
Ran by Silvija Sagolj (administrator) on SILVIJASAGOLJ on 11-08-2014 19:13:10
Running from C:\Users\Silvija Sagolj\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\btplayerctrl.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(Intel® Corporation) C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe
() C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD9\PDVD9Serv.exe
(cyberlink) C:\Program Files (x86)\Cyberlink\Shared files\brs.exe
(PowerISO Computing, Inc.) C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
() C:\Program Files (x86)\Dell\Stage Remote\DMR.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
(Intel(R) Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7284328 2011-08-31] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2277480 2011-08-17] (Realtek Semiconductor)
HKLM\...\Run: [FreeFallProtection] => C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()
HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-16] (Intel(R) Corporation)
HKLM\...\Run: [IntelTBRunOnce] => wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs"
HKLM\...\Run: [Stage Remote] => C:\Program Files (x86)\Dell\Stage Remote\StageRemote.exe [2034752 2011-08-08] ()
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2818856 2011-08-26] (Synaptics Incorporated)
HKLM\...\Run: [DellStage] => C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe [2055016 2011-04-30] ()
HKLM\...\Run: [Nvtmru] => C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-08] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-10] (NVIDIA Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)
HKLM-x32\...\Run: [RemoteControl9] => c:\Program Files (x86)\CyberLink\PowerDVD9\PDVD9Serv.exe [87336 2010-10-02] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD9LanguageShortcut] => c:\Program Files (x86)\CyberLink\PowerDVD9\Language\Language.exe [50472 2010-09-18] (CyberLink Corp.)
HKLM-x32\...\Run: [BDRegion] => c:\Program Files (x86)\Cyberlink\Shared Files\brs.exe [75048 2011-08-12] (cyberlink)
HKLM-x32\...\Run: [AccuWeatherWidget] => C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe [885760 2011-04-30] ()
HKLM-x32\...\Run: [PWRISOVM.EXE] => C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [200704 2007-08-07] (PowerISO Computing, Inc.)
HKLM-x32\...\Run: [Dell Webcam Central] => C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [577536 2012-05-09] (Creative Technology Ltd)
HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-09-11] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-29] ()
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-24] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-07-23] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe Run
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Run: [Google Update] => C:\Users\Silvija Sagolj\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-11-29] (Google Inc.)
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Policies\Explorer: [DisallowRun] 1
AppInit_DLLs: C:\Windows\System32\nvinitx.dll => C:\Windows\System32\nvinitx.dll [168616 2013-10-23] (NVIDIA Corporation)
AppInit_DLLs: ,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-10-23] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [141336 2013-10-23] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
Startup: C:\Users\Silvija Sagolj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk
ShortcutTarget: Überwachungstool für die Intel® Turbo-Boost-Technik 2.0.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} =>  No File
ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: GDriveBlacklistedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSharedEditOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSharedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSharedViewOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSyncedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers: GDriveSyncingOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google)
ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

ProxyServer: :0
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USCON/8
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {88E0DB61-FF3C-47A3-9080-6EDB2F61D75B} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Click to Call for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
DPF: HKLM {682C59F5-478C-4421-9070-AD170D143B77} hxxp://www.dell.com/support/troubleshooting/Content/Ode/pcd64.cab
DPF: HKLM-x32 {6C269571-C6D7-4818-BCA4-32A035E8C884} hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15102/CTSUEng.cab
DPF: HKLM-x32 {D4B68B83-8710-488B-A692-D74B50BA558E} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/15113/CTPIDPDE.cab
DPF: HKLM-x32 {F6ACF75C-C32C-447B-9BEF-46B766368D29} hxxp://ccfiles.creative.com/Web/softwareupdate/ocx/130321/CTPID.cab
Handler: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)
Handler-x32: skypec2c - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @phonostar.de/phonostar -> C:\Program Files (x86)\phonostar-Player\npphonostarDetectNP.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 -> C:\Users\Silvija Sagolj\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 -> C:\Users\Silvija Sagolj\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Users\Silvija Sagolj\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR Plugin: (Shockwave Flash) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\36.0.1985.125\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U17) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Silvija Sagolj\AppData\Local\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1168638.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.170.2) - C:\Windows\SysWOW64\npDeployJava1.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Drive) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-09]
CHR Extension: (YouTube) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-05-02]
CHR Extension: (Google-Suche) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-05-02]
CHR Extension: (Google Kalender) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\ejjicmeblgpmajnghnpcppodonldlgfn [2013-06-16]
CHR Extension: (AdBlock) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2013-06-17]
CHR Extension: (avast! Online Security) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2013-06-23]
CHR Extension: (Chrome to Mobile) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\idknbmbdnapjicclomlijcgfpikmndhd [2013-06-14]
CHR Extension: (Google Wallet) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Google Mail) - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-05-02]
CHR HKCU\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\SILVIJ~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2013-06-09]
CHR HKLM-x32\...\Chrome\Extension: [ibfnlmghaedjneaalifaieadkiahfjgj] - C:\ProgramData\SaveByclick\ibfnlmghaedjneaalifaieadkiahfjgj.crx [2013-06-09]
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-07-14]
CHR HKLM-x32\...\Chrome\Extension: [pgcfilbicagkadfmlakoomnidchmgmpe] - C:\ProgramData\Coolyou\pgcfilbicagkadfmlakoomnidchmgmpe.crx [2012-08-07]
CHR StartMenuInternet: Google Chrome - C:\Users\Silvija Sagolj\AppData\Local\Google\Chrome\Application\chrome.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-07-23] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-07-23] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390176 2014-07-14] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1767520 2014-07-14] (Microsoft Corporation)
S2 CLKMSVC10_9EC60124; c:\Program Files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe [248304 2011-08-12] (CyberLink)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-16] ()
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-10] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-10] (NVIDIA Corporation)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-23] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-07-23] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-07-23] (Avira Operations GmbH & Co. KG)
U5 FontCache3.0.0.0; C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [42856 2010-11-21] (Microsoft Corporation)
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-04-18] () [File not signed]
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [300320 2013-10-23] (NVIDIA Corporation)
S3 NvStUSB; C:\Windows\system32\drivers\nvstusb.sys [122472 2011-06-13] ()
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-04-18] (Secunia)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 cpuz135; \??\C:\Windows\TEMP\cpuz135\cpuz135_x64.sys [X]
S3 cpuz136; \??\C:\Windows\TEMP\cpuz136\cpuz136_x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-11 19:13 - 2014-08-11 19:14 - 00000000 ____D () C:\Users\Silvija Sagolj\Desktop\alles
2014-08-11 19:13 - 2014-08-11 19:13 - 00000000 ____D () C:\FRST
2014-08-11 19:10 - 2014-08-11 19:10 - 02099712 _____ (Farbar) C:\Users\Silvija Sagolj\Desktop\FRST64.exe
2014-08-11 19:08 - 2014-08-11 19:08 - 00000000 _____ () C:\Users\Silvija Sagolj\defogger_reenable
2014-08-11 10:48 - 2014-08-11 10:48 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\Avira
2014-08-11 10:46 - 2014-07-23 13:29 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-08-11 10:46 - 2014-07-23 13:29 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-08-11 10:46 - 2014-07-23 13:29 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-08-11 10:44 - 2014-08-11 10:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-11 10:44 - 2014-08-11 10:46 - 00000000 ____D () C:\ProgramData\Avira
2014-08-11 10:44 - 2014-08-11 10:46 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-11 10:44 - 2014-08-11 10:44 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-11 10:43 - 2014-08-11 10:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-11 10:07 - 2014-08-11 10:07 - 00003352 ____N () C:\bootsqm.dat
2014-08-10 23:54 - 2014-08-11 16:01 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-10 23:54 - 2014-08-10 23:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-10 23:54 - 2014-08-10 23:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-10 23:54 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-10 23:54 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-10 19:39 - 2014-08-10 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-10 19:33 - 2014-08-10 19:39 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-08-10 19:33 - 2014-08-10 19:33 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\Skype
2014-08-10 12:03 - 2014-08-10 12:03 - 00005315 _____ () C:\Users\Silvija Sagolj\AppData\Local\recently-used.xbel
2014-08-10 09:16 - 2014-08-10 09:16 - 00000000 ____D () C:\Users\Silvija Sagolj\Downloads\Portrait-Professional-
2014-08-10 09:15 - 2014-08-10 09:15 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\Tempa4d0e4fceba7d0a4172e09ec1d3fd22a
2014-08-10 09:13 - 2014-08-10 12:03 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\gtk-2.0
2014-08-10 09:13 - 2014-08-10 09:13 - 00000000 ____D () C:\Users\Silvija Sagolj\.thumbnails
2014-08-10 08:56 - 2014-08-10 12:04 - 00000000 ____D () C:\Users\Silvija Sagolj\.gimp-2.8
2014-08-10 08:56 - 2014-08-10 08:56 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\gegl-0.2
2014-08-09 20:41 - 2014-08-09 20:41 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\{44B5C1C0-5A3C-4F44-B1CD-B773EF3C800A}
2014-08-01 17:46 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 17:46 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 17:46 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 17:46 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 17:46 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 17:46 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 17:46 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 17:46 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 17:46 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 17:46 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 17:45 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 17:45 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 17:45 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 17:45 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-16 16:48 - 2014-07-16 16:48 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-16 16:48 - 2014-07-16 16:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-16 16:48 - 2014-07-16 16:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-16 16:48 - 2014-07-16 16:48 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-16 16:47 - 2014-07-16 16:47 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-16 16:47 - 2014-07-16 16:47 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-16 16:47 - 2014-07-16 16:47 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-16 16:47 - 2014-07-16 16:47 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-11 19:14 - 2014-08-11 19:13 - 00000000 ____D () C:\Users\Silvija Sagolj\Desktop\alles
2014-08-11 19:13 - 2014-08-11 19:13 - 00000000 ____D () C:\FRST
2014-08-11 19:13 - 2013-06-09 14:20 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-11 19:10 - 2014-08-11 19:10 - 02099712 _____ (Farbar) C:\Users\Silvija Sagolj\Desktop\FRST64.exe
2014-08-11 19:08 - 2014-08-11 19:08 - 00000000 _____ () C:\Users\Silvija Sagolj\defogger_reenable
2014-08-11 19:08 - 2012-05-02 19:47 - 00000000 ____D () C:\Users\Silvija Sagolj
2014-08-11 19:06 - 2009-07-14 06:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-11 19:06 - 2009-07-14 06:45 - 00021296 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-11 19:03 - 2010-11-21 08:50 - 00702608 _____ () C:\Windows\system32\perfh007.dat
2014-08-11 19:03 - 2010-11-21 08:50 - 00150656 _____ () C:\Windows\system32\perfc007.dat
2014-08-11 19:03 - 2009-07-14 07:13 - 01628664 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-11 19:00 - 2013-06-28 08:08 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\CrashDumps
2014-08-11 18:58 - 2013-06-17 19:33 - 00082441 _____ () C:\Windows\setupact.log
2014-08-11 18:58 - 2011-12-08 19:12 - 00000000 ____D () C:\Program Files (x86)\Dell DataSafe Local Backup
2014-08-11 18:57 - 2011-12-08 11:28 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-11 18:57 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-11 16:01 - 2014-08-10 23:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-11 15:16 - 2011-12-08 11:30 - 01175983 _____ () C:\Windows\WindowsUpdate.log
2014-08-11 15:11 - 2011-12-08 19:16 - 00000000 ____D () C:\Users\Default\AppData\Local\SoftThinks
2014-08-11 15:11 - 2011-12-08 19:16 - 00000000 ____D () C:\Users\Default User\AppData\Local\SoftThinks
2014-08-11 15:10 - 2013-06-23 10:32 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-08-11 15:10 - 2013-06-17 19:33 - 01521612 _____ () C:\Windows\PFRO.log
2014-08-11 15:01 - 2012-05-20 16:40 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\Skype
2014-08-11 14:50 - 2012-11-29 21:18 - 00001156 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4120619775-2555974261-1378655148-1001UA.job
2014-08-11 14:04 - 2013-05-24 15:21 - 00003440 _____ () C:\Windows\System32\Tasks\PCDEventLauncherTask
2014-08-11 13:45 - 2012-10-29 20:16 - 00000000 ____D () C:\Users\Silvija Sagolj\Documents\Privat
2014-08-11 10:48 - 2014-08-11 10:48 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\Avira
2014-08-11 10:47 - 2014-08-11 10:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-11 10:46 - 2014-08-11 10:44 - 00000000 ____D () C:\ProgramData\Avira
2014-08-11 10:46 - 2014-08-11 10:44 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-11 10:44 - 2014-08-11 10:44 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-11 10:43 - 2014-08-11 10:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-11 10:07 - 2014-08-11 10:07 - 00003352 ____N () C:\bootsqm.dat
2014-08-11 09:10 - 2013-07-10 09:23 - 00000000 ____D () C:\Users\Silvija Sagolj\Documents\Important
2014-08-10 23:54 - 2014-08-10 23:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-10 23:54 - 2014-08-10 23:54 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-10 23:54 - 2012-09-24 21:34 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-10 23:54 - 2012-09-24 21:34 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\Malwarebytes
2014-08-10 23:54 - 2012-09-24 21:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-10 20:50 - 2012-11-29 21:18 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4120619775-2555974261-1378655148-1001Core.job
2014-08-10 20:01 - 2013-06-09 14:20 - 00001122 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-10 19:39 - 2014-08-10 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-08-10 19:39 - 2014-08-10 19:33 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-08-10 19:39 - 2011-12-08 19:14 - 00000000 ____D () C:\ProgramData\Skype
2014-08-10 19:33 - 2014-08-10 19:33 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\Skype
2014-08-10 12:04 - 2014-08-10 08:56 - 00000000 ____D () C:\Users\Silvija Sagolj\.gimp-2.8
2014-08-10 12:03 - 2014-08-10 12:03 - 00005315 _____ () C:\Users\Silvija Sagolj\AppData\Local\recently-used.xbel
2014-08-10 12:03 - 2014-08-10 09:13 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\gtk-2.0
2014-08-10 09:16 - 2014-08-10 09:16 - 00000000 ____D () C:\Users\Silvija Sagolj\Downloads\Portrait-Professional-
2014-08-10 09:15 - 2014-08-10 09:15 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\Tempa4d0e4fceba7d0a4172e09ec1d3fd22a
2014-08-10 09:13 - 2014-08-10 09:13 - 00000000 ____D () C:\Users\Silvija Sagolj\.thumbnails
2014-08-10 08:56 - 2014-08-10 08:56 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\gegl-0.2
2014-08-10 08:01 - 2012-06-06 21:29 - 00000000 ___RD () C:\Users\Silvija Sagolj\Dropbox
2014-08-10 08:01 - 2012-06-06 21:27 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\Dropbox
2014-08-10 01:08 - 2012-05-22 15:29 - 00000000 ____D () C:\Users\Silvija Sagolj\Documents\Meine empfangenen Dateien
2014-08-10 00:49 - 2012-06-06 21:27 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-08-10 00:36 - 2012-05-19 10:32 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\vlc
2014-08-09 20:41 - 2014-08-09 20:41 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Local\{44B5C1C0-5A3C-4F44-B1CD-B773EF3C800A}
2014-08-08 23:40 - 2013-12-23 11:14 - 00407552 ___SH () C:\Users\Silvija Sagolj\Downloads\Thumbs.db
2014-08-05 19:51 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-07-30 19:42 - 2014-06-11 18:05 - 00010236 _____ () C:\Windows\SecuniaPackage.log
2014-07-25 22:20 - 2012-05-18 09:35 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-25 22:20 - 2011-12-08 19:23 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-25 22:19 - 2012-05-18 09:35 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-23 13:29 - 2014-08-11 10:46 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-07-23 13:29 - 2014-08-11 10:46 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-07-23 13:29 - 2014-08-11 10:46 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-07-18 21:52 - 2012-05-02 22:35 - 00002414 _____ () C:\Users\Silvija Sagolj\Desktop\Google Chrome.lnk
2014-07-16 21:18 - 2013-09-25 07:42 - 00087040 ___SH () C:\Users\Silvija Sagolj\Desktop\Thumbs.db
2014-07-16 19:50 - 2012-05-10 12:00 - 00000000 ____D () C:\Users\Silvija Sagolj\AppData\Roaming\PCDr
2014-07-16 16:48 - 2014-07-16 16:48 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-07-16 16:48 - 2014-07-16 16:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-07-16 16:48 - 2014-07-16 16:48 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-07-16 16:48 - 2014-07-16 16:48 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-07-16 16:48 - 2012-05-02 21:27 - 00000000 ____D () C:\Program Files (x86)\Java
2014-07-16 16:47 - 2014-07-16 16:47 - 00319912 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-07-16 16:47 - 2014-07-16 16:47 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-07-16 16:47 - 2014-07-16 16:47 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-07-16 16:47 - 2014-07-16 16:47 - 00111016 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-07-12 14:00 - 2009-07-14 06:45 - 00421480 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-07-12 13:59 - 2014-05-06 08:30 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-07-12 13:59 - 2010-11-21 09:00 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-12 13:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-12 13:59 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\Dism
2014-07-12 08:53 - 2012-06-06 20:11 - 00000000 ____D () C:\ProgramData\Microsoft Help

Some content of TEMP:
====================
C:\Users\Silvija Sagolj\AppData\Local\Temp\amazonicon_v8.exe
C:\Users\Silvija Sagolj\AppData\Local\Temp\amazoninstallernircmdc.exe
C:\Users\Silvija Sagolj\AppData\Local\Temp\avgnt.exe
C:\Users\Silvija Sagolj\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpailquv.dll
C:\Users\Silvija Sagolj\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpg13s5f.dll
C:\Users\Silvija Sagolj\AppData\Local\Temp\sdanircmdc.exe
C:\Users\Silvija Sagolj\AppData\Local\Temp\sdapskill.exe
C:\Users\Silvija Sagolj\AppData\Local\Temp\sdaspwn.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
und Gmer:
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-11 19:30:44
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST975042 rev.0002 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\SILVIJ~1\AppData\Local\Temp\agldrkog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE[2664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE[2664] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2912] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW                          0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW                            0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                            0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW                          0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                  0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                  0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                  0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                    0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW + 2                0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                        0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                      0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                          0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                            0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                    0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                      0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\USER32.dll!CreateWindowExW                            0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                        0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                        0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                  0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                            00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\ole32.dll!CoCreateInstance                            00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE[3612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                    0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                      0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                      0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                    0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW            0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx            0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation            0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW              0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2          0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                  0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                    0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                      0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\USER32.dll!CreateWindowExW                      0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                  0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                  0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo            0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList              0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                      00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\ole32.dll!CoCreateInstance                      00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69              0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3932] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                              0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5736] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW          0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!RegSetValueExW            0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!RegSetValueExA            0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW            0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW    0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx    0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation    0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW      0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2  0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW        0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW      0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW          0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary              0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\USER32.dll!CreateWindowExW              0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA          0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW          0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo  0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList      0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo        0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket            00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe[5204] C:\Windows\syswow64\ole32.dll!CoCreateInstance              00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                  0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                  0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                        0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                        0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                        0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                          0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                      0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                              0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                            0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                  0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                          0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                            0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                  0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                              0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                              0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                        0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                  00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe[5500] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                  00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                  0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                  0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW        0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx        0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation        0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW          0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2      0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW              0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW            0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                  0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList          0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo            0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\USER32.dll!CreateWindowExW                  0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA              0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW              0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo        0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                  00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\ole32.dll!CoCreateInstance                  00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69          0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe[6344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155        0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                        0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                          0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                          0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                        0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                  0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                              0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                      0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                    0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                        0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                          0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                          0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                      0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                      0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                  0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                    0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                          00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[6456] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                          00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                        0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                          0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                          0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                        0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                  0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2              0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                      0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                    0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                        0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                          0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\USER32.dll!CreateWindowExW                          0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                      0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                      0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                  0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                    0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                          00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\Dell\Stage Remote\StageRemoteService.exe[6760] C:\Windows\syswow64\ole32.dll!CoCreateInstance                          00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                  0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                    0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                    0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                  0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                          0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                          0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                          0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                            0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                        0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                              0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                  0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                    0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                    0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                          0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                            0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                              0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                    00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\Cyberlink\Shared files\brs.exe[7152] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                    00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                          0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                            0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                            0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                            0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                    0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                    0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                    0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                      0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                                  0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                        0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                      0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                          0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                              0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                              0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                          0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                          0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                  0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                      0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                        0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                            00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\PowerISO\PWRISOVM.EXE[6220] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                              00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                  0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                  0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                  0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                          0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                          0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                          0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                            0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                        0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                              0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                            0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                    0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                            0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                              0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                    0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                        0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                          0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[6564] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
?      C:\Windows\system32\mssprxy.dll [6564] entry point in ".rdata" section                                                                        000000005cf071e6
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                            0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                              0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                              0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                              0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                      0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                      0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                      0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                        0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                    0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                          0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                        0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                            0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                            0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                            0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                    0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                              00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe[6748] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                        0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                          0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                          0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                          0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                  0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                  0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                  0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                    0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                                0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                      0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                    0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                        0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                            0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                    0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                      0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                            0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                        0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                        0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                          00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[6888] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                            00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW                            0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW                              0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                              0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW                              0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                      0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                      0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                      0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                        0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW + 2                    0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                          0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                        0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                            0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                            0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                            0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                    0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                              00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                      0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[6708] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                      0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                      0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                        0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                        0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                        0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                  0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                              0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                    0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                  0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                      0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                          0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                          0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                      0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                      0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                              0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                  0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                    0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                        00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                          00000000777e9d0b 5 bytes JMP 000000016bdb1217
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                0000000076e71465 2 bytes [E7, 76]
.text  C:\Program Files (x86)\Dell\Stage Remote\DMR.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                0000000076e714bb 2 bytes [E7, 76]
.text  ...                                                                                                                                            * 2
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                        0000000076b31f0e 7 bytes JMP 000000016bdb168b
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                          0000000076b35bad 7 bytes JMP 000000016bdb11a4
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                          0000000076b41409 7 bytes JMP 000000016bdb1280
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                          0000000076b4ea45 7 bytes JMP 000000016bdb123a
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                  0000000076b5b21b 5 bytes JMP 000000016bdb15a0
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                  0000000076bd8e24 7 bytes JMP 000000016bdb132f
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                  0000000076bd8ea9 5 bytes JMP 000000016bdb16cc
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                    0000000076bd91ff 1 byte JMP 000000016bdb1703
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW + 2                                0000000076bd9201 3 bytes {JMP 0xfffffffff51d8504}
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                      0000000077351d29 5 bytes JMP 000000016bdb11bd
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                    0000000077351dd7 5 bytes JMP 000000016bdb1014
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                        0000000077352ab1 5 bytes JMP 000000016bdb154b
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                            0000000077352d17 5 bytes JMP 000000016bdb1267
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                    0000000076aae96b 5 bytes JMP 000000016bdb15b9
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                      0000000076aaeba5 5 bytes JMP 000000016bdb1181
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                            0000000076c48a29 5 bytes JMP 000000016bdb171c
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                        0000000076c54572 5 bytes JMP 000000016bdb10a0
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                        0000000076c6e567 5 bytes JMP 000000016bdb140b
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                0000000076ca7a5c 5 bytes JMP 000000016bdb15c8
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                          00000000777b5ea5 5 bytes JMP 000000016bdb15f0
.text  C:\Users\Silvija Sagolj\Desktop\Gmer-19357.exe[7888] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                            00000000777e9d0b 5 bytes JMP 000000016bdb1217

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4c8093304b10                                                                   
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4c8093304b10@fcc734631135                                                      0x31 0x2A 0xE8 0x02 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4c8093304b10@781fdbaef48d                                                      0xDF 0xBB 0xD7 0x9A ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4c8093304b10@d890e80c5a30                                                      0xB2 0x1B 0x6E 0xB2 ...
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4c8093304b10 (not active ControlSet)                                               
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4c8093304b10@fcc734631135                                                          0x31 0x2A 0xE8 0x02 ...
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4c8093304b10@781fdbaef48d                                                          0xDF 0xBB 0xD7 0x9A ...
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4c8093304b10@d890e80c5a30                                                          0xB2 0x1B 0x6E 0xB2 ...

---- EOF - GMER 2.1 ----

Warlord711 11.08.2014 18:52
Der Rechner geht schlagartig aus ?
Oder fährt sauber runter ?

Hast du Avira mal komplett deinstalliert und neu installiert ?

eve2504 11.08.2014 18:56
Er geht einfach aus. Da kommt ein bluescreen aber so kurz, dass er nicht lesbar ist.
Habe ich gemacht.
Zumindest lässt der Echtzeitscanner sich wieder aktivieren.

Warlord711 11.08.2014 19:03
Aber Bluescreen bleibt ?

eve2504 11.08.2014 19:04
Nein, geht sofort weg und der PC ist einfach aus. Kein richtiges runterfahren, einfach aus.

Warlord711 11.08.2014 19:10
Der Rechner hat in der Registry für einen User eine Einschränkung:

Code:
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Policies\Explorer: [DisallowRun] 1
Weisst du ob das gewollt ist ? Gibt es einen eingeschränkten Benutzer ?

eve2504 11.08.2014 19:11
Heißt das, einen anderen Nutzer? Nein, habe ich nie eigestellt

Warlord711 11.08.2014 19:58
Hm ok, lass uns grad mal testen wer das ist:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
cmd: wmic useraccount | findstr "S-1-5-21-4120619775-2555974261-1378655148-1001"

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


eve2504 11.08.2014 20:05
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-08-2014 01
Ran by Silvija Sagolj at 2014-08-11 21:05:34 Run:1
Running from C:\Users\Silvija Sagolj\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
cmd: wmic useraccount | findstr "S-1-5-21-4120619775-2555974261-1378655148-1001"
       
*****************


=========  wmic useraccount | findstr "S-1-5-21-4120619775-2555974261-1378655148-1001" =========

512          SilvijaSagolj\Silvija Sagolj                                                                          FALSE    SilvijaSagolj                              TRUE          FALSE    Silvija Sagolj  TRUE                FALSE            FALSE            S-1-5-21-4120619775-2555974261-1378655148-1001  1        OK       


========= End of CMD: =========


==== End of Fixlog ====

Warlord711 12.08.2014 07:54
OK. Bitte die 2 Schritte hier ausführen, die Logs posten und dann bitte testen, ob Avira normal läuft.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Policies\Explorer: [DisallowRun] 1
HKLM\...\Policies\Explorer: [RestrictRun] 0
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Downloade dir bitte Farbar Service Scanner Farbar Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.

Poste bitte den Inhalt hier.



eve2504 12.08.2014 08:02
schritt 1
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-08-2014 01
Ran by Silvija Sagolj at 2014-08-12 08:59:53 Run:2
Running from C:\Users\Silvija Sagolj\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Policies\Explorer: [RestrictRun] 0
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\...\Policies\Explorer: [DisallowRun] 1
HKLM\...\Policies\Explorer: [RestrictRun] 0
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
*****************

HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\RestrictRun => value deleted successfully.
HKU\S-1-5-21-4120619775-2555974261-1378655148-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\DisallowRun => value deleted successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\RestrictRun => value deleted successfully.
"HKLM\SOFTWARE\Policies\Google" => Key deleted successfully.

==== End of Fixlog ====
fss:
Code:
Farbar Service Scanner Version: 21-07-2014
Ran by Silvija Sagolj (administrator) on 12-08-2014 at 09:02:00
Running from "C:\Users\Silvija Sagolj\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1


Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed


**** End of log ****

Warlord711 12.08.2014 10:06
Avira läuft immer noch nicht ?

eve2504 12.08.2014 12:42
Läuft noch, aber ich meine, dass es vorher nicht so lange lief.
Außerdem sind Echtzeitscanner und Firewall wieder aktivierbar.
Ich editiere hier, sobald es durch ist.

Kann den obigen Beitrag leider nicht editieren.
Laptop ist wieder ausgegangen. Hatte Chrome gerade genutzt, dann fror alles ein und er ging ohne bluescreen aus


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:23 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131