Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Avira findet beim Scan 65 Infektionen mit PUA/Linkury.Gen2 (https://www.trojaner-board.de/167781-avira-findet-beim-scan-65-infektionen-pua-linkury-gen2.html)

volkyleo 10.06.2015 09:33

Avira findet beim Scan 65 Infektionen mit PUA/Linkury.Gen2
 
Liebes Trojanber-Board-Team,

Avira Scan vom 10.06.2015 findet 65 Bedrohungen durch PUA/Linkury.Gen2.
Ich habe alle geforderten Scans durchgeführt und poste nun die entsprechenden Log-Files.
Avira, defogger, FRST, Gmer.
Ich bedanke mich bereits für die Unterstützung.
LG Volker

Code:

Exportierte Ereignisse:

10.06.2015 07:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\AdwCleaner\Quarantine\C\Program Files
      (x86)\LPT\Smartbar.Common.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5c7400d6.qua'
      verschoben!

10.06.2015 07:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\AdwCleaner\Quarantine\C\Program Files
      (x86)\LPT\Smartbar.Communication.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0fac13ea.qua'
      verschoben!

10.06.2015 07:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\AdwCleaner\Quarantine\C\Program Files
      (x86)\LPT\Smartbar.Communication.NamedPipe.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '04984f87.qua'
      verschoben!

10.06.2015 07:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\AdwCleaner\Quarantine\C\Program Files
      (x86)\LPT\Smartbar.Infrastructure.Utilities.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '700267ff.qua'
      verschoben!

10.06.2015 07:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\AdwCleaner\Quarantine\C\Program Files
      (x86)\LPT\Smartbar.Monetization.Proxy.ProxyService.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0e791cc1.qua'
      verschoben!

10.06.2015 07:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\AdwCleaner\Quarantine\C\Program Files
      (x86)\LPT\Smartbar.Personalization.Common.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '40226fa7.qua'
      verschoben!

10.06.2015 07:24 [System-Scanner] Malware gefunden
      Die Datei 'C:\AdwCleaner\Quarantine\C\Program Files
      (x86)\LPT\Smartbar.Resources.HistoryAndStatsWrapper.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3b5213f5.qua'
      verschoben!

10.06.2015 07:23 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Common
      .dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4bb539de.qua'
      verschoben!

10.06.2015 07:23 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Commun
      ication.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3ae76597.qua'
      verschoben!

10.06.2015 07:23 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Commun
      ication.NamedPipe.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '40565f5b.qua'
      verschoben!

10.06.2015 07:23 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Infras
      tructure.Utilities.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '2872780a.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Moneti
      zation.Proxy.ProxyRemover.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '65522652.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Moneti
      zation.Proxy.ProxyService.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0b7b0981.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Person
      alization.Common.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '41d45c9f.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\Smartbar.Resour
      ces.HistoryAndStatsWrapper.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '412a56cb.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\smia.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0a626c24.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\LPT\smia64.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '6d052497.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\ChromeHost.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '465b7888.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\ProductsRemovalTool.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '33c70095.qua'
      verschoben!

10.06.2015 07:22 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\SafeFinder.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '11fe522e.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\sidc.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '65a34a5e.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Common.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '40ad3049.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Communication.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1a8f02d3.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Communication.NamedPipe.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0ddf617c.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.GUI.Controls.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1f661dc6.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.GUI.Docking.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0c82215f.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.GUI.MainClient.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '69555583.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Infrastructure.Entities.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '0cf9170f.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Infrastructure.Core.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '6dd936ba.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Infrastructure.Plugins.ChromeLocalPlugin.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '38fd7013.qua'
      verschoben!

10.06.2015 07:21 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Infrastructure.Plugins.FireFoxLocalPlugin.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '188b7491.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Infrastructure.Plugins.InternetExplorerLocalPlugin.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '709b0e0d.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Infrastructure.Utilities.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '52eb5947.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Monetization.Proxy.ProxyService.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '05652be5.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Personalization.Common.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '63d72708.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Resources.HistoryAndStatsWrapper.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '38422fc6.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Resources.LanguageSettings.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '71d80ac5.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Resources.SocialNetsSharer.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1d8e1ef8.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '2c5d53c9.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\Smartbar.Resources.Translations.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '300047cb.qua'
      verschoben!

10.06.2015 07:20 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\SmartbarInternetExplorerBHO.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3d9636e6.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\SmartbarInternetExplorerBHO2.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '68ee3233.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\SmartbarInternetExplorerExtension.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '16c23e1f.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\SmartbarInternetExplorerExtension2.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '29915a5c.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\SmartbarVersionsHelper.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '23d4711e.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\smia64.exe.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '11780abe.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\amfclgbdpgndipgoegfpkkgobahigbcl\manifest.json.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.JH' [riskware].
      Durchgeführte Aktion(en):
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '37b54abc.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\ar\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '548661c6.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\de\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '6a78011b.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\es\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '468c78dd.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\fr\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1ecd61c9.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\he\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '17c66565.qua'
      verschoben!

10.06.2015 07:19 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\it\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '52ef1c2d.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\nl\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5cf52cf7.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\pt\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '2d4c1565.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\ru\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4110395f.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Applicatio
      n\tr\Smartbar.Resources.LanguageSettings.resources.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '587802f8.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.AdvancedExeLauncherPlugin.
      dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '75222dbc.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.CustomControl.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '093a6de8.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.DMP.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '458241bf.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.MessengerPlugin.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3a9973d9.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.SafeMode.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7f1d5eea.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.WeatherPlugin.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '192a112c.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.WordPlugin.dll.vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4b754a3f.qua'
      verschoben!

10.06.2015 07:18 [System-Scanner] Malware gefunden
      Die Datei
      'C:\AdwCleaner\Quarantine\C\Users\Sch_\AppData\Local\Smartbar\Common\Ser
      vicesPlugins\Smartbar.Personalization.ServicesPlugins.YoutubeDownloadPlugin.dll.
      vir'
      enthielt einen Virus oder unerwünschtes Programm 'PUA/Linkury.Gen2' [riskware].
      Durchgeführte Aktion(en):
      Die Registrierung wurde für diese Datei nicht bereinigt, wegen zu vieler
      Mehrfachfunde. Für eine genauere Analyse sollten Sie uns diese Datei über den
      Quarantäne Manager zur genaueren Untersuchung zusenden.
      Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '53e26595.qua'
      verschoben!

Code:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:33 on 10/06/2015 (Sch_)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-


Warlord711 10.06.2015 09:39

Hi !

Die Avira Logs zeigen alle auf die AdwCleaner Quarantäne.

Falls du regelmäßig mit AdwCleaner arbeitest, erstelle in Avira eine Ausnahme für *.vir Dateien. AdwCleaner Quarantäne hängt immer .vir an die Dateien in Quarantäne.

volkyleo 10.06.2015 10:56

Hi - Danke für deine Nachricht. Sorry, dass ich noch nicht alle Log-Files gepostet habe, aber mir ist der Rechner mit einem Blue-Screen (Driver_Power_State_Failure) abgeschmiert.

Ich habe vor langer Zeit mal AdwCleaner genutzt, aber nicht in dem letzten halben Jahr.

Hier der Vollständigkeit halber die anderen Logfiles:

Code:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 09:33 on 10/06/2015 (Sch_)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015
Ran by Schneider (ATTENTION: The logged in user is not administrator) on SCH_-PC on 10-06-2015 09:34:24
Running from C:\Users\Schneider\Desktop
Loaded Profiles: Sch_ & Schneider (Available Profiles: Sch_ & UpdatusUser & Schneider)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

Failed to access process -> smss.exe
Failed to access process -> csrss.exe
Failed to access process -> wininit.exe
Failed to access process -> csrss.exe
Failed to access process -> services.exe
Failed to access process -> lsass.exe
Failed to access process -> lsm.exe
Failed to access process -> winlogon.exe
Failed to access process -> svchost.exe
Failed to access process -> ibmpmsvc.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> nvSCPAPISvr.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> svchost.exe
Failed to access process -> wlanext.exe
Failed to access process -> conhost.exe
Failed to access process -> svchost.exe
Failed to access process -> NvXDSync.exe
Failed to access process -> nvvsvc.exe
Failed to access process -> spoolsv.exe
Failed to access process -> sched.exe
Failed to access process -> tphkload.exe
Failed to access process -> TPHKSVC.exe
Failed to access process -> AcPrfMgrSvc.exe
Failed to access process -> tpnumlk.exe
Failed to access process -> armsvc.exe
Failed to access process -> avguard.exe
Failed to access process -> btwdins.exe
Failed to access process -> cvpnd.exe
Failed to access process -> svchost.exe
Failed to access process -> dlsdbnt.exe
Failed to access process -> PresentationFontCache.exe
Failed to access process -> svchost.exe
Failed to access process -> HWDeviceService64.exe
Failed to access process -> CamMute.exe
Failed to access process -> micmute.exe
Failed to access process -> TPKNRSVC.exe
Failed to access process -> lvvsst.exe
Failed to access process -> mbbService.exe
Failed to access process -> PDFProFiltSrvPP.exe
Failed to access process -> QDLService2kLenovo.exe
Failed to access process -> RegSrvc.exe
Failed to access process -> svchost.exe
Failed to access process -> WLIDSVC.EXE
Failed to access process -> AcSvc.exe
Failed to access process -> Avira.OE.ServiceHost.exe
Failed to access process -> WLIDSVCM.EXE
Failed to access process -> dlpwdnt.exe
Failed to access process -> EvtEng.exe
Failed to access process -> unsecapp.exe
Failed to access process -> WmiPrvSE.exe
Failed to access process -> avshadow.exe
Failed to access process -> WUDFHost.exe
Failed to access process -> virtscrl.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
Failed to access process -> tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
Failed to access process -> USBVaccine.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(creativbox.net, Torsten Leithold & Georg von Kries GbR) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
() C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
Failed to access process -> SearchIndexer.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
Failed to access process -> SvcGuiHlpr.exe
Failed to access process -> svchost.exe
Failed to access process -> LMS.exe
Failed to access process -> UNS.exe
Failed to access process -> svchost.exe
Failed to access process -> wmpnetwk.exe
Failed to access process -> svchost.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
Failed to access process -> OSPPSVC.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Failed to access process -> SearchProtocolHost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-15] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [228744 2012-09-20] (Lenovo.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [44096 2012-01-16] (Lenovo Group Limited)
HKLM\...\Run: [DLPSP] => C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE [421016 2007-07-25] (Dell Inc.)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [BCSSync] => C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472992 2013-03-21] (Adobe Systems Incorporated)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-05-29] (Synaptics Incorporated)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [1793736 2015-02-25] (NVIDIA Corporation)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111928 2013-05-03] (Intel Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2015-04-30] (Adobe Systems Inc.)
HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2715536 2015-04-10] (Dominik Reichl)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-09-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41360 2015-04-30] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [335232 2015-04-10] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [43871568 2015-06-02] (Dropbox, Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [SimpleSYN.NET] => C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe [2562352 2015-03-28] (creativbox.net, Torsten Leithold & Georg von Kries GbR)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911032 2015-03-18] (Microsoft Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [OneDrive] => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-26] (Microsoft Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5849.0427\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5849.0427\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {1b0dc35a-0670-11e4-81aa-f0def15a0d0a} - G:\LG_PC_Programs.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {22791074-b1f6-11e4-8767-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4911ad02-b367-11e4-bf67-f0def15a0d0a} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4c47e6e6-b358-11e4-8ba9-806e6f6e6963} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4c47e717-b358-11e4-8ba9-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {ac36bd99-61a7-11e3-ad0d-cc52af7c9255} - F:\DTLplus_Launcher.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {fb634da8-b69c-11e4-84e7-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
AppInit_DLLs: C:\Users\Sch_\AppData\Local\Smartbar\Application\Resources\crdlil64.dll => C:\Users\Sch_\AppData\Local\Smartbar\Application\Resources\crdlil64.dll File not found
AppInit_DLLs: ,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [167312 2015-02-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [147576 2015-02-25] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli ACGina
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2013-01-15]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2013-11-14]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-26] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-26] (Microsoft Corporation)
GroupPolicyUsers\S-1-5-21-3128309724-421563842-2291253580-1002\User: Group Policy Restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
URLSearchHook: [S-1-5-21-3128309724-421563842-2291253580-1000] ATTENTION ==> Default URLSearchHook is missing
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-16] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-16] (Oracle Corporation)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-3128309724-421563842-2291253580-1002 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {8FEFF364-6A5F-4966-A917-A3AC28411659} hxxp://download.easetuner.com/download/SOPCORE.CAB
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Schneider\AppData\Roaming\Mozilla\Firefox\Profiles\fricryze.default-1410854564604
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-26] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-16] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-16] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-02-15] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2013-03-21] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-26] ()
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-02-15] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-27] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2013-03-21] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Extension: Adblock Plus - C:\Users\Schneider\AppData\Roaming\Mozilla\Firefox\Profiles\fricryze.default-1410854564604\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-02-02]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-16]

Chrome:
=======
CHR Profile: C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-01-16]
CHR Extension: (Google Drive) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-14]
CHR Extension: (Flash Video Downloader) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckonikmheknimhhabkpfnjempmioakll [2014-07-03]
CHR Extension: (Video Downloader professional) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\elicpjhcidhpjomhibiffojpinpmmpil [2014-10-14]
CHR Extension: (Avira Browser Safety) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-08-06]
CHR Extension: (AdBlock) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-22]
CHR Extension: (Bookmark Manager) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-04-16]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-05]
CHR Extension: (Lightshot (screenshot tool)) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\mbniclmhobmnbdlbpiphghaielnnpgdp [2014-10-01]
CHR Extension: (Google Wallet) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]
CHR Extension: (Gmail) - C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-01-16]
CHR HKU\S-1-5-21-3128309724-421563842-2291253580-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\SCHNEI~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-08-14]
CHR HKU\S-1-5-21-3128309724-421563842-2291253580-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-05] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-05] (Dropbox, Inc.)
R2 DLPWD; C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE [107928 2006-12-07] (Dell Inc.)
R2 DLSDB; C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE [191896 2006-12-07] (Dell Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-09-24] (Lenovo.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-02-06] ()
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 lmhosts; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239184 2014-02-15] ()
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NlaSvc; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\SysWOW64\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 QDLService2kLenovo; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe [1688384 2011-05-23] (QUALCOMM, Inc.)
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2013-04-18] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2013-06-28] (LG Electronics Inc.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 qcfilterlno2k; C:\Windows\System32\DRIVERS\qcfilterlno2k.sys [6400 2011-05-23] (QUALCOMM Incorporated)
R3 qcusbnetlno2k; C:\Windows\System32\DRIVERS\qcusbnetlno2k.sys [444416 2011-05-23] (QUALCOMM Incorporated)
R3 qcusbserlno2k; C:\Windows\System32\DRIVERS\qcusbserlno2k.sys [231040 2011-05-23] (QUALCOMM Incorporated)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [31472 2014-08-25] (Synaptics Incorporated)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-10 09:34 - 2015-06-10 09:34 - 00035114 _____ C:\Users\Schneider\Desktop\FRST.txt
2015-06-10 09:34 - 2015-06-10 09:34 - 00000000 ____D C:\FRST
2015-06-10 09:33 - 2015-06-10 09:33 - 02108928 _____ (Farbar) C:\Users\Schneider\Downloads\FRST64.exe
2015-06-10 09:33 - 2015-06-10 09:33 - 02108928 _____ (Farbar) C:\Users\Schneider\Desktop\FRST64.exe
2015-06-10 09:33 - 2015-06-10 09:33 - 00000486 _____ C:\Users\Schneider\Desktop\defogger_disable.log
2015-06-10 09:33 - 2015-06-10 09:33 - 00000000 _____ C:\Users\Sch_\defogger_reenable
2015-06-10 09:32 - 2015-06-10 09:32 - 00050477 _____ C:\Users\Schneider\Downloads\Defogger.exe
2015-06-10 09:32 - 2015-06-10 09:32 - 00050477 _____ C:\Users\Schneider\Desktop\Defogger.exe
2015-06-10 09:21 - 2015-06-10 09:21 - 00059121 _____ C:\Users\Schneider\Desktop\Regression.xlsx
2015-06-10 07:27 - 2015-06-10 07:27 - 00074326 _____ C:\Users\Schneider\Desktop\Avira.txt
2015-06-09 15:02 - 2015-06-09 15:03 - 40301384 _____ C:\Users\Schneider\Downloads\Firefox Setup 38.0.6.exe
2015-06-09 15:01 - 2015-06-09 21:23 - 02678968 _____ C:\Users\Schneider\Desktop\Akquise .xlsx
2015-06-09 14:47 - 2015-06-09 14:47 - 18054744 _____ (Adobe Systems Inc.) C:\Users\Schneider\Downloads\AdobeAIRInstaller.exe
2015-06-09 13:17 - 2015-06-09 13:17 - 00025998 _____ C:\Users\Schneider\Downloads\FirmenadressenBSP.xlsx
2015-06-08 22:43 - 2015-06-08 22:44 - 01330371 _____ C:\Users\Schneider\Downloads\LA Open 2015.zip
2015-06-06 20:22 - 2015-06-06 20:22 - 00000000 ____D C:\Users\Schneider\AppData\Local\GWX
2015-06-05 23:00 - 2015-06-05 23:00 - 82771853 _____ C:\Users\Schneider\Downloads\nice slow cock massage - Pornhubcom.mp4.crdownload
2015-06-05 19:14 - 2015-06-05 19:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-06-05 19:13 - 2015-06-10 09:18 - 00001226 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2015-06-05 19:13 - 2015-06-10 09:15 - 00001222 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2015-06-05 19:13 - 2015-06-05 19:15 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-06-05 19:13 - 2015-06-05 19:13 - 00000000 ____D C:\Users\Schneider\AppData\Local\Dropbox
2015-06-05 19:13 - 2015-06-05 19:13 - 00000000 ____D C:\ProgramData\Dropbox
2015-06-05 14:15 - 2015-06-09 15:04 - 00001153 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-06-05 14:12 - 2015-06-05 14:15 - 51306608 _____ (Dropbox, Inc.) C:\Users\Schneider\Downloads\Dropbox 3.6.5.exe
2015-06-05 14:05 - 2015-06-05 14:05 - 00002032 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2015-06-05 12:08 - 2015-06-09 12:50 - 00011824 _____ C:\Users\Schneider\Desktop\CRM Entscheidungsmatrix.xlsx
2015-06-04 22:38 - 2015-06-04 22:38 - 16429971 _____ C:\Users\Schneider\Downloads\_exchange_picture_170372.zip
2015-06-04 19:45 - 2015-06-04 19:45 - 00000000 ____D C:\Users\Schneider\Desktop\NPS
2015-06-03 17:59 - 2015-06-03 17:59 - 00989511 _____ C:\Users\Schneider\Desktop\Präsentation1.pptx
2015-06-03 14:15 - 2015-06-03 14:15 - 00023552 _____ C:\Users\Schneider\Downloads\LISRELTrialData.xls
2015-06-03 14:09 - 2015-06-03 14:09 - 00002651 _____ C:\Users\Public\Desktop\LISREL 9.2 Student.lnk
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSI, Inc
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\Program Files (x86)\LISREL9S
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\LISREL9 Student Examples
2015-06-03 14:07 - 2015-06-04 19:44 - 00000000 ____D C:\Users\Schneider\Desktop\Strukturgleichungsmodell
2015-06-02 15:07 - 2015-06-04 19:45 - 00000000 ____D C:\Users\Schneider\Desktop\IHK
2015-05-29 13:54 - 2015-06-03 10:12 - 00917243 _____ C:\Users\Schneider\Desktop\Alte_Prognosemodelle.pptx
2015-05-29 13:07 - 2015-06-05 19:13 - 00000000 ____D C:\Users\Sch_\AppData\Local\Dropbox
2015-05-29 13:04 - 2015-05-29 13:05 - 51079592 _____ (Dropbox, Inc.) C:\Users\Schneider\Downloads\Dropbox 3.6.4.exe
2015-05-28 13:24 - 2015-05-28 14:31 - 17791197 _____ C:\Users\Schneider\Downloads\PM Benchmarking v.11_aktuell.pptx
2015-05-27 12:14 - 2015-05-27 17:32 - 00039464 _____ C:\Users\Schneider\Downloads\Kontoumsatz_vom_27052015.xlsx
2015-05-27 00:17 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-05-13 14:48 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 14:48 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 12:04 - 2015-04-27 21:28 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-05-13 12:04 - 2015-04-27 21:28 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-13 12:04 - 2015-04-27 21:28 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-13 12:04 - 2015-04-27 21:26 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 01254400 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-05-13 12:04 - 2015-04-27 21:23 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-05-13 12:04 - 2015-04-27 21:22 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-13 12:04 - 2015-04-27 21:22 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-05-13 12:04 - 2015-04-27 21:21 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-13 12:04 - 2015-04-27 21:18 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-13 12:04 - 2015-04-27 21:18 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:16 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 21:11 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-05-13 12:04 - 2015-04-27 21:11 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-05-13 12:04 - 2015-04-27 21:08 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-13 12:04 - 2015-04-27 21:05 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-05-13 12:04 - 2015-04-27 21:04 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-05-13 12:04 - 2015-04-27 21:04 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-13 12:04 - 2015-04-27 21:04 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-05-13 12:04 - 2015-04-27 21:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-05-13 12:04 - 2015-04-27 21:04 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-05-13 12:04 - 2015-04-27 21:04 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-05-13 12:04 - 2015-04-27 21:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-05-13 12:04 - 2015-04-27 21:04 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-13 12:04 - 2015-04-27 21:03 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-05-13 12:04 - 2015-04-27 21:03 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-05-13 12:04 - 2015-04-27 21:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-13 12:04 - 2015-04-27 21:03 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-13 12:04 - 2015-04-27 21:03 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-05-13 12:04 - 2015-04-27 21:03 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-05-13 12:04 - 2015-04-27 21:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-13 12:04 - 2015-04-27 21:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 20:06 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-05-13 12:04 - 2015-04-27 19:57 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-05-13 12:04 - 2015-04-27 19:57 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-05-13 12:04 - 2015-04-27 19:55 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-05-13 12:04 - 2015-04-27 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-05-13 11:41 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-13 11:41 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-13 11:41 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-13 11:41 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-13 11:41 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 11:41 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 11:40 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-13 11:40 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-13 11:40 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-13 11:40 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-13 11:40 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-13 11:40 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-13 11:40 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-13 11:40 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-13 11:40 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-13 11:40 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-13 11:40 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-13 11:40 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-13 11:40 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-13 11:40 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-13 11:40 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-13 11:40 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-13 11:40 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-13 11:40 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-13 11:40 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-13 11:40 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-13 11:40 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-13 11:40 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-13 11:40 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-13 11:40 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-13 11:40 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-13 11:40 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-13 11:40 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-13 11:40 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-13 11:40 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-13 11:40 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-13 11:40 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-13 11:40 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-13 11:40 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-13 11:40 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-13 11:40 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-13 11:40 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-13 11:40 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-13 11:40 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-13 11:40 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-13 11:40 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-13 11:40 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-13 11:40 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-13 11:40 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-13 11:40 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-13 11:40 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-13 11:40 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-13 11:40 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-13 11:40 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-13 11:40 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-13 11:40 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-13 11:40 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-13 11:40 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-13 11:40 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-13 11:40 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-13 11:40 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-13 11:40 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-13 11:40 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-13 11:40 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-13 11:40 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 11:40 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 11:40 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 11:40 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-13 11:40 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 11:39 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 11:39 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 11:39 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 11:39 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 11:39 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 11:39 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 11:39 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 11:39 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 11:39 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 11:39 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 11:39 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-13 11:31 - 2015-05-13 11:31 - 00000000 ____D C:\Users\Schneider\AppData\Local\NVIDIA
2015-05-13 11:30 - 2015-05-13 11:30 - 00000000 ____D C:\Windows\SysWOW64\NV
2015-05-13 11:30 - 2015-05-13 11:30 - 00000000 ____D C:\Windows\system32\NV
2015-05-13 11:24 - 2015-02-04 02:00 - 00608072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-05-13 11:19 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-13 11:19 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-13 11:19 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-13 11:19 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-12 07:27 - 2015-05-12 07:27 - 00102376 _____ (Lenovo.) C:\Windows\system32\ibmpmsvc.exe
2015-05-12 07:27 - 2015-05-12 07:27 - 00074728 _____ (Lenovo.) C:\Windows\system32\ibmpmctl.exe
2015-05-12 07:27 - 2015-05-12 07:27 - 00063464 _____ (Lenovo.) C:\Windows\system32\Drivers\ibmpmdrv.sys
2015-05-12 07:27 - 2015-05-12 07:27 - 00042472 _____ (Lenovo.) C:\Windows\system32\tpinspm.dll
2015-05-11 15:43 - 2015-05-11 16:10 - 00000000 ____D C:\Users\Schneider\Desktop\diupp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-10 09:33 - 2013-01-15 16:12 - 00000000 ____D C:\Users\Sch_
2015-06-10 09:29 - 2013-08-16 16:13 - 00046206 _____ C:\Users\Schneider\Desktop\volky.kdbx
2015-06-10 09:29 - 2009-07-14 06:45 - 00026672 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-10 09:29 - 2009-07-14 06:45 - 00026672 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-10 09:19 - 2013-01-17 17:09 - 00000000 ____D C:\Users\Schneider\Documents\Outlook-Dateien
2015-06-10 09:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-06-10 09:18 - 2013-01-15 16:12 - 01802766 _____ C:\Windows\WindowsUpdate.log
2015-06-10 09:15 - 2013-01-15 23:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-10 09:14 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-10 09:13 - 2015-04-24 12:15 - 00004816 _____ C:\Windows\setupact.log
2015-06-10 09:13 - 2013-01-15 16:25 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-10 07:27 - 2013-08-16 16:13 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\KeePass
2015-06-10 06:54 - 2015-04-26 19:47 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-10 06:48 - 2013-01-15 23:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-09 15:05 - 2013-01-16 02:38 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\Skype
2015-06-09 15:04 - 2014-02-21 11:01 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-06-09 15:04 - 2014-02-21 11:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-09 15:03 - 2014-12-21 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-09 11:30 - 2013-12-15 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-09 11:29 - 2013-12-15 16:45 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-09 11:29 - 2013-12-15 16:45 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-06-08 22:50 - 2013-01-17 20:46 - 00000000 ____D C:\Users\Schneider\Documents\eXtremeGammon
2015-06-08 11:05 - 2014-09-26 11:05 - 00000324 _____ C:\Windows\Tasks\SuperEasyDriverUpdater.job
2015-06-08 09:35 - 2013-03-12 18:49 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\Dropbox
2015-06-05 19:13 - 2013-03-12 18:49 - 00000000 ____D C:\Users\Sch_\AppData\Roaming\Dropbox
2015-06-05 14:15 - 2013-01-16 02:37 - 00000000 ____D C:\ProgramData\Skype
2015-06-05 14:13 - 2014-04-01 09:36 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2015-06-05 14:13 - 2013-03-13 17:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-06-05 14:05 - 2013-01-16 00:13 - 00002465 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2015-06-05 14:05 - 2013-01-16 00:13 - 00002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
2015-06-05 14:05 - 2013-01-16 00:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
2015-06-05 14:04 - 2014-09-26 09:41 - 00000000 ____D C:\Intel
2015-06-04 19:41 - 2009-07-14 06:45 - 00427992 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-03 15:03 - 2013-01-15 20:23 - 00111008 _____ C:\Users\Schneider\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-03 09:41 - 2009-07-14 12:57 - 00699682 _____ C:\Windows\system32\perfh007.dat
2015-06-03 09:41 - 2009-07-14 12:57 - 00149790 _____ C:\Windows\system32\perfc007.dat
2015-06-03 09:41 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-02 15:44 - 2014-12-05 00:27 - 00000000 ____D C:\Users\Schneider\Desktop\Desktop_Stuff
2015-06-02 11:37 - 2015-03-16 15:19 - 00000000 ____D C:\Users\Schneider\AppData\Local\CrashDumps
2015-06-01 15:08 - 2013-07-02 20:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-05-30 00:18 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-27 17:32 - 2014-02-22 00:51 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\vlc
2015-05-27 00:39 - 2014-04-08 10:25 - 00000000 ____D C:\Users\Sch_\AppData\Roaming\Notepad++
2015-05-27 00:39 - 2014-04-08 10:25 - 00000000 ____D C:\Program Files (x86)\Notepad++
2015-05-27 00:36 - 2013-11-22 13:10 - 00000000 ____D C:\Program Files\CCleaner
2015-05-27 00:10 - 2015-04-04 22:42 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-27 00:10 - 2015-04-04 22:42 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-26 23:45 - 2014-07-22 11:40 - 00002203 _____ C:\Users\Schneider\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-14 17:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-05-14 14:14 - 2013-01-16 00:23 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-05-13 20:11 - 2009-07-14 13:21 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-13 20:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-13 20:06 - 2013-08-11 17:49 - 00000000 ____D C:\Windows\system32\MRT
2015-05-13 20:00 - 2013-01-15 21:29 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-13 14:47 - 2013-07-10 14:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 14:46 - 2013-07-10 14:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-13 14:46 - 2013-07-10 14:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 11:27 - 2013-12-12 22:04 - 01594964 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-05-12 14:53 - 2015-01-07 16:07 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\avidemux
2015-05-11 16:04 - 2013-02-04 18:26 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\SuperMailer

==================== Files in the root of some directories =======

2015-04-24 13:28 - 2015-04-24 13:28 - 6103040 _____ () C:\Program Files (x86)\GUT3ED4.tmp
2013-01-15 23:48 - 2013-01-15 23:48 - 4096000 _____ () C:\Program Files (x86)\GUTC957.tmp
2014-09-18 14:29 - 2015-01-22 14:32 - 0000111 _____ () C:\Users\Schneider\AppData\Roaming\Camdata.ini
2014-09-18 14:29 - 2015-01-22 14:32 - 0000408 _____ () C:\Users\Schneider\AppData\Roaming\CamLayout.ini
2014-09-18 14:29 - 2015-01-22 14:32 - 0000408 _____ () C:\Users\Schneider\AppData\Roaming\CamShapes.ini
2014-09-18 14:29 - 2015-01-22 14:32 - 0004547 _____ () C:\Users\Schneider\AppData\Roaming\CamStudio.cfg
2015-04-22 16:44 - 2015-04-22 16:44 - 0009375 _____ () C:\Users\Schneider\AppData\Roaming\Kommagetrennte Werte (Windows).EML
2015-04-22 16:40 - 2015-04-22 16:40 - 0009366 _____ () C:\Users\Schneider\AppData\Roaming\Microsoft Excel 97-2003.EML
2014-09-18 14:23 - 2014-10-24 23:40 - 0000096 _____ () C:\Users\Schneider\AppData\Roaming\version2.xml
2014-12-20 22:52 - 2014-12-20 22:59 - 0005632 _____ () C:\Users\Schneider\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2015-04-20 18:41 - 2015-04-20 18:41 - 0002095 _____ () C:\Users\Schneider\AppData\Local\recently-used.xbel
2013-02-18 19:14 - 2013-02-18 19:14 - 21748128 _____ () C:\Users\Schneider\AppData\Local\TempFullTiltPokerEuSetup.exe
2014-08-24 17:53 - 2014-08-24 17:53 - 0000000 _____ () C:\Users\Schneider\AppData\Local\{9B751C3E-E6C0-43B7-A9C5-8ECBD28D64F8}
2013-10-09 11:24 - 2013-10-09 11:24 - 0000106 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc

Some files in TEMP:
====================
C:\Users\Schneider\AppData\Local\Temp\avgnt.exe
C:\Users\Schneider\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpuwwz5o.dll
C:\Users\Sch_\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

==================== End of log ============================


volkyleo 10.06.2015 10:57

[CODE]Additional
FRST Logfile:
Code:

scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Schneider at 2015-06-10 09:35:14
Running from C:\Users\Schneider\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3128309724-421563842-2291253580-500 - Administrator - Disabled)
Gast (S-1-5-21-3128309724-421563842-2291253580-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3128309724-421563842-2291253580-1008 - Limited - Enabled)
rmophcbsllRTWGPAGVT (S-1-5-21-3128309724-421563842-2291253580-1006 - Administrator - Enabled)
Schneider (S-1-5-21-3128309724-421563842-2291253580-1002 - Limited - Enabled) => C:\Users\Schneider
Sch_ (S-1-5-21-3128309724-421563842-2291253580-1000 - Administrator - Enabled) => C:\Users\Sch_
UpdatusUser (S-1-5-21-3128309724-421563842-2291253580-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.14 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.144 - Adobe Systems Incorporated)
Adobe Bridge CC (64 Bit) (HKLM-x32\...\{359F8007-6486-429C-A8C5-D67F6897C88C}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.62.01 - )
Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.8.9046 - )
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.574 - Avira Operations GmbH & Co. KG)
Brother MFL-Pro Suite MFC-7360N (HKLM-x32\...\{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}) (Version: 1.0.9.0 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Conexant 20585 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.95.48.50 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DataQualityTools (x32 Version: 4.1 - Thomas Hainke Dipl. Inform. Univ.) Hidden
Dell-Druckersoftware (HKLM-x32\...\{105F3CE5-FE55-408E-BF30-E78F85BA0B12}) (Version: 1.00.000 - Dell Inc.)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.6.5 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.27.23 - Dropbox, Inc.) Hidden
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.36 - )
eXtreme Gammon 2 (HKLM-x32\...\{2F5AF5E1-E021-4832-A423-EF480EC58A0B}_is1) (Version: 2.10 - GameSite 2000, Ltd.)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
FileZilla Client 3.11.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.11.0.2 - Tim Kosse)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Full Tilt Poker.Eu (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.30.43.WIN.FullTilt.EU - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GNU Backgammon (Version 1_03_000, 20140804) (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\GNU Backgammon_is1) (Version:  - Free Software Foundation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Drive (HKLM-x32\...\{CBC9F5FD-5CFA-4A33-81CD-369EAB77E3A6}) (Version: 1.22.9403.0223 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GridGammon 3.8.0 (Build 896) (HKLM-x32\...\GridGammon) (Version: 3.8.0 (Build 896) - Jensen-Barclay, LLC)
IBM SPSS Statistics 22 (HKLM\...\{104875A1-D083-4A34-BC4F-3F635B7F8EF7}) (Version: 22.0.0.0 - IBM Corp)
Integrated Camera Driver Installer Package Ver.1.1.0.48 (HKLM-x32\...\{C3CD17B4-08B0-492D-8A4C-81716D33E520}) (Version: 1.1.0.48 - RICOH)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.2.50.1050 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2253 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{D75AEB5B-FA18-4BD4-9EED-54CA46DB5AE8}) (Version: 13.04.0000 - Intel Corporation)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
KeePass Password Safe 2.29 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.29 - Dominik Reichl)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.11 - )
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Mobile Broadband Activation (HKLM-x32\...\{A95D9DF7-CF34-421A-A1DC-936A49A4DAEA}) (Version: 4.2.1003.00 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{A7BB9BBD-DFE4-4276-820A-7CD141FC09E6}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{1C83CB66-D345-4D6C-95A2-63A03269ADA0}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.10.07 - )
Lenovo Solution Center (HKLM\...\{4041B18B-DE30-4D78-9D60-6ADC586C5E00}) (Version: 2.1.003.00 - Lenovo Group Limited)
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
LG PC Suite (HKLM-x32\...\LG PC Suite) (Version: 5.3.06.20130913 - LG Electronics)
LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)
LISREL 9.2 for Windows (Student) (HKLM-x32\...\{1DDDDB1A-DBE8-449F-9016-819A423B5832}) (Version: 9.2 - SSI)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-Bit (HKLM\...\{95140000-007A-0407-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit (HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.25.00.03 - Huawei Technologies Co.,Ltd)
MobileWiFi (HKLM-x32\...\MobileWiFi) (Version: TOOL-ConnLaucher_WIN1.12.05.00 - Huawei Technologies Co.,Ltd)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.6 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.6 (x86 en-US)) (Version: 38.0.6 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.0.6 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 341.44 - NVIDIA Corporation)
NVIDIA Grafiktreiber 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.44 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.22.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.22.1 - NVIDIA Corporation)
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version:  - Panda Security)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
partypoker (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\PartyPoker) (Version:  - )
partypoker backgammon (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\PartyGammon) (Version:  - )
PokerSnowie (HKLM-x32\...\PokerSnowie_is1) (Version:  - Snowie Games Ltd)
Qualcomm Gobi 2000 Package for Lenovo (HKLM-x32\...\{666C9123-1AEC-446F-8AA8-28256B1953D4}) (Version: 1.1.250 - QUALCOMM)
RICOH R5U230 Media Driver ver.2.06.02.02 (HKLM-x32\...\{022CBB38-CEF0-42BA-906A-A49BEFAE0BEE}) (Version: 2.06.02.02 - RICOH)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Scansoft PDF Professional (x32 Version:  - ) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SimpleSYN 3.5  (HKLM-x32\...\{bd41baf4-c624-43d4-8770-50c80d735148}) (Version: 3.5.7528 - creativbox.net)
SimpleSYN 3.5  (Version: 3.5.7528 - creativbox.net) Hidden
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
SRecorder (HKLM-x32\...\SRecorder_is1) (Version: 2.0.0.0 - SRecorder Company)
SuperEasy Driver Updater v.1.1.1 (HKLM-x32\...\{039BC111-D60F-A6FF-85F4-7992EA886B8D}_is1) (Version: 1.1.1 - SuperEasy Software GmbH & Co. KG)
SuperMailer 8.00 (HKLM\...\Newsletter Software SuperMailer (x64)_is1) (Version: 8.00 - Mirko Boeer Softwareentwicklungen)
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.3200 - Broadcom Corporation)
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.9 - )
ThinkPad Wireless LAN Adapter Software (HKLM-x32\...\{9D3D2C60-A55F-4fed-B2B9-17394396DF01}) (Version: 1.00.0029.8 - REALTEK Semiconductor Corp.)
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 5.97 - Lenovo)
ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 2.09 - Lenovo)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.9 - Lenovo)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
Verizon Wireless Mobile Broadband Self Activation (HKLM-x32\...\{193CA6A6-E735-40B1-AA92-F611B291792C}) (Version: 3.2.2 - Smith Micro Software, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Webinaria 2.0 (HKLM-x32\...\Webinaria_is1) (Version:  - Charlwood eMarketing)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430) (HKLM\...\DE7217D2A8B057F15EC6E52329FDAB84231521E8) (Version: 04/08/2010 6.3.5.430 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================

ATTENTION: System Restore is disabled
Check "winmgmt" service or repair WMI.


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job =>
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job =>
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job =>
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job =>
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job =>
Task: C:\Windows\Tasks\SuperEasyDriverUpdater.job =>
Task: C:\Windows\Tasks\SuperEasyDriverUpdater_UPDATES.job =>

==================== Loaded Modules (Whitelisted) ==============

2015-02-25 12:52 - 2015-02-25 12:52 - 00010952 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2015-06-02 17:20 - 2015-06-02 17:20 - 00043480 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2015-04-15 22:13 - 2015-04-15 22:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2011-06-13 20:37 - 2011-06-13 20:37 - 00173344 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2011-09-06 16:34 - 2010-11-28 20:34 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2015-03-28 13:42 - 2015-03-28 13:42 - 00107312 _____ () C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.Engine.XmlSerializers.dll
2014-03-14 14:31 - 2014-03-14 14:31 - 00061752 _____ () C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.WCF.XmlSerializers.dll
2015-01-27 14:18 - 2015-01-27 14:18 - 02926800 _____ () C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
2013-01-15 18:34 - 2012-09-24 07:36 - 00104960 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2015-04-29 15:15 - 2015-04-29 15:15 - 03445656 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\PDFMaker\Common\X64\AdobePDFMakerX.dll
2015-04-30 00:16 - 2015-04-30 00:16 - 01446400 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Locale\de_DE\PDFMaker\AdobePDFMakerX.DEU
2013-02-15 03:36 - 2013-02-15 03:36 - 01554496 _____ () C:\Program Files\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll
2014-03-14 14:31 - 2014-03-14 14:31 - 00030520 _____ () C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.Ipc.XmlSerializers.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{0177C179-5A17-4DC3-B7F3-4CA2E396168D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{D5A40BBA-3515-4CB9-AC1B-D6A996211BDE}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{B35DABEB-105A-4271-A8D8-5D98FE961F47}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{88A966CC-5EBF-4ECB-BA84-4EB0AB253802}C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{247A6B68-1635-43AC-A4CF-83CFE8C40250}C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{C2500268-171F-49B8-8AFB-469468D61094}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B7744C75-B336-449B-80C5-838BFA32522A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TCP Query User{619C759E-E4F6-4D05-AEFA-9DD14DE2E5A2}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{364DFD2B-928E-441A-9F38-3173B14FF6AC}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{9D80FF1E-6EF6-476D-A249-18A3B58E2C43}] => (Allow) C:\Program Files (x86)\Brother\Brmfl10f\FAXRX.exe
FirewallRules: [{E018E007-1CB5-46D4-87E8-822DEB1CE7CC}] => (Allow) C:\Program Files (x86)\Brother\Brmfl10f\FAXRX.exe
FirewallRules: [{F00692B4-B2C4-445D-8B0B-C79A61D93201}] => (Allow) LPort=54925
FirewallRules: [TCP Query User{99319B7C-37DB-4498-8DB0-373D0C469523}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [UDP Query User{09336A13-8ABA-4F12-A7D8-B2C971265816}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [{FE117F15-FCDE-4F57-A594-DBFDEC0886CB}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{7040AA9B-A43A-4F40-9FF5-D95F6C3B89F5}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{14ED3387-E667-4906-8FBE-95D2652107A8}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{FD2120EC-AAE4-46F1-AEA1-4EBCF6E5FF13}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{E45D337E-4545-423F-BCD5-D2AEE72B96A4}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{C1F24B9E-E2D0-4EF1-9494-8435F7A14672}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{B0D57C34-96BA-4B3E-B795-407158E1AC0A}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{7638B9C5-8675-4EF4-88AB-CEE3EC7A95F5}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{AD295283-7A34-42B0-8279-3A66C420A1D9}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{6124F19C-1465-4430-A220-D6200989C37B}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{E5EEA0AE-B5FE-48C8-9529-4CF61BA2E3C6}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{FE52A2E8-3B8D-4E86-ABE8-08FD31F94707}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{9FC99164-FCF5-4981-B726-0ACD37FA6C19}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{E115D3DB-8CEA-49FE-8782-4B7FCEC1E00F}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [{58668C00-1FE6-4E90-A422-D1C50CFB59A1}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [TCP Query User{5DE1D668-E486-44CB-ABEE-CE03FDE43835}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [UDP Query User{E8F22B0B-D2A4-42EE-9970-7572AF76041D}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [TCP Query User{441653E0-09D4-4255-B889-0C095D9629E0}C:\program files\ibm\spss\statistics\22\stats.exe] => (Allow) C:\program files\ibm\spss\statistics\22\stats.exe
FirewallRules: [UDP Query User{E96ABC1B-CCDE-4227-8035-8BCAF1BB0B71}C:\program files\ibm\spss\statistics\22\stats.exe] => (Allow) C:\program files\ibm\spss\statistics\22\stats.exe
FirewallRules: [{BC6D5EAC-2B23-4351-9F4B-7D745288C668}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{478E6377-6B9D-4BFF-A95B-C350E388330B}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{593992C3-F247-460D-B2AC-A2D546F89B9B}] => (Allow) C:\Users\Sch_\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{145EEBA0-5E57-487F-9C77-4C3BC458977C}] => (Allow) C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{5E7F4C91-CC57-4891-8D2D-03791B99ECFE}C:\program files\microsoft office\office14\groove.exe] => (Block) C:\program files\microsoft office\office14\groove.exe
FirewallRules: [UDP Query User{D320306A-E334-40E4-B9B6-0487B1A48994}C:\program files\microsoft office\office14\groove.exe] => (Block) C:\program files\microsoft office\office14\groove.exe
FirewallRules: [{9C1843E9-C58C-43EA-B151-F5355B79CA6C}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro\Apowersoft Screen Recorder Pro.exe
FirewallRules: [{D8AD5A46-6223-4994-84A7-3ACC33B2D882}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro\Apowersoft Screen Recorder Pro.exe
FirewallRules: [{CD78455F-A95F-4A5C-9881-E13F258914B0}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\VideoEditor.exe
FirewallRules: [{4EE8DD7F-5E4E-4B7F-B941-4A36AC918538}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\VideoEditor.exe
FirewallRules: [{7C7FD931-1293-4EA8-9DEC-FE8E00C83690}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\Updater.exe
FirewallRules: [{F83B214C-D8FB-46E9-82E1-F7C11B3539EE}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\Updater.exe
FirewallRules: [{8EED3E8E-22F6-4351-9AC3-61774226AD38}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3E353B2C-4F01-41D3-97CA-E6755F4ABBAD}] => (Allow) LPort=2869
FirewallRules: [{981AC201-7A99-454B-BB59-58ACAE95A989}] => (Allow) LPort=1900
FirewallRules: [{9AC5B808-1CB2-4856-AEB5-400EDE36655B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{992EA5EF-FC4C-4C53-8814-9ED7D0C5F4FC}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe
FirewallRules: [{3F8DC095-1F92-46C0-B62B-82891C82E8ED}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe
FirewallRules: [{81F38556-5395-4EE1-AB88-FB3F6694C9AD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EDDF0EFE-3669-4174-9EB7-07779F1CAA8D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{555EBA7D-A3DA-4BC9-BFAB-C0DF5CBC38AE}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe
FirewallRules: [{0D2A86BA-2433-49F9-8A64-36F131C78D1B}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe
FirewallRules: [{FC82A0FF-96BF-4B79-AA65-D02FF388E73B}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{9CC77F6E-D172-40F6-9A58-B3FFBD2E47EB}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{08261FE2-45A6-427F-ADD4-160AC8C7A0AE}] => (Allow) C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{12C2F115-32E5-44BA-8F39-0B6218940ECE}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{CB8F560E-3C39-4A79-9456-CDEF7E056208}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/10/2015 00:17:41 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Error: (06/09/2015 02:57:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AcSvc.exe, Version: 5.9.7.95, Zeitstempel: 0x50487c7e
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18839, Zeitstempel: 0x553e8808
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00032711
ID des fehlerhaften Prozesses: 0x1098
Startzeit der fehlerhaften Anwendung: 0xAcSvc.exe0
Pfad der fehlerhaften Anwendung: AcSvc.exe1
Pfad des fehlerhaften Moduls: AcSvc.exe2
Berichtskennung: AcSvc.exe3

Error: (06/09/2015 08:13:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AcSvc.exe, Version: 5.9.7.95, Zeitstempel: 0x50487c7e
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18839, Zeitstempel: 0x553e8808
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0002e3fe
ID des fehlerhaften Prozesses: 0xb3c
Startzeit der fehlerhaften Anwendung: 0xAcSvc.exe0
Pfad der fehlerhaften Anwendung: AcSvc.exe1
Pfad des fehlerhaften Moduls: AcSvc.exe2
Berichtskennung: AcSvc.exe3

Error: (06/09/2015 07:42:56 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Error: (06/08/2015 00:00:30 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Error: (06/08/2015 11:36:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AcSvc.exe, Version: 5.9.7.95, Zeitstempel: 0x50487c7e
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18839, Zeitstempel: 0x553e8808
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00032711
ID des fehlerhaften Prozesses: 0xd54
Startzeit der fehlerhaften Anwendung: 0xAcSvc.exe0
Pfad der fehlerhaften Anwendung: AcSvc.exe1
Pfad des fehlerhaften Moduls: AcSvc.exe2
Berichtskennung: AcSvc.exe3

Error: (06/07/2015 10:57:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: AcSvc.exe, Version: 5.9.7.95, Zeitstempel: 0x50487c7e
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18839, Zeitstempel: 0x553e8808
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00032711
ID des fehlerhaften Prozesses: 0xd50
Startzeit der fehlerhaften Anwendung: 0xAcSvc.exe0
Pfad der fehlerhaften Anwendung: AcSvc.exe1
Pfad des fehlerhaften Moduls: AcSvc.exe2
Berichtskennung: AcSvc.exe3

Error: (06/06/2015 11:54:17 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Error: (06/06/2015 07:42:55 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.

Error: (06/05/2015 01:08:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifest.


System errors:
=============
Error: (06/10/2015 09:16:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/10/2015 09:16:32 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/09/2015 09:38:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/09/2015 09:38:30 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/09/2015 09:33:36 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎09.‎06.‎2015 um 21:32:27 unerwartet heruntergefahren.

Error: (06/09/2015 09:32:24 PM) (Source: Microsoft-Windows-Kernel-Power) (EventID: 86) (User: NT-AUTORITÄT)
Description: Das System wurde aufgrund eines kritischen thermischen Ereignisses heruntergefahren.
           
Zeit für das Herunterfahren = 2015-06-09T19:32:24.325783200Z
           
ACPI-Thermozone = ACPI\ThermalZone\THM0
           
_CRT = 373K

Error: (06/09/2015 09:29:27 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎09.‎06.‎2015 um 21:27:48 unerwartet heruntergefahren.

Error: (06/09/2015 02:58:04 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "AcSvc" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/09/2015 02:47:30 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/09/2015 02:47:30 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).


Microsoft Office:
=========================
Error: (06/10/2015 00:17:41 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (06/09/2015 02:57:57 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: AcSvc.exe5.9.7.9550487c7entdll.dll6.1.7601.18839553e8808c000000500032711109801d0a2b2081e86c9C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exeC:\Windows\SysWOW64\ntdll.dll26022230-0ea7-11e5-ad0b-00059a3c7800

Error: (06/09/2015 08:13:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: AcSvc.exe5.9.7.9550487c7entdll.dll6.1.7601.18839553e8808c00000050002e3feb3c01d0a273afe73f55C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exeC:\Windows\SysWOW64\ntdll.dlla0e026f3-0e6e-11e5-83fd-f0def15a0d0a

Error: (06/09/2015 07:42:56 AM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (06/08/2015 00:00:30 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (06/08/2015 11:36:42 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: AcSvc.exe5.9.7.9550487c7entdll.dll6.1.7601.18839553e8808c000000500032711d5401d0a1b40628ae92C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exeC:\Windows\SysWOW64\ntdll.dllde3e31e9-0dc1-11e5-a9ee-f0def15a0d0a

Error: (06/07/2015 10:57:50 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: AcSvc.exe5.9.7.9550487c7entdll.dll6.1.7601.18839553e8808c000000500032711d5001d0a0fdac370d82C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exeC:\Windows\SysWOW64\ntdll.dll460bf98e-0cf3-11e5-a3dd-f0def15a0d0a

Error: (06/06/2015 11:54:17 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (06/06/2015 07:42:55 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe

Error: (06/05/2015 01:08:53 PM) (Source: SideBySide) (EventID: 80) (User: )
Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_41e554362bd82458.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18807_none_fa381d5f175bfb52.manifestC:\Program Files (x86)\LG Electronics\LG PC Suite\LGPCSuite.exe


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5 CPU M 480 @ 2.67GHz
Percentage of memory in use: 36%
Total physical RAM: 7987.67 MB
Available physical RAM: 5081.71 MB
Total Pagefile: 15973.55 MB
Available Pagefile: 12665.17 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:193.08 GB) (Free:46.35 GB) NTFS
Drive d: () (Fixed) (Total:94.07 GB) (Free:49.26 GB) NTFS
Drive e: (Lenovo_Recovery) (Fixed) (Total:9.77 GB) (Free:1.25 GB) NTFS

==================== MBR & Partition Table ==================

==================== End of log ============================

--- --- ---

volkyleo 10.06.2015 10:58

Code:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-10 09:57:55
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEKT-08PVMT1 rev.02.01A02 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\SCH_BU~1\AppData\Local\Temp\pfkiaaod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\kernel32.dll!RegSetValueExW                                    000000007725a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                  0000000077263f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                  000000007727ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                            000000007728f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                          00000000772b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                          00000000772c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\kernel32.dll!RegSetValueExA                                    00000000772e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                  000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                    000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                              000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                              000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                            000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\ole32.dll!CoCreateInstance                                    000007fefd807490 11 bytes JMP 000007fffd180228
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1620] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                    000007fefd81bf00 7 bytes JMP 000007fffd180260
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                    00000000754a1401 2 bytes JMP 752cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                      00000000754a1419 2 bytes JMP 752cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                    00000000754a1431 2 bytes JMP 75348f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                    00000000754a144a 2 bytes CALL 752a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                      00000000754a14dd 2 bytes JMP 75348822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                00000000754a14f5 2 bytes JMP 753489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                      00000000754a150d 2 bytes JMP 75348718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                00000000754a1525 2 bytes JMP 75348ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                      00000000754a153d 2 bytes JMP 752bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                          00000000754a1555 2 bytes JMP 752c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                    00000000754a156d 2 bytes JMP 75348fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                      00000000754a1585 2 bytes JMP 75348b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                        00000000754a159d 2 bytes JMP 753486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                      00000000754a15b5 2 bytes JMP 752bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                    00000000754a15cd 2 bytes JMP 752cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                00000000754a16b2 2 bytes JMP 75348ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1072] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                00000000754a16bd 2 bytes JMP 75348671 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[1224] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                  000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[1224] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                    000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[1224] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                        000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[1224] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[1224] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                  000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[1224] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                          00000000754a1401 2 bytes JMP 752cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                            00000000754a1419 2 bytes JMP 752cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                          00000000754a1431 2 bytes JMP 75348f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                          00000000754a144a 2 bytes CALL 752a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                              00000000754a14dd 2 bytes JMP 75348822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                      00000000754a14f5 2 bytes JMP 753489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                              00000000754a150d 2 bytes JMP 75348718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                      00000000754a1525 2 bytes JMP 75348ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                            00000000754a153d 2 bytes JMP 752bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                  00000000754a1555 2 bytes JMP 752c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                          00000000754a156d 2 bytes JMP 75348fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                            00000000754a1585 2 bytes JMP 75348b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                00000000754a159d 2 bytes JMP 753486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                            00000000754a15b5 2 bytes JMP 752bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                          00000000754a15cd 2 bytes JMP 752cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                      00000000754a16b2 2 bytes JMP 75348ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[1552] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                      00000000754a16bd 2 bytes JMP 75348671 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3752] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3752] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                  000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3752] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                    000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3752] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                              000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3752] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                              000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3752] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                            000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                              00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                        0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                        0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                          0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                            00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                          00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                              00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                  00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                  0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                              0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                              000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                        00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                      0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                          0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                            0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2136] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                                              0000000075e89d0f 1 byte [F1]
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[3968] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                  000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[3968] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                    000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[3968] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                      000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[3968] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[3968] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[3968] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                              000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                  000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                            000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                          000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                  000007fef247dc88 5 bytes JMP 000007fff22700d8
.text  C:\Windows\system32\Dwm.exe[4020] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                000007fef247de10 5 bytes JMP 000007fff2270110
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                  00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                        0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                        0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                          0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                  00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                  0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                              0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                              000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                          00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                        0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                          0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                            0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                  0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[4136] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                                              0000000075e89d0f 1 byte [F1]
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                  00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                    00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                    00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                  00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                          0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                          0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                            0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                              00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                  00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                    0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                            00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                          0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                            0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                              0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                    0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                    0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[4180] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                                                0000000075e89d0f 1 byte [F1]
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                              00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                              00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                      0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                      0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                        0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                            00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                          00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                              00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                            0000000075624572 5 bytes JMP 0000000167743810
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                            000000007563e567 5 bytes JMP 0000000167743880
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                        00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                      0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                        0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                          0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[4488] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                                            0000000075e89d0f 1 byte [F1]
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                            000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                    000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\ole32.dll!CoCreateInstance                                                            000007fefd807490 11 bytes JMP 000007fffd180228
.text  C:\Windows\System32\igfxpers.exe[4664] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                            000007fefd81bf00 7 bytes JMP 000007fffd180260
.text  C:\Windows\System32\TpShocks.exe[4680] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Windows\System32\TpShocks.exe[4680] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Windows\System32\TpShocks.exe[4680] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                            000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Windows\System32\TpShocks.exe[4680] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Windows\System32\TpShocks.exe[4680] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Windows\System32\TpShocks.exe[4680] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                    000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                              00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                        0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                        0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                          0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                            00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                          00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                              00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                  00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                          0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                            0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                  0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                              0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                              000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                        00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                      0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                  0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[4704] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                              0000000075e89d0f 1 byte [F1]
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\kernel32.dll!RegSetValueExW                                              000000007725a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                            0000000077263f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                              000000007727ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                        000000007728f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                      00000000772b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                      00000000772c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\kernel32.dll!RegSetValueExA                                              00000000772e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                          000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                            000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                        000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                          000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                        000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\ole32.dll!CoCreateInstance                                                000007fefd807490 11 bytes JMP 000007fffd180228
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[4828] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                              000007fefd81bf00 7 bytes JMP 000007fffd180260
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                      00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                        00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                        00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                        00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                  0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                    00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                  00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                      00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                          00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\USER32.dll!CreateWindowExW                          0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                      0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                      000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo              0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                  0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                    0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                        0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\ole32.dll!CoCreateInstance                          0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                      0000000075e89d0f 1 byte [F1]
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                00000000754a1401 2 bytes JMP 752cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                  00000000754a1419 2 bytes JMP 752cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                00000000754a1431 2 bytes JMP 75348f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                00000000754a144a 2 bytes CALL 752a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                    00000000754a14dd 2 bytes JMP 75348822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17            00000000754a14f5 2 bytes JMP 753489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                    00000000754a150d 2 bytes JMP 75348718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17            00000000754a1525 2 bytes JMP 75348ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                  00000000754a153d 2 bytes JMP 752bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                        00000000754a1555 2 bytes JMP 752c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                00000000754a156d 2 bytes JMP 75348fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                  00000000754a1585 2 bytes JMP 75348b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                      00000000754a159d 2 bytes JMP 753486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                  00000000754a15b5 2 bytes JMP 752bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                00000000754a15cd 2 bytes JMP 752cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20            00000000754a16b2 2 bytes JMP 75348ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[5036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31            00000000754a16bd 2 bytes JMP 75348671 C:\Windows\syswow64\kernel32.dll
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                              00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                              00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                      0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                      0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                        0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                            00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                          00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                              00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                            0000000075624572 5 bytes JMP 0000000167743810
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                            000000007563e567 5 bytes JMP 0000000167743880
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                        00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                      0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                        0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                          0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[5048] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                                            0000000075e89d0f 1 byte [F1]
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\kernel32.dll!RegSetValueExW                                      000000007725a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                    0000000077263f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                      000000007727ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                000000007728f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                              00000000772b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                              00000000772c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\kernel32.dll!RegSetValueExA                                      00000000772e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                  000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                    000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                        000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                  000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\ole32.dll!CoCreateInstance                                        000007fefd807490 11 bytes JMP 000007fffd180228
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[832] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                      000007fefd81bf00 7 bytes JMP 000007fffd180260
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                          000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                            000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                        000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                          000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                        000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\ole32.dll!CoCreateInstance                                                000007fefd807490 11 bytes JMP 000007fffd180228
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[1252] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                              000007fefd81bf00 7 bytes JMP 000007fffd180260
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1580] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                        000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1580] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                          000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1580] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                            000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1580] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                      000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1580] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                      000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1580] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                    000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\kernel32.dll!RegSetValueExW                                    000000007725a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                  0000000077263f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                    000000007727ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                              000000007728f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                            00000000772b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                            00000000772c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\kernel32.dll!RegSetValueExA                                    00000000772e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                  000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                      000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                              000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[4368] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                              000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[472] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                        000007fefd193460 7 bytes JMP 000007fffd1800d8
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[472] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                          000007fefd1aa590 6 bytes JMP 000007fffd180148
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[472] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                              000007fefd1aac00 5 bytes JMP 000007fffd180180
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[472] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                      000007fefd1aada0 5 bytes JMP 000007fffd180110
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[472] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                        000007fefef689e0 8 bytes JMP 000007fffd1801f0
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[472] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                      000007fefef6be40 8 bytes JMP 000007fffd1801b8
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                            00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                              00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                              00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                              00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                      0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                      0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                        0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                          00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                        00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                            00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                            0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                            000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                      00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                    0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                              0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[920] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                            0000000075e89d0f 1 byte [F1]
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                      00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                        00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                        00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                      00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                              0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                              0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                    00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                  00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                      00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                        00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                        0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                    0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                    000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                              0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                  0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                        0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                        0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[4652] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                                    0000000075e89d0f 1 byte [F1]
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                              00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                              00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                      0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                      0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                        0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                            00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                          00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                              00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\user32.DLL!CreateWindowExW                                0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\user32.DLL!EnumDisplayDevicesA                            0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\user32.DLL!EnumDisplayDevicesW                            000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\user32.DLL!ChangeDisplaySettingsExW                        00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\user32.DLL!DisplayConfigGetDeviceInfo                      0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                        0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                          0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe[708] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                            0000000075e89d0f 1 byte [F1]
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                          00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                            00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                            00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                          00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                  0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                  0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                    0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                        00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                      00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                          00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                            00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                            0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\ole32.dll!CoCreateInstance                            0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                        0000000075e89d0f 1 byte [F1]
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                    0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                      0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\USER32.dll!CreateWindowExW                            0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                        0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                        000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                    00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[4960] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                  0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW                                00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW                                  00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                  00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW                                00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                        0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                        0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                          0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                              00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                            00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5512] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                  00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                  00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                  00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                          0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                          0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                            0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                    0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                0000000075624572 5 bytes JMP 0000000167743810
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                000000007563e567 5 bytes JMP 0000000167743880
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                          00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                        0000000075677a5c 5 bytes JMP 0000000167743800
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                            0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                              0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                  0000000075e55ea5 5 bytes JMP 0000000167743320
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                    0000000075e89d0b 3 bytes JMP 00000001677432b0
.text  C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[5728] C:\Windows\syswow64\ole32.dll!CoCreateInstance + 4                                                0000000075e89d0f 1 byte [F1]
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                    00000000754a1401 2 bytes JMP 752cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                      00000000754a1419 2 bytes JMP 752cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                    00000000754a1431 2 bytes JMP 75348f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                    00000000754a144a 2 bytes CALL 752a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                        00000000754a14dd 2 bytes JMP 75348822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                00000000754a14f5 2 bytes JMP 753489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                        00000000754a150d 2 bytes JMP 75348718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                00000000754a1525 2 bytes JMP 75348ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                      00000000754a153d 2 bytes JMP 752bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                            00000000754a1555 2 bytes JMP 752c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                    00000000754a156d 2 bytes JMP 75348fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                      00000000754a1585 2 bytes JMP 75348b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                          00000000754a159d 2 bytes JMP 753486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                      00000000754a15b5 2 bytes JMP 752bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                    00000000754a15cd 2 bytes JMP 752cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                00000000754a16b2 2 bytes JMP 75348ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[5844] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                00000000754a16bd 2 bytes JMP 75348671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000754a1401 2 bytes JMP 752cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000754a1419 2 bytes JMP 752cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000754a1431 2 bytes JMP 75348f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000754a144a 2 bytes CALL 752a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17        00000000754a14dd 2 bytes JMP 75348822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000754a14f5 2 bytes JMP 753489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17        00000000754a150d 2 bytes JMP 75348718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000754a1525 2 bytes JMP 75348ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000754a153d 2 bytes JMP 752bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17            00000000754a1555 2 bytes JMP 752c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000754a156d 2 bytes JMP 75348fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000754a1585 2 bytes JMP 75348b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17          00000000754a159d 2 bytes JMP 753486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000754a15b5 2 bytes JMP 752bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000754a15cd 2 bytes JMP 752cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000754a16b2 2 bytes JMP 75348ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4896] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000754a16bd 2 bytes JMP 75348671 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                00000000752a1efe 7 bytes JMP 0000000167743dd0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                  00000000752a5b9d 7 bytes JMP 00000001677440e0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  00000000752b13f9 7 bytes JMP 0000000167743f10
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                  00000000752bea45 7 bytes JMP 0000000167743dc0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                          0000000075348ea4 7 bytes JMP 0000000167743b50
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                          0000000075348f29 5 bytes JMP 0000000167743c00
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                            0000000075349281 5 bytes JMP 0000000167743b60
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              00000000755c1d29 5 bytes JMP 0000000167743b00
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            00000000755c1dd7 5 bytes JMP 0000000167743ab0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                00000000755c2ab1 5 bytes JMP 0000000167743c10
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    00000000755c2d17 5 bytes JMP 0000000167743890
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                            0000000075b0e96b 5 bytes JMP 00000001677433e0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                              0000000075b0eba5 5 bytes JMP 00000001677433f0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                    0000000075618a29 5 bytes JMP 0000000167743370
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                0000000075624572 5 bytes JMP 0000000167743810
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                000000007563e567 5 bytes JMP 0000000167743880
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                          00000000756607d7 5 bytes JMP 0000000167743280
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4964] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                        0000000075677a5c 5 bytes JMP 0000000167743800

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af7c9255                                                                     
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af7c9255 (not active ControlSet)                                                 

---- EOF - GMER 2.1 ----


Warlord711 10.06.2015 11:01

Führe sämtliche Tools mit administrativen Rechten aus, Vista, Win7,Win8 User mit Rechtsklick "als Administrator starten".

Bitte neue FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken

http://saved.im/mtg0mjy4yjlu/2014-04...ryscantool.png

volkyleo 10.06.2015 16:04

Hi, hier nochmal alle Logfiles ausgeführt als Admin.

Code:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:51 on 10/06/2015 (Sch_)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015
Ran by Sch_ (administrator) on SCH_-PC on 10-06-2015 16:52:40
Running from C:\Users\Schneider\Desktop
Loaded Profiles: Sch_ & Schneider (Available Profiles: Sch_ & UpdatusUser & Schneider)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Dell Inc.) C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(QUALCOMM, Inc.) C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Dell Inc.) C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Dominik Reichl) C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-15] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [228744 2012-09-20] (Lenovo.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [60920 2013-05-29] (Lenovo Group Limited)
HKLM\...\Run: [DLPSP] => C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE [421016 2007-07-25] (Dell Inc.)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916592 2014-07-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111928 2013-05-03] (Intel Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2015-04-30] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [130864 2015-05-21] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [Mobile Partner] => C:\Program Files (x86)\MobileWiFi\MobileWiFi
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\RunOnce: [DeleteMarkAny] => C:\Windows\SysWOW64\MASetupCleaner.exe [24576 2013-02-05] ((주)마크애니)
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\RunOnce: [Report] => \AdwCleaner\AdwCleaner[S0].txt [7521 2014-09-16] ()
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [SimpleSYN.NET] => C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe [2562352 2015-03-28] (creativbox.net, Torsten Leithold & Georg von Kries GbR)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911032 2015-03-18] (Microsoft Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [OneDrive] => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-26] (Microsoft Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5849.0427\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5849.0427\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {1b0dc35a-0670-11e4-81aa-f0def15a0d0a} - G:\LG_PC_Programs.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {22791074-b1f6-11e4-8767-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4911ad02-b367-11e4-bf67-f0def15a0d0a} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4c47e6e6-b358-11e4-8ba9-806e6f6e6963} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4c47e717-b358-11e4-8ba9-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {ac36bd99-61a7-11e3-ad0d-cc52af7c9255} - F:\DTLplus_Launcher.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {fb634da8-b69c-11e4-84e7-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
AppInit_DLLs: C:\Users\Sch_\AppData\Local\Smartbar\Application\Resources\crdlil64.dll => C:\Users\Sch_\AppData\Local\Smartbar\Application\Resources\crdlil64.dll File not found
AppInit_DLLs: ,C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [167312 2015-02-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [147576 2015-02-25] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli ACGina
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2013-01-15]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2013-11-14]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
GroupPolicyUsers\S-1-5-21-3128309724-421563842-2291253580-1002\User: Group Policy Restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3128309724-421563842-2291253580-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3128309724-421563842-2291253580-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-16] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-16] (Oracle Corporation)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-3128309724-421563842-2291253580-1002 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {8FEFF364-6A5F-4966-A917-A3AC28411659} hxxp://download.easetuner.com/download/SOPCORE.CAB
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Sch_\AppData\Roaming\Mozilla\Firefox\Profiles\ckb2i04g.default-1386154641997
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_169.dll [2015-04-26] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-16] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-16] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-02-15] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2013-03-21] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-26] ()
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-02-15] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-27] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2013-03-21] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-16]
FF HKU\.DEFAULT\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12
FF Extension: ThinkVantage Password Manager - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12 [2015-06-10]
FF HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12

Chrome:
=======
CHR HomePage: Default ->
CHR StartupUrls: Default -> "hxxp://www.google.com"
CHR Profile: C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-04]
CHR Extension: (Google Drive) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-04]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-15]
CHR Extension: (YouTube) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-04]
CHR Extension: (Google Search) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-04]
CHR Extension: (Google Wallet) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-04]
CHR Extension: (Gmail) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-04]
CHR HKU\S-1-5-21-3128309724-421563842-2291253580-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\SCHNEI~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-08-14]
CHR HKU\S-1-5-21-3128309724-421563842-2291253580-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lpdfbkehegfmedglgemnhbnpmfmioggj] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [208632 2015-05-21] (Avira Operations GmbH & Co. KG)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-05] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-05] (Dropbox, Inc.)
R2 DLPWD; C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE [107928 2006-12-07] (Dell Inc.)
R2 DLSDB; C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE [191896 2006-12-07] (Dell Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [319536 2015-04-17] (Lenovo.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-02-06] ()
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [619776 2015-01-15] (Lenovo)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239184 2014-02-15] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 QDLService2kLenovo; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe [1688384 2011-05-23] (QUALCOMM, Inc.)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [49136 2015-05-15] ()
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2013-04-18] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2013-06-28] (LG Electronics Inc.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 qcfilterlno2k; C:\Windows\System32\DRIVERS\qcfilterlno2k.sys [6400 2011-05-23] (QUALCOMM Incorporated)
R3 qcusbnetlno2k; C:\Windows\System32\DRIVERS\qcusbnetlno2k.sys [444416 2011-05-23] (QUALCOMM Incorporated)
R3 qcusbserlno2k; C:\Windows\System32\DRIVERS\qcusbserlno2k.sys [231040 2011-05-23] (QUALCOMM Incorporated)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2014-07-28] (Synaptics Incorporated)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-10 16:52 - 2015-06-10 16:53 - 00032880 _____ C:\Users\Schneider\Desktop\FRST.txt
2015-06-10 16:51 - 2015-06-10 16:51 - 00000486 _____ C:\Users\Schneider\Desktop\defogger_disable.log
2015-06-10 16:43 - 2015-06-10 16:43 - 00000746 _____ C:\Windows\PFRO.log
2015-06-10 16:04 - 2011-01-14 08:23 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\umpo.dll
2015-06-10 16:00 - 2015-06-10 16:01 - 00011710 _____ C:\Windows\DPINST.LOG
2015-06-10 16:00 - 2015-06-10 16:01 - 00001464 _____ C:\Windows\Synaptics.log
2015-06-10 16:00 - 2015-06-10 16:00 - 00001577 _____ C:\Windows\Delfg.cmd
2015-06-10 16:00 - 2015-06-10 16:00 - 00000146 _____ C:\Windows\launchpw.cmd
2015-06-10 16:00 - 2015-06-10 16:00 - 00000006 _____ C:\Windows\systemtype.txt
2015-06-10 16:00 - 2014-07-28 12:25 - 00536304 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00461552 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2015-06-10 16:00 - 2014-07-28 12:25 - 00224496 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00173808 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo14.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00114416 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00045296 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel.sys
2015-06-10 16:00 - 2014-05-16 14:56 - 04456520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc110u.dll
2015-06-10 16:00 - 2014-05-16 14:56 - 04423680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc110.dll
2015-06-10 16:00 - 2014-05-16 14:56 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110u.dll
2015-06-10 16:00 - 2014-05-16 14:56 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110.dll
2015-06-10 15:59 - 2015-06-10 16:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage
2015-06-10 15:57 - 2015-06-10 15:57 - 00003020 _____ C:\Windows\System32\Tasks\PMTask
2015-06-10 15:54 - 2015-06-10 15:54 - 00002057 _____ C:\Users\Public\Desktop\REACHit.lnk
2015-06-10 15:54 - 2015-06-10 15:54 - 00001673 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\REACHit Drive.lnk
2015-06-10 15:54 - 2015-06-10 15:54 - 00001673 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\REACHit Drive.lnk
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Windows\SysWOW64\REACHit
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\Lenovo
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\Downloaded Installations
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\Lenovo
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\Downloaded Installations
2015-06-10 15:53 - 2015-06-10 15:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2015-06-10 15:53 - 2015-06-10 15:53 - 00001053 _____ C:\Users\Public\Desktop\SHAREit.lnk
2015-06-10 15:46 - 2015-06-10 15:46 - 00000000 ____D C:\Users\Schneider\AppData\Local\Tvsukernel
2015-06-10 15:32 - 2015-06-10 15:32 - 12471264 _____ ( ) C:\Users\Schneider\Downloads\systemupdate506-05-15-2015.exe
2015-06-10 14:45 - 2015-06-10 14:45 - 00004274 _____ C:\Users\Schneider\Downloads\Kontoumsatz_vom_10062015.csv
2015-06-10 14:02 - 2015-06-10 14:02 - 00000000 ____D C:\Users\Sch_\AppData\Local\GWX
2015-06-10 10:59 - 2015-06-10 10:59 - 878437825 _____ C:\Windows\MEMORY.DMP
2015-06-10 10:59 - 2015-06-10 10:59 - 00265144 _____ C:\Windows\Minidump\061015-19765-01.dmp
2015-06-10 10:45 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 10:45 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 10:45 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 10:45 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 10:45 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 10:45 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 10:45 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 10:45 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 10:45 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 10:45 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 10:45 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 10:45 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 10:45 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 10:40 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 10:40 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 10:40 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 10:40 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 10:40 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 10:40 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 10:40 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 10:40 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 10:40 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 10:40 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 10:40 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 10:40 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 10:40 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 10:40 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 10:40 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 10:40 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 10:40 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 10:40 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 10:39 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 10:39 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 10:34 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 10:33 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 10:33 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 10:33 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 10:33 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 10:33 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 10:33 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 10:33 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 10:33 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 10:33 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 10:33 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 10:33 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 10:33 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 10:33 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 10:33 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 10:33 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 10:33 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 10:33 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 10:33 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 10:33 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 10:33 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 10:33 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 10:33 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 10:33 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 10:33 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 10:33 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 10:33 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 10:33 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 10:33 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 10:33 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 10:33 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 10:33 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 10:33 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 10:33 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 10:33 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 10:33 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 10:33 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 10:33 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 10:33 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 10:33 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 10:33 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 10:33 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 10:33 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 10:33 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 10:33 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 10:33 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 10:33 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 10:33 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 10:33 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 10:33 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 10:33 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 10:33 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 10:33 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 10:33 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 10:33 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 10:33 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 10:33 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 10:33 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 10:33 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 10:33 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 10:33 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 10:09 - 2015-06-10 10:18 - 00084290 _____ C:\Users\Schneider\Desktop\Avira_Ereignisse.txt
2015-06-10 09:37 - 2015-06-10 09:37 - 00380416 _____ C:\Users\Schneider\Downloads\Gmer-19357.exe
2015-06-10 09:37 - 2015-06-10 09:37 - 00380416 _____ C:\Users\Schneider\Desktop\Gmer-19357.exe
2015-06-10 09:34 - 2015-06-10 16:52 - 00000000 ____D C:\FRST
2015-06-10 09:33 - 2015-06-10 09:33 - 02108928 _____ (Farbar) C:\Users\Schneider\Downloads\FRST64.exe
2015-06-10 09:33 - 2015-06-10 09:33 - 02108928 _____ (Farbar) C:\Users\Schneider\Desktop\FRST64.exe
2015-06-10 09:33 - 2015-06-10 09:33 - 00000000 _____ C:\Users\Sch_\defogger_reenable
2015-06-10 09:32 - 2015-06-10 09:32 - 00050477 _____ C:\Users\Schneider\Downloads\Defogger.exe
2015-06-10 09:32 - 2015-06-10 09:32 - 00050477 _____ C:\Users\Schneider\Desktop\Defogger.exe
2015-06-10 09:21 - 2015-06-10 09:21 - 00059121 _____ C:\Users\Schneider\Desktop\Regression.xlsx
2015-06-10 07:27 - 2015-06-10 07:27 - 00074326 _____ C:\Users\Schneider\Desktop\Avira.txt
2015-06-09 15:02 - 2015-06-09 15:03 - 40301384 _____ C:\Users\Schneider\Downloads\Firefox Setup 38.0.6.exe
2015-06-09 15:01 - 2015-06-09 21:23 - 02678968 _____ C:\Users\Schneider\Desktop\Akquise .xlsx
2015-06-09 14:47 - 2015-06-09 14:47 - 18054744 _____ (Adobe Systems Inc.) C:\Users\Schneider\Downloads\AdobeAIRInstaller.exe
2015-06-09 13:17 - 2015-06-09 13:17 - 00025998 _____ C:\Users\Schneider\Downloads\FirmenadressenBSP.xlsx
2015-06-08 22:43 - 2015-06-08 22:44 - 01330371 _____ C:\Users\Schneider\Downloads\LA Open 2015.zip
2015-06-06 20:22 - 2015-06-06 20:22 - 00000000 ____D C:\Users\Schneider\AppData\Local\GWX
2015-06-05 23:00 - 2015-06-05 23:00 - 82771853 _____ C:\Users\Schneider\Downloads\nice slow cock massage - Pornhubcom.mp4.crdownload
2015-06-05 19:14 - 2015-06-05 19:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-06-05 19:13 - 2015-06-10 16:44 - 00001222 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2015-06-05 19:13 - 2015-06-10 16:18 - 00001226 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2015-06-05 19:13 - 2015-06-05 19:15 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-06-05 19:13 - 2015-06-05 19:13 - 00004222 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineUA
2015-06-05 19:13 - 2015-06-05 19:13 - 00003970 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineCore
2015-06-05 19:13 - 2015-06-05 19:13 - 00000000 ____D C:\Users\Schneider\AppData\Local\Dropbox
2015-06-05 19:13 - 2015-06-05 19:13 - 00000000 ____D C:\ProgramData\Dropbox
2015-06-05 14:15 - 2015-06-09 15:04 - 00001153 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-06-05 14:12 - 2015-06-05 14:15 - 51306608 _____ (Dropbox, Inc.) C:\Users\Schneider\Downloads\Dropbox 3.6.5.exe
2015-06-05 14:05 - 2015-06-05 14:05 - 00002032 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2015-06-05 12:08 - 2015-06-09 12:50 - 00011824 _____ C:\Users\Schneider\Desktop\CRM Entscheidungsmatrix.xlsx
2015-06-04 22:38 - 2015-06-04 22:38 - 16429971 _____ C:\Users\Schneider\Downloads\_exchange_picture_170372.zip
2015-06-04 19:45 - 2015-06-04 19:45 - 00000000 ____D C:\Users\Schneider\Desktop\NPS
2015-06-03 17:59 - 2015-06-03 17:59 - 00989511 _____ C:\Users\Schneider\Desktop\Präsentation1.pptx
2015-06-03 14:15 - 2015-06-03 14:15 - 00023552 _____ C:\Users\Schneider\Downloads\LISRELTrialData.xls
2015-06-03 14:09 - 2015-06-03 14:09 - 00002651 _____ C:\Users\Public\Desktop\LISREL 9.2 Student.lnk
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSI, Inc
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\Program Files (x86)\LISREL9S
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\LISREL9 Student Examples
2015-06-03 14:07 - 2015-06-04 19:44 - 00000000 ____D C:\Users\Schneider\Desktop\Strukturgleichungsmodell
2015-06-02 15:07 - 2015-06-04 19:45 - 00000000 ____D C:\Users\Schneider\Desktop\IHK
2015-05-29 13:54 - 2015-06-03 10:12 - 00917243 _____ C:\Users\Schneider\Desktop\Alte_Prognosemodelle.pptx
2015-05-29 13:07 - 2015-06-05 19:13 - 00000000 ____D C:\Users\Sch_\AppData\Local\Dropbox
2015-05-29 13:04 - 2015-05-29 13:05 - 51079592 _____ (Dropbox, Inc.) C:\Users\Schneider\Downloads\Dropbox 3.6.4.exe
2015-05-28 13:24 - 2015-05-28 14:31 - 17791197 _____ C:\Users\Schneider\Downloads\PM Benchmarking v.11_aktuell.pptx
2015-05-27 12:14 - 2015-05-27 17:32 - 00039464 _____ C:\Users\Schneider\Downloads\Kontoumsatz_vom_27052015.xlsx
2015-05-27 00:17 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-05-13 14:48 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 14:48 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 11:41 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 11:41 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 11:40 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 11:40 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 11:40 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 11:40 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 11:39 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 11:39 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 11:39 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 11:39 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 11:39 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 11:39 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 11:39 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 11:39 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 11:39 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 11:39 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 11:39 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-13 11:31 - 2015-05-13 11:31 - 00000000 ____D C:\Users\Schneider\AppData\Local\NVIDIA
2015-05-13 11:30 - 2015-05-13 11:30 - 00000000 ____D C:\Windows\SysWOW64\NV
2015-05-13 11:30 - 2015-05-13 11:30 - 00000000 ____D C:\Windows\system32\NV
2015-05-13 11:24 - 2015-02-04 02:00 - 00608072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-05-13 11:19 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-13 11:19 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-13 11:19 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-13 11:19 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-12 07:27 - 2015-05-12 07:27 - 00102376 _____ (Lenovo.) C:\Windows\system32\ibmpmsvc.exe
2015-05-12 07:27 - 2015-05-12 07:27 - 00074728 _____ (Lenovo.) C:\Windows\system32\ibmpmctl.exe
2015-05-12 07:27 - 2015-05-12 07:27 - 00063464 _____ (Lenovo.) C:\Windows\system32\Drivers\ibmpmdrv.sys
2015-05-12 07:27 - 2015-05-12 07:27 - 00042472 _____ (Lenovo.) C:\Windows\system32\tpinspm.dll
2015-05-11 15:43 - 2015-05-11 16:10 - 00000000 ____D C:\Users\Schneider\Desktop\diupp

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-10 16:51 - 2013-01-15 16:12 - 01330465 _____ C:\Windows\WindowsUpdate.log
2015-06-10 16:48 - 2013-01-15 23:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-10 16:47 - 2013-01-17 17:09 - 00000000 ____D C:\Users\Schneider\Documents\Outlook-Dateien
2015-06-10 16:44 - 2013-01-15 23:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-10 16:44 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-10 16:43 - 2015-04-24 12:15 - 00005864 _____ C:\Windows\setupact.log
2015-06-10 16:43 - 2013-12-15 16:45 - 00000000 ____D C:\ProgramData\Avira
2015-06-10 16:43 - 2013-01-15 16:25 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-10 16:37 - 2013-12-15 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-10 16:37 - 2013-12-15 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2015-06-10 16:37 - 2013-10-09 11:12 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-10 16:31 - 2009-07-14 06:45 - 00026672 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-10 16:31 - 2009-07-14 06:45 - 00026672 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-10 16:00 - 2013-01-15 18:35 - 00000000 ___HD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2015-06-10 16:00 - 2013-01-15 18:35 - 00000000 ____D C:\ProgramData\Lenovo
2015-06-10 16:00 - 2013-01-15 16:21 - 00000000 ____D C:\Program Files (x86)\Lenovo
2015-06-10 16:00 - 2013-01-15 16:15 - 00000000 ____D C:\Program Files\Lenovo
2015-06-10 16:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Help
2015-06-10 15:59 - 2013-01-15 16:36 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2015-06-10 15:59 - 2013-01-15 16:35 - 00000000 ____D C:\Windows\Downloaded Installations
2015-06-10 15:57 - 2009-07-14 05:20 - 00000000 __RSD C:\Windows\Media
2015-06-10 15:54 - 2015-04-26 19:47 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-10 15:54 - 2013-01-15 20:23 - 00000000 ____D C:\Users\Schneider\AppData\Local\Lenovo
2015-06-10 15:42 - 2013-03-05 10:28 - 00111008 _____ C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT
2015-06-10 15:37 - 2013-08-16 16:13 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\KeePass
2015-06-10 15:34 - 2013-01-15 18:38 - 00000000 ____D C:\Windows\System32\Tasks\TVT
2015-06-10 15:24 - 2014-12-05 00:27 - 00000000 ____D C:\Users\Schneider\Desktop\Desktop_Stuff
2015-06-10 13:46 - 2013-08-16 16:13 - 00046286 _____ C:\Users\Schneider\Desktop\volky.kdbx
2015-06-10 13:36 - 2009-07-14 12:57 - 00699682 _____ C:\Windows\system32\perfh007.dat
2015-06-10 13:36 - 2009-07-14 12:57 - 00149790 _____ C:\Windows\system32\perfc007.dat
2015-06-10 13:36 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-10 13:36 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-10 13:30 - 2009-07-14 06:45 - 00427992 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-10 13:28 - 2014-12-10 12:09 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-10 13:28 - 2014-05-06 17:18 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-10 13:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-10 12:12 - 2013-01-16 00:23 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-10 12:09 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini
2015-06-10 12:08 - 2013-08-11 17:49 - 00000000 ____D C:\Windows\system32\MRT
2015-06-10 12:02 - 2013-01-15 21:29 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 10:59 - 2013-04-18 09:50 - 00000000 ____D C:\Windows\Minidump
2015-06-10 09:33 - 2013-01-15 16:12 - 00000000 ____D C:\Users\Sch_
2015-06-10 09:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-06-09 15:05 - 2013-01-16 02:38 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\Skype
2015-06-09 15:04 - 2014-02-21 11:01 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-06-09 15:04 - 2014-02-21 11:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-09 15:03 - 2014-12-21 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-09 11:29 - 2013-12-15 16:45 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-09 11:29 - 2013-12-15 16:45 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-06-08 22:50 - 2013-01-17 20:46 - 00000000 ____D C:\Users\Schneider\Documents\eXtremeGammon
2015-06-08 11:05 - 2014-09-26 11:05 - 00000324 _____ C:\Windows\Tasks\SuperEasyDriverUpdater.job
2015-06-08 09:35 - 2013-03-12 18:49 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\Dropbox
2015-06-05 19:13 - 2013-03-12 18:49 - 00000000 ____D C:\Users\Sch_\AppData\Roaming\Dropbox
2015-06-05 14:15 - 2013-01-16 02:37 - 00000000 ____D C:\ProgramData\Skype
2015-06-05 14:13 - 2014-04-01 09:36 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2015-06-05 14:13 - 2013-03-13 17:47 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
2015-06-05 14:05 - 2013-01-16 00:13 - 00002465 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2015-06-05 14:05 - 2013-01-16 00:13 - 00002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
2015-06-05 14:05 - 2013-01-16 00:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
2015-06-05 14:04 - 2014-09-26 09:41 - 00000000 ____D C:\Intel
2015-06-03 15:03 - 2013-01-15 20:23 - 00111008 _____ C:\Users\Schneider\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-02 11:37 - 2015-03-16 15:19 - 00000000 ____D C:\Users\Schneider\AppData\Local\CrashDumps
2015-06-01 15:08 - 2013-07-02 20:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-05-30 00:18 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-27 17:32 - 2014-02-22 00:51 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\vlc
2015-05-27 00:43 - 2013-01-15 23:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-27 00:43 - 2013-01-15 23:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-27 00:39 - 2014-04-08 10:25 - 00000000 ____D C:\Users\Sch_\AppData\Roaming\Notepad++
2015-05-27 00:39 - 2014-04-08 10:25 - 00000000 ____D C:\Program Files (x86)\Notepad++
2015-05-27 00:36 - 2013-11-22 13:10 - 00000000 ____D C:\Program Files\CCleaner
2015-05-27 00:10 - 2015-04-04 22:42 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-27 00:10 - 2015-04-04 22:42 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-26 23:45 - 2014-07-22 11:40 - 00002203 _____ C:\Users\Schneider\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-14 17:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-05-13 20:11 - 2009-07-14 13:21 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-13 20:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-13 14:47 - 2013-07-10 14:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 14:46 - 2013-07-10 14:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-13 14:46 - 2013-07-10 14:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 11:27 - 2013-12-12 22:04 - 01594964 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-05-12 14:53 - 2015-01-07 16:07 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\avidemux
2015-05-11 16:04 - 2013-02-04 18:26 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\SuperMailer

==================== Files in the root of some directories =======

2015-04-24 13:28 - 2015-04-24 13:28 - 6103040 _____ () C:\Program Files (x86)\GUT3ED4.tmp
2013-01-15 23:48 - 2013-01-15 23:48 - 4096000 _____ () C:\Program Files (x86)\GUTC957.tmp
2013-10-09 11:24 - 2013-10-09 11:24 - 0000106 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc

Some files in TEMP:
====================
C:\Users\Schneider\AppData\Local\Temp\avgnt.exe
C:\Users\Schneider\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6yzwg8.dll
C:\Users\Sch_\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-03 12:37

==================== End of log ============================


volkyleo 10.06.2015 16:05

[CODE]Additional
FRST Logfile:
Code:

scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Sch_ at 2015-06-10 16:53:33
Running from C:\Users\Schneider\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3128309724-421563842-2291253580-500 - Administrator - Disabled)
Gast (S-1-5-21-3128309724-421563842-2291253580-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3128309724-421563842-2291253580-1008 - Limited - Enabled)
Schneider (S-1-5-21-3128309724-421563842-2291253580-1002 - Limited - Enabled) => C:\Users\Schneider
Sch_ (S-1-5-21-3128309724-421563842-2291253580-1000 - Administrator - Enabled) => C:\Users\Sch_
UpdatusUser (S-1-5-21-3128309724-421563842-2291253580-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.14 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.144 - Adobe Systems Incorporated)
Adobe Bridge CC (64 Bit) (HKLM-x32\...\{359F8007-6486-429C-A8C5-D67F6897C88C}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.73.01 - )
Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.8.9046 - )
Avira (HKLM-x32\...\{0696cc37-db90-4000-be99-4a173ca7c8af}) (Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.574 - Avira Operations GmbH & Co. KG)
Brother MFL-Pro Suite MFC-7360N (HKLM-x32\...\{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}) (Version: 1.0.9.0 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Conexant 20585 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.95.48.50 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DataQualityTools (x32 Version: 4.1 - Thomas Hainke Dipl. Inform. Univ.) Hidden
Dell-Druckersoftware (HKLM-x32\...\{105F3CE5-FE55-408E-BF30-E78F85BA0B12}) (Version: 1.00.000 - Dell Inc.)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.6.5 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.27.23 - Dropbox, Inc.) Hidden
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.67.5 - Lenovo Group Limited)
eXtreme Gammon 2 (HKLM-x32\...\{2F5AF5E1-E021-4832-A423-EF480EC58A0B}_is1) (Version: 2.10 - GameSite 2000, Ltd.)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
FileZilla Client 3.11.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.11.0.2 - Tim Kosse)
FileZilla Packages (HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\FileZilla Packages) (Version:  - ) <==== ATTENTION
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Full Tilt Poker.Eu (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.30.43.WIN.FullTilt.EU - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GNU Backgammon (Version 1_03_000, 20140804) (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\GNU Backgammon_is1) (Version:  - Free Software Foundation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Drive (HKLM-x32\...\{CBC9F5FD-5CFA-4A33-81CD-369EAB77E3A6}) (Version: 1.22.9403.0223 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GridGammon 3.8.0 (Build 896) (HKLM-x32\...\GridGammon) (Version: 3.8.0 (Build 896) - Jensen-Barclay, LLC)
IBM SPSS Statistics 22 (HKLM\...\{104875A1-D083-4A34-BC4F-3F635B7F8EF7}) (Version: 22.0.0.0 - IBM Corp)
Integrated Camera Driver Installer Package Ver.1.1.0.48 (HKLM-x32\...\{C3CD17B4-08B0-492D-8A4C-81716D33E520}) (Version: 1.1.0.48 - RICOH)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.2.50.1050 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2253 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{D75AEB5B-FA18-4BD4-9EED-54CA46DB5AE8}) (Version: 13.04.0000 - Intel Corporation)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
KeePass Password Safe 2.29 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.29 - Dominik Reichl)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.11 - )
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Mobile Broadband Activation (HKLM-x32\...\{A95D9DF7-CF34-421A-A1DC-936A49A4DAEA}) (Version: 4.2.1003.00 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{A7BB9BBD-DFE4-4276-820A-7CD141FC09E6}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{1C83CB66-D345-4D6C-95A2-63A03269ADA0}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.10.07 - )
Lenovo Solution Center (HKLM\...\{4041B18B-DE30-4D78-9D60-6ADC586C5E00}) (Version: 2.1.003.00 - Lenovo Group Limited)
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.06.0037 - Lenovo)
LG PC Suite (HKLM-x32\...\LG PC Suite) (Version: 5.3.06.20130913 - LG Electronics)
LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)
LISREL 9.2 for Windows (Student) (HKLM-x32\...\{1DDDDB1A-DBE8-449F-9016-819A423B5832}) (Version: 9.2 - SSI)
Message Center Plus (HKLM\...\{C2C2DB64-1BCE-4FA7-962D-457795ECCEC0}) (Version: 3.3.0004.00 - Lenovo Group Limited)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (x32 Version: 1.2.0006.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-Bit (HKLM\...\{95140000-007A-0407-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit (HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.25.00.03 - Huawei Technologies Co.,Ltd)
MobileWiFi (HKLM-x32\...\MobileWiFi) (Version: TOOL-ConnLaucher_WIN1.12.05.00 - Huawei Technologies Co.,Ltd)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.6 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.6 (x86 en-US)) (Version: 38.0.6 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.0.6 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 341.44 - NVIDIA Corporation)
NVIDIA Grafiktreiber 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.44 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.22.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.22.1 - NVIDIA Corporation)
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version:  - Panda Security)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
partypoker (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\PartyPoker) (Version:  - )
partypoker backgammon (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\PartyGammon) (Version:  - )
PokerSnowie (HKLM-x32\...\PokerSnowie_is1) (Version:  - Snowie Games Ltd)
Qualcomm Gobi 2000 Package for Lenovo (HKLM-x32\...\{666C9123-1AEC-446F-8AA8-28256B1953D4}) (Version: 1.1.250 - QUALCOMM)
REACHit (HKLM-x32\...\{4532E4C5-C84D-4040-A044-ECFCC5C6995B}) (Version: 2.0.5.2 - Lenovo, Inc.)
RICOH R5U230 Media Driver ver.2.06.02.02 (HKLM-x32\...\{022CBB38-CEF0-42BA-906A-A49BEFAE0BEE}) (Version: 2.06.02.02 - RICOH)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Scansoft PDF Professional (x32 Version:  - ) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 2.1.15.0 - Lenovo Group Limited)
SimpleSYN 3.5  (HKLM-x32\...\{bd41baf4-c624-43d4-8770-50c80d735148}) (Version: 3.5.7528 - creativbox.net)
SimpleSYN 3.5  (Version: 3.5.7528 - creativbox.net) Hidden
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
SRecorder (HKLM-x32\...\SRecorder_is1) (Version: 2.0.0.0 - SRecorder Company)
SuperEasy Driver Updater v.1.1.1 (HKLM-x32\...\{039BC111-D60F-A6FF-85F4-7992EA886B8D}_is1) (Version: 1.1.1 - SuperEasy Software GmbH & Co. KG)
SuperMailer 8.00 (HKLM\...\Newsletter Software SuperMailer (x64)_is1) (Version: 8.00 - Mirko Boeer Softwareentwicklungen)
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.3200 - Broadcom Corporation)
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.42 - )
ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.14 - )
ThinkPad Wireless LAN Adapter Software (HKLM-x32\...\{9D3D2C60-A55F-4fed-B2B9-17394396DF01}) (Version: 1.00.0029.8 - REALTEK Semiconductor Corp.)
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.24 - Lenovo)
ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 2.11.0.0 - Lenovo)
ThinkVantage GPS (HKLM-x32\...\{6DB21B2C-2BEF-44B4-B264-8EC2BC2369C6}) (Version: 2.81 - Lenovo)
ThinkVantage Password Manager (HKLM-x32\...\{70EE2BAA-F82A-4B8A-950E-649EFD64D5B9}) (Version: 4.70.2.0 - Lenovo Group Limited)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.9 - Lenovo)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
Verizon Wireless Mobile Broadband Self Activation (HKLM-x32\...\{193CA6A6-E735-40B1-AA92-F611B291792C}) (Version: 3.2.2 - Smith Micro Software, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Webinaria 2.0 (HKLM-x32\...\Webinaria_is1) (Version:  - Charlwood eMarketing)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430) (HKLM\...\DE7217D2A8B057F15EC6E52329FDAB84231521E8) (Version: 04/08/2010 6.3.5.430 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

03-06-2015 14:08:38 Installed LISREL 9.2 for Windows (Student).
05-06-2015 19:18:05 Windows Update
09-06-2015 14:38:32 Windows Update
10-06-2015 12:00:06 Windows Update
10-06-2015 15:33:14 Installed Lenovo System Update.
10-06-2015 15:53:39 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0F076846-17F4-4790-8E7C-6E1A2C3CC3A0} - System32\Tasks\Lenovo\Message Center Plus Launcher => C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe [2014-09-13] (Lenovo)
Task: {0F52BA4F-0907-4B16-89CA-A8CA8BCF3496} - System32\Tasks\FileHippo.com-Online-Aktualisierungsprogramm => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
Task: {19A6E1BF-BB9A-409D-882C-0E33B3B357F6} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {1A510C0A-3CA9-4FE6-940A-F4492E609F91} - System32\Tasks\Lenovo\REACHit Agent Startup => C:\Program Files (x86)\Lenovo\REACHit\webAgent.exe [2015-02-09] (Lenovo)
Task: {2395A7E6-2DAF-4DAC-86D8-20C9E7858D19} - System32\Tasks\{5B56D82C-92EE-4E0A-A65B-B66E40706CF6} => pcalua.exe -a C:\Users\Sch_\Downloads\AdobeAIRInstaller.exe -d C:\Users\Sch_\Downloads
Task: {2C18C0FC-6513-40C6-B33D-66456161598F} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2015-05-15] ()
Task: {2D5059EF-1694-41D2-AADF-3A9028E48403} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-09-10] (Lenovo)
Task: {31D4F55C-4895-4A5B-83B9-E6027C20B0DC} - System32\Tasks\Lenovo\REACHit Agent Update => C:\Program Files (x86)\Lenovo\REACHit\webAgent.exe [2015-02-09] (Lenovo)
Task: {3DDABD6B-5547-4D91-BD0B-6F52AC00E458} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2013-02-15] (Microsoft Corporation)
Task: {52E4876B-8840-47EC-9BCF-42084E6525BA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-06-05] (Dropbox, Inc.)
Task: {554E53B4-EDA5-4E16-9FF8-55D8D0E3CC6B} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {5B7AE85F-F880-473D-80B5-1FF6DE92EECF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-15] (Google Inc.)
Task: {65FED530-4B60-4111-9225-CDB26ADB39D6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-15] (Google Inc.)
Task: {78A48A45-E8CA-4F43-A55E-FEFD5827F49A} - System32\Tasks\SuperEasyDriverUpdater => C:\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe [2013-11-01] (SuperEasy Software)
Task: {7D69B9DA-9F78-4E4E-ACE0-13931D9DAAC4} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-06-05] (Dropbox, Inc.)
Task: {7E515CBE-ADC0-4DC1-9396-7A35E3516E97} - System32\Tasks\Lenovo\LSC\RebootCountTask => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {824E4734-FD2D-4FD0-AE0C-8B1ED7F3B81E} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()
Task: {8D054E36-F22A-4F54-AB58-557F9FDF9F74} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {8FF45B59-652A-4B1E-9E4D-2DAEC463B475} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {993216FD-F97B-4E0E-BDDD-9212F5E07E5D} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {A1A4BCA8-7F7A-493F-A9CA-08BDE9237A11} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {A3C128FE-30A7-493E-8C8D-05F46E5E6C84} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
Task: {B29AAC44-ED1F-4DC4-802B-D61A66A336F9} - System32\Tasks\Lenovo\LSC\Time72Task => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {B4EC8C9C-866A-46DE-B28E-55BB3161F4C5} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {B67BA21A-E470-47B3-8F2F-A0E5230F5CF9} - System32\Tasks\SuperEasyDriverUpdater_UPDATES => C:\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe [2013-11-01] (SuperEasy Software)
Task: {D4728376-8DA0-427A-9C29-5EC0EE86A42A} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe [2015-04-17] (Lenovo Group Limited)
Task: {D7EF94A7-C4AD-4C45-8099-CA623FBA5999} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-26] (Adobe Systems Incorporated)
Task: {DB3E32FF-DE22-4A97-928B-A892D14874A1} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-05-17] ()
Task: {E599D675-5D75-4874-85BA-AE0E81554F58} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-08] (Piriform Ltd)
Task: {E9A0B661-0ADD-4B3D-A81D-49E815F3DFFA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {F1E46004-8F2D-485B-A88C-C942FB2A81B4} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SuperEasyDriverUpdater.job => C:\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe
Task: C:\Windows\Tasks\SuperEasyDriverUpdater_UPDATES.job => C:\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe

==================== Loaded Modules (Whitelisted) ==============

2010-10-19 14:39 - 2010-10-19 14:39 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2015-02-25 12:52 - 2015-02-25 12:52 - 00010952 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-01-15 22:14 - 2015-02-04 04:21 - 00115400 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-06-02 17:20 - 2015-06-02 17:20 - 00043480 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2011-06-13 20:37 - 2011-06-13 20:37 - 00173344 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2015-04-15 22:13 - 2015-04-15 22:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2011-09-06 16:34 - 2010-11-28 20:34 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-02-06 08:10 - 2013-02-06 08:10 - 00351824 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2015-02-11 16:15 - 2014-02-15 08:59 - 00239184 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe
2014-01-21 13:15 - 2005-04-22 06:36 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2013-01-15 18:34 - 2015-04-17 06:07 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2012-09-06 20:18 - 2012-09-06 20:18 - 00086016 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2015-02-25 12:52 - 2015-02-25 12:52 - 00012104 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2015-04-30 00:16 - 2015-04-30 00:16 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu
2015-06-02 17:20 - 2015-06-02 17:20 - 00039384 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2015-06-10 04:50 - 2015-06-05 20:22 - 01281864 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libglesv2.dll
2015-06-10 04:50 - 2015-06-05 20:22 - 00080712 _____ () C:\Program Files (x86)\Google\Chrome\Application\43.0.2357.124\libegl.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3128309724-421563842-2291253580-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Sch_\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe Acrobat Speed Launcher => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: ApowersoftScreenCapture => C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe /autoStart
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
MSCONFIG\startupreg: Dropbox => "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /systemstartup
MSCONFIG\startupreg: Google+ Auto Backup => "C:\Users\Sch_\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe" /autostart
MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: KeePass 2 PreLoad => "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PasswordManager => "C:\Program Files\Lenovo\Password Manager\password_manager.exe"
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
MSCONFIG\startupreg: SRecorder => C:\Program Files (x86)\SRecorder\SRecorder.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{0177C179-5A17-4DC3-B7F3-4CA2E396168D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{D5A40BBA-3515-4CB9-AC1B-D6A996211BDE}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{B35DABEB-105A-4271-A8D8-5D98FE961F47}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{88A966CC-5EBF-4ECB-BA84-4EB0AB253802}C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{247A6B68-1635-43AC-A4CF-83CFE8C40250}C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{C2500268-171F-49B8-8AFB-469468D61094}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B7744C75-B336-449B-80C5-838BFA32522A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TCP Query User{619C759E-E4F6-4D05-AEFA-9DD14DE2E5A2}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{364DFD2B-928E-441A-9F38-3173B14FF6AC}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{9D80FF1E-6EF6-476D-A249-18A3B58E2C43}] => (Allow) C:\Program Files (x86)\Brother\Brmfl10f\FAXRX.exe
FirewallRules: [{E018E007-1CB5-46D4-87E8-822DEB1CE7CC}] => (Allow) C:\Program Files (x86)\Brother\Brmfl10f\FAXRX.exe
FirewallRules: [{F00692B4-B2C4-445D-8B0B-C79A61D93201}] => (Allow) LPort=54925
FirewallRules: [TCP Query User{99319B7C-37DB-4498-8DB0-373D0C469523}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [UDP Query User{09336A13-8ABA-4F12-A7D8-B2C971265816}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [{FE117F15-FCDE-4F57-A594-DBFDEC0886CB}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{7040AA9B-A43A-4F40-9FF5-D95F6C3B89F5}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{14ED3387-E667-4906-8FBE-95D2652107A8}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{FD2120EC-AAE4-46F1-AEA1-4EBCF6E5FF13}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{E45D337E-4545-423F-BCD5-D2AEE72B96A4}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{C1F24B9E-E2D0-4EF1-9494-8435F7A14672}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{B0D57C34-96BA-4B3E-B795-407158E1AC0A}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{7638B9C5-8675-4EF4-88AB-CEE3EC7A95F5}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{AD295283-7A34-42B0-8279-3A66C420A1D9}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{6124F19C-1465-4430-A220-D6200989C37B}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{E5EEA0AE-B5FE-48C8-9529-4CF61BA2E3C6}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{FE52A2E8-3B8D-4E86-ABE8-08FD31F94707}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{9FC99164-FCF5-4981-B726-0ACD37FA6C19}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{E115D3DB-8CEA-49FE-8782-4B7FCEC1E00F}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [{58668C00-1FE6-4E90-A422-D1C50CFB59A1}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [TCP Query User{5DE1D668-E486-44CB-ABEE-CE03FDE43835}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [UDP Query User{E8F22B0B-D2A4-42EE-9970-7572AF76041D}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [TCP Query User{441653E0-09D4-4255-B889-0C095D9629E0}C:\program files\ibm\spss\statistics\22\stats.exe] => (Allow) C:\program files\ibm\spss\statistics\22\stats.exe
FirewallRules: [UDP Query User{E96ABC1B-CCDE-4227-8035-8BCAF1BB0B71}C:\program files\ibm\spss\statistics\22\stats.exe] => (Allow) C:\program files\ibm\spss\statistics\22\stats.exe
FirewallRules: [{BC6D5EAC-2B23-4351-9F4B-7D745288C668}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{478E6377-6B9D-4BFF-A95B-C350E388330B}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{593992C3-F247-460D-B2AC-A2D546F89B9B}] => (Allow) C:\Users\Sch_\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{145EEBA0-5E57-487F-9C77-4C3BC458977C}] => (Allow) C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{5E7F4C91-CC57-4891-8D2D-03791B99ECFE}C:\program files\microsoft office\office14\groove.exe] => (Block) C:\program files\microsoft office\office14\groove.exe
FirewallRules: [UDP Query User{D320306A-E334-40E4-B9B6-0487B1A48994}C:\program files\microsoft office\office14\groove.exe] => (Block) C:\program files\microsoft office\office14\groove.exe
FirewallRules: [{9C1843E9-C58C-43EA-B151-F5355B79CA6C}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro\Apowersoft Screen Recorder Pro.exe
FirewallRules: [{D8AD5A46-6223-4994-84A7-3ACC33B2D882}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro\Apowersoft Screen Recorder Pro.exe
FirewallRules: [{CD78455F-A95F-4A5C-9881-E13F258914B0}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\VideoEditor.exe
FirewallRules: [{4EE8DD7F-5E4E-4B7F-B941-4A36AC918538}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\VideoEditor.exe
FirewallRules: [{7C7FD931-1293-4EA8-9DEC-FE8E00C83690}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\Updater.exe
FirewallRules: [{F83B214C-D8FB-46E9-82E1-F7C11B3539EE}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\Updater.exe
FirewallRules: [{8EED3E8E-22F6-4351-9AC3-61774226AD38}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3E353B2C-4F01-41D3-97CA-E6755F4ABBAD}] => (Allow) LPort=2869
FirewallRules: [{981AC201-7A99-454B-BB59-58ACAE95A989}] => (Allow) LPort=1900
FirewallRules: [{9AC5B808-1CB2-4856-AEB5-400EDE36655B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{992EA5EF-FC4C-4C53-8814-9ED7D0C5F4FC}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe
FirewallRules: [{3F8DC095-1F92-46C0-B62B-82891C82E8ED}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe
FirewallRules: [{81F38556-5395-4EE1-AB88-FB3F6694C9AD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EDDF0EFE-3669-4174-9EB7-07779F1CAA8D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{555EBA7D-A3DA-4BC9-BFAB-C0DF5CBC38AE}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe
FirewallRules: [{0D2A86BA-2433-49F9-8A64-36F131C78D1B}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe
FirewallRules: [{FC82A0FF-96BF-4B79-AA65-D02FF388E73B}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{9CC77F6E-D172-40F6-9A58-B3FFBD2E47EB}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{08261FE2-45A6-427F-ADD4-160AC8C7A0AE}] => (Allow) C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{12C2F115-32E5-44BA-8F39-0B6218940ECE}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{CB8F560E-3C39-4A79-9456-CDEF7E056208}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{A5815DB5-9213-4E4F-BB04-4417B80AC197}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{1D40E93B-5087-4161-8E9A-9F76AA471E55}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{0417101C-BFDF-40C5-B8E1-65F39882A5C2}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{900EFFBA-462F-4EF3-987B-B180AE9D6C8C}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/10/2015 04:04:33 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\servicing\TrustedInstaller.exe; Beschreibung = Windows Modules Installer; Fehler = 0x80042313).

Error: (06/10/2015 04:04:28 PM) (Source: VSS) (EventID: 12297) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\" nicht geleert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
], Freigabe[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:04:28 PM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 0000000000000510,0x0053c000,00000000001E98B0,0,00000000001F6A90,4096,[0])". hr = 0x80070005, Zugriff verweigert
.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:04:17 PM) (Source: VSS) (EventID: 12297) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\" nicht geleert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
], Freigabe[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:04:17 PM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 00000000000004F0,0x0053c000,0000000000265EA0,0,0000000000266EB0,4096,[0])". hr = 0x80070005, Zugriff verweigert
.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:04:05 PM) (Source: VSS) (EventID: 12297) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\" nicht geleert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
], Freigabe[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:04:05 PM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 00000000000004B4,0x0053c000,0000000000264140,0,0000000000265150,4096,[0])". hr = 0x80070005, Zugriff verweigert
.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:03:54 PM) (Source: VSS) (EventID: 12297) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\" nicht geleert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
], Freigabe[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:03:54 PM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 000000000000027C,0x0053c000,0000000000260B40,0,0000000000261B50,4096,[0])". hr = 0x80070005, Zugriff verweigert
.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:03:43 PM) (Source: VSS) (EventID: 12297) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die E/A-Schreibvorgänge können während des Schattenkopie-Erstellungszeitraums auf Volume "\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\" nicht geleert werden.
Der Volumeindex im Schattenkopiesatz ist 0. Fehlerdetails: Offen[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Leerung[0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
], Freigabe[0x00000000, Der Vorgang wurde erfolgreich beendet.
], Ausführung[0x00000000, Der Vorgang wurde erfolgreich beendet.
].


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet


System errors:
=============
Error: (06/10/2015 04:49:09 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/10/2015 04:49:09 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/10/2015 04:43:51 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎10.‎06.‎2015 um 16:37:49 unerwartet heruntergefahren.

Error: (06/10/2015 04:37:49 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/10/2015 04:37:49 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/10/2015 04:31:39 PM) (Source: Service Control Manager) (EventID: 7043) (User: )
Description: Der Dienst Windows Update konnte nach dem Empfang eines Preshutdown-Steuerelements nicht richtig heruntergefahren werden.

Error: (06/10/2015 04:30:10 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/10/2015 04:30:10 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/10/2015 04:24:24 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎10.‎06.‎2015 um 16:21:41 unerwartet heruntergefahren.

Error: (06/10/2015 04:18:22 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069


Microsoft Office:
=========================
Error: (06/10/2015 04:04:33 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\servicing\TrustedInstaller.exeWindows Modules Installer0x80042313

Error: (06/10/2015 04:04:28 PM) (Source: VSS) (EventID: 12297) (User: )
Description: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\00x00000000, Der Vorgang wurde erfolgreich beendet.
0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
0x00000000, Der Vorgang wurde erfolgreich beendet.
0x00000000, Der Vorgang wurde erfolgreich beendet.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:04:28 PM) (Source: VSS) (EventID: 12289) (User: )
Description: DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 0000000000000510,0x0053c000,00000000001E98B0,0,00000000001F6A90,4096,[0])0x80070005, Zugriff verweigert


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:04:17 PM) (Source: VSS) (EventID: 12297) (User: )
Description: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\00x00000000, Der Vorgang wurde erfolgreich beendet.
0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
0x00000000, Der Vorgang wurde erfolgreich beendet.
0x00000000, Der Vorgang wurde erfolgreich beendet.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:04:17 PM) (Source: VSS) (EventID: 12289) (User: )
Description: DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 00000000000004F0,0x0053c000,0000000000265EA0,0,0000000000266EB0,4096,[0])0x80070005, Zugriff verweigert


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:04:05 PM) (Source: VSS) (EventID: 12297) (User: )
Description: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\00x00000000, Der Vorgang wurde erfolgreich beendet.
0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
0x00000000, Der Vorgang wurde erfolgreich beendet.
0x00000000, Der Vorgang wurde erfolgreich beendet.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:04:05 PM) (Source: VSS) (EventID: 12289) (User: )
Description: DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 00000000000004B4,0x0053c000,0000000000264140,0,0000000000265150,4096,[0])0x80070005, Zugriff verweigert


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:03:54 PM) (Source: VSS) (EventID: 12297) (User: )
Description: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\00x00000000, Der Vorgang wurde erfolgreich beendet.
0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
0x00000000, Der Vorgang wurde erfolgreich beendet.
0x00000000, Der Vorgang wurde erfolgreich beendet.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet

Error: (06/10/2015 04:03:54 PM) (Source: VSS) (EventID: 12289) (User: )
Description: DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 000000000000027C,0x0053c000,0000000000260B40,0,0000000000261B50,4096,[0])0x80070005, Zugriff verweigert


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: calling flush-and-hold IOCTL
  Aktueller Status: flush-and-hold writes
  Volumename: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\

Error: (06/10/2015 04:03:43 PM) (Source: VSS) (EventID: 12297) (User: )
Description: \\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963}\00x00000000, Der Vorgang wurde erfolgreich beendet.
0x80042302, Unerwarteter Fehler bei einer Komponente des Volumeschattenkopie-Diensts.
Weitere Informationen finden Sie im Anwendungsereignisprotokoll.
0x00000000, Der Vorgang wurde erfolgreich beendet.
0x00000000, Der Vorgang wurde erfolgreich beendet.


Vorgang:
  Asynchroner Vorgang wird ausgeführt

Kontext:
  Aktueller Status: DoSnapshotSet


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5 CPU M 480 @ 2.67GHz
Percentage of memory in use: 42%
Total physical RAM: 7987.67 MB
Available physical RAM: 4603.43 MB
Total Pagefile: 15973.54 MB
Available Pagefile: 12477.37 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:193.08 GB) (Free:43.03 GB) NTFS
Drive d: () (Fixed) (Total:94.07 GB) (Free:49.26 GB) NTFS
Drive e: (Lenovo_Recovery) (Fixed) (Total:9.77 GB) (Free:1.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 07628771)
Partition 1: (Active) - (Size=1.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=193.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=94.1 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=9.8 GB) - (Type=07 NTFS)

==================== End of log ============================

--- --- ---

volkyleo 10.06.2015 16:08

Code:

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-10 17:02:10
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.02.0 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\SCH_BU~1\AppData\Local\Temp\pfkiaaod.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\kernel32.dll!RegSetValueExW                                    000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                  0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                  000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                            000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                          00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                          00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\kernel32.dll!RegSetValueExA                                    00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                    000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                              000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                          000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                  000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                              000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                            000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\ole32.dll!CoCreateInstance                                    000007fefdf97490 11 bytes JMP 000007fffd1c0228
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1892] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                    000007fefdfabf00 7 bytes JMP 000007fffd1c0260
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                    0000000075611401 2 bytes JMP 757cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                      0000000075611419 2 bytes JMP 757cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                    0000000075611431 2 bytes JMP 75848f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                    000000007561144a 2 bytes CALL 757a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                      00000000756114dd 2 bytes JMP 75848822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                00000000756114f5 2 bytes JMP 758489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                      000000007561150d 2 bytes JMP 75848718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                0000000075611525 2 bytes JMP 75848ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                      000000007561153d 2 bytes JMP 757bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                          0000000075611555 2 bytes JMP 757c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                    000000007561156d 2 bytes JMP 75848fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                      0000000075611585 2 bytes JMP 75848b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                        000000007561159d 2 bytes JMP 758486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                      00000000756115b5 2 bytes JMP 757bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                    00000000756115cd 2 bytes JMP 757cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                00000000756116b2 2 bytes JMP 75848ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[1624] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                00000000756116bd 2 bytes JMP 75848671 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe[1844] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                        000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe[1844] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                  000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe[1844] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe[1844] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                            000007fefd1da413 2 bytes [FE, FF]
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe[1844] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                    000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe[1844] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                  000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlk.exe[1844] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                          0000000075611401 2 bytes JMP 757cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                            0000000075611419 2 bytes JMP 757cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                          0000000075611431 2 bytes JMP 75848f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                          000000007561144a 2 bytes CALL 757a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                            00000000756114dd 2 bytes JMP 75848822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                      00000000756114f5 2 bytes JMP 758489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                            000000007561150d 2 bytes JMP 75848718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                      0000000075611525 2 bytes JMP 75848ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                            000000007561153d 2 bytes JMP 757bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                0000000075611555 2 bytes JMP 757c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                          000000007561156d 2 bytes JMP 75848fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                            0000000075611585 2 bytes JMP 75848b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                              000000007561159d 2 bytes JMP 758486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                            00000000756115b5 2 bytes JMP 757bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                          00000000756115cd 2 bytes JMP 757cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                      00000000756116b2 2 bytes JMP 75848ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2100] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                      00000000756116bd 2 bytes JMP 75848671 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                  000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                                      000007fefd1da413 2 bytes [FE, FF]
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                            000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                          000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                  000007fef7c9dc88 5 bytes JMP 000007fff7c700d8
.text  C:\Windows\system32\Dwm.exe[2480] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                000007fef7c9de10 5 bytes JMP 000007fff7c70110
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                              00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                        0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                        0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                          0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                            0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                          0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                              0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                  0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                  0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                              0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                              0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                        0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                      0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                          0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                            0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\Program Files\LENOVO\HOTKEY\tposdsvc.exe[2576] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\Program Files\LENOVO\HOTKEY\shtctky.exe[2628] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                  000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files\LENOVO\HOTKEY\shtctky.exe[2628] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                              000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files\LENOVO\HOTKEY\shtctky.exe[2628] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                            000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files\LENOVO\HOTKEY\shtctky.exe[2628] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                        000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files\LENOVO\HOTKEY\shtctky.exe[2628] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files\LENOVO\HOTKEY\shtctky.exe[2628] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                            000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files\LENOVO\HOTKEY\shtctky.exe[2628] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                          000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe[2764] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                      000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe[2764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                  000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe[2764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe[2764] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                            000007fefd1da413 2 bytes [FE, FF]
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe[2764] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                    000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe[2764] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe[2764] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                              000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                          0000000075611401 2 bytes JMP 757cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                            0000000075611419 2 bytes JMP 757cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                          0000000075611431 2 bytes JMP 75848f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                          000000007561144a 2 bytes CALL 757a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                              00000000756114dd 2 bytes JMP 75848822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                      00000000756114f5 2 bytes JMP 758489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                              000000007561150d 2 bytes JMP 75848718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                      0000000075611525 2 bytes JMP 75848ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                            000000007561153d 2 bytes JMP 757bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                  0000000075611555 2 bytes JMP 757c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                          000000007561156d 2 bytes JMP 75848fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                            0000000075611585 2 bytes JMP 75848b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                000000007561159d 2 bytes JMP 758486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                            00000000756115b5 2 bytes JMP 757bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                          00000000756115cd 2 bytes JMP 757cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                      00000000756116b2 2 bytes JMP 75848ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                      00000000756116bd 2 bytes JMP 75848671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                  00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                        0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                        0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                          0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                  0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                  0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                              0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                              0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                          0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                        0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                          0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                            0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                  0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe[2996] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                  00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                  00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                    00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                    00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                  00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                          0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                          0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                            0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                              0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                  0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                    0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                            0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                          0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                            0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                              0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                    0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\Program Files\Lenovo\Zoom\TpScrex.exe[3048] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                    00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                            000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                                  000007fefd1da413 2 bytes [FE, FF]
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                    000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\ole32.dll!CoCreateInstance                                                            000007fefdf97490 11 bytes JMP 000007fffd1c0228
.text  C:\Windows\System32\igfxpers.exe[3168] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                            000007fefdfabf00 7 bytes JMP 000007fffd1c0260
.text  C:\Windows\System32\TpShocks.exe[3232] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                            000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Windows\System32\TpShocks.exe[3232] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Windows\System32\TpShocks.exe[3232] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Windows\System32\TpShocks.exe[3232] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                                  000007fefd1da413 2 bytes [FE, FF]
.text  C:\Windows\System32\TpShocks.exe[3232] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Windows\System32\TpShocks.exe[3232] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Windows\System32\TpShocks.exe[3232] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                    000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                              00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                        0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                        0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                          0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                            0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                          0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                              0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                  0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                          0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                            0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                  0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                              0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                              0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                        0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                      0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[3248] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                  00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\kernel32.dll!RegSetValueExW                                              000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                            0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                              000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                        000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                      00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                      00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\kernel32.dll!RegSetValueExA                                              00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                          000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                        000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                    000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                            000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                          000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                        000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\ole32.dll!CoCreateInstance                                                000007fefdf97490 11 bytes JMP 000007fffd1c0228
.text  C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3412] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                              000007fefdfabf00 7 bytes JMP 000007fffd1c0260
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                              00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                              00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                      0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                      0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                        0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                            0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                          0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                              0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                            0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                            0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                        0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                      0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                        0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                          0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe[3584] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                              00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                              00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                      0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                      0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                        0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                            0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                          0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                              0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                            0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                            0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                        0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                      0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                        0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                          0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\ProgramData\DatacardService\DCSHelper.exe[3672] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\kernel32.dll!RegSetValueExW                                      000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                    0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                    000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                              000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                            00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                            00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\kernel32.dll!RegSetValueExA                                      00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                      000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                  000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                            000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                    000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                              000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\ole32.dll!CoCreateInstance                                      000007fefdf97490 11 bytes JMP 000007fffd1c0228
.text  C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE[3744] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                      000007fefdfabf00 7 bytes JMP 000007fffd1c0260
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3976] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                    000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3976] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3976] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                              000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3976] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                          000007fefd1da413 2 bytes [FE, FF]
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3976] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                  000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3976] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                              000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[3976] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                            000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\kernel32.dll!RegSetValueExW                                    000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\kernel32.dll!RegQueryValueExW                                  0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\kernel32.dll!RegDeleteValueW                                    000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                              000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                            00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                            00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\kernel32.dll!RegSetValueExA                                    00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                      000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                              000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                          000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                  000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[1996] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                              000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                    0000000075611401 2 bytes JMP 757cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                      0000000075611419 2 bytes JMP 757cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                    0000000075611431 2 bytes JMP 75848f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                    000000007561144a 2 bytes CALL 757a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                        00000000756114dd 2 bytes JMP 75848822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                00000000756114f5 2 bytes JMP 758489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                        000000007561150d 2 bytes JMP 75848718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                0000000075611525 2 bytes JMP 75848ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                      000000007561153d 2 bytes JMP 757bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                            0000000075611555 2 bytes JMP 757c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                    000000007561156d 2 bytes JMP 75848fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                      0000000075611585 2 bytes JMP 75848b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                          000000007561159d 2 bytes JMP 758486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                      00000000756115b5 2 bytes JMP 757bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                    00000000756115cd 2 bytes JMP 757cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                00000000756116b2 2 bytes JMP 75848ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[3176] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                00000000756116bd 2 bytes JMP 75848671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[4456] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                            000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[4456] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                        000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[4456] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                      000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[4456] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                  000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[4456] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                          000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[4456] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                      000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[4456] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                    000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                            00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                              00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                              00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                            00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                    0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                    0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                      0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                          0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                        0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                            0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                              0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\USER32.dll!CreateWindowExW                              0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                          0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                          0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                      0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                    0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                      0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                        0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                              0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe[4548] C:\Windows\syswow64\ole32.dll!CoCreateInstance                              00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                              0000000075611401 2 bytes JMP 757cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                0000000075611419 2 bytes JMP 757cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                              0000000075611431 2 bytes JMP 75848f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                              000000007561144a 2 bytes CALL 757a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                00000000756114dd 2 bytes JMP 75848822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                          00000000756114f5 2 bytes JMP 758489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                000000007561150d 2 bytes JMP 75848718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                          0000000075611525 2 bytes JMP 75848ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                000000007561153d 2 bytes JMP 757bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                    0000000075611555 2 bytes JMP 757c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                              000000007561156d 2 bytes JMP 75848fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                0000000075611585 2 bytes JMP 75848b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                  000000007561159d 2 bytes JMP 758486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                00000000756115b5 2 bytes JMP 757bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                              00000000756115cd 2 bytes JMP 757cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                          00000000756116b2 2 bytes JMP 75848ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe[4596] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                          00000000756116bd 2 bytes JMP 75848671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNEL32.dll!RegQueryValueExW                                  00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExW                                    00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                    00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNEL32.dll!RegDeleteValueW                                    00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                            0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                            0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                              0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                              0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                  0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe[3492] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                      0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                          000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                        000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                    000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                            000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                          000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                        000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\ole32.dll!CoCreateInstance                                                000007fefdf97490 11 bytes JMP 000007fffd1c0228
.text  C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[2336] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                              000007fefdfabf00 7 bytes JMP 000007fffd1c0260
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                    00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                      00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                      00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                      00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                              0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                              0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                  0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                    0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                        0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                        0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                    0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                    0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                              0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                            0000000076e47a5c 5 bytes JMP 000000016d413800
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                  0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                      0000000075095ea5 5 bytes JMP 000000016d413320
.text  C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.exe[3228] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                        00000000750c9d0b 5 bytes JMP 000000016d4132b0
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                              000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                                  000007fefd1da413 2 bytes [FE, FF]
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                        000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                      000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\ole32.dll!CoCreateInstance                                                              000007fefdf97490 11 bytes JMP 000007fffd1c0228
.text  C:\Windows\system32\taskeng.exe[2324] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                            000007fefdfabf00 7 bytes JMP 000007fffd1c0260
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      0000000075611401 2 bytes JMP 757cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        0000000075611419 2 bytes JMP 757cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      0000000075611431 2 bytes JMP 75848f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      000000007561144a 2 bytes CALL 757a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17        00000000756114dd 2 bytes JMP 75848822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000756114f5 2 bytes JMP 758489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17        000000007561150d 2 bytes JMP 75848718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  0000000075611525 2 bytes JMP 75848ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        000000007561153d 2 bytes JMP 757bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17            0000000075611555 2 bytes JMP 757c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      000000007561156d 2 bytes JMP 75848fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        0000000075611585 2 bytes JMP 75848b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17          000000007561159d 2 bytes JMP 758486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000756115b5 2 bytes JMP 757bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000756115cd 2 bytes JMP 757cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000756116b2 2 bytes JMP 75848ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000756116bd 2 bytes JMP 75848671 C:\Windows\syswow64\kernel32.dll
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6800] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                            000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6800] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                        000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6800] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                      000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6800] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                  000007fefd1da413 2 bytes [FE, FF]
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6800] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                          000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6800] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                      000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[6800] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                    000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                              0000000075611401 2 bytes JMP 757cb21b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                0000000075611419 2 bytes JMP 757cb346 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                              0000000075611431 2 bytes JMP 75848f29 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                              000000007561144a 2 bytes CALL 757a489d C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                              * 9
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                00000000756114dd 2 bytes JMP 75848822 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                          00000000756114f5 2 bytes JMP 758489f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                000000007561150d 2 bytes JMP 75848718 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                          0000000075611525 2 bytes JMP 75848ae2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                000000007561153d 2 bytes JMP 757bfca8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                    0000000075611555 2 bytes JMP 757c68ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                              000000007561156d 2 bytes JMP 75848fe3 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                0000000075611585 2 bytes JMP 75848b42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                  000000007561159d 2 bytes JMP 758486dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                00000000756115b5 2 bytes JMP 757bfd41 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                              00000000756115cd 2 bytes JMP 757cb2dc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                          00000000756116b2 2 bytes JMP 75848ea4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE[6936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                          00000000756116bd 2 bytes JMP 75848671 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNEL32.dll!RegSetValueExW                                  000000007715a3e0 7 bytes JMP 000000016fff0228
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNEL32.dll!RegQueryValueExW                                0000000077163f00 5 bytes JMP 000000016fff0180
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNEL32.dll!RegDeleteValueW                                000000007717ffd0 5 bytes JMP 000000016fff01b8
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNEL32.dll!K32GetMappedFileNameW                          000000007718f350 5 bytes JMP 000000016fff0110
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNEL32.dll!K32EnumProcessModulesEx                        00000000771b9aa0 7 bytes JMP 000000016fff00d8
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNEL32.dll!K32GetModuleInformation                        00000000771c9530 5 bytes JMP 000000016fff0148
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNEL32.dll!RegSetValueExA                                  00000000771e8850 7 bytes JMP 000000016fff01f0
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                  000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                              000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                            000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                        000007fefd1da413 2 bytes [FE, FF]
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                            000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe[6852] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                          000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                              000007fefd1d2db0 5 bytes JMP 000007fffd1c0180
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                        000007fefd1d37d0 7 bytes JMP 000007fffd1c00d8
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                      000007fefd1da410 2 bytes JMP 000007fffd1c0110
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW + 3                                                  000007fefd1da413 2 bytes [FE, FF]
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                          000007fefd1daec0 6 bytes JMP 000007fffd1c0148
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\ole32.dll!CoCreateInstance                                                              000007fefdf97490 11 bytes JMP 000007fffd1c0228
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                            000007fefdfabf00 7 bytes JMP 000007fffd1c0260
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                        000007fefd5d89e0 8 bytes JMP 000007fffd1c01f0
.text  C:\Windows\system32\DllHost.exe[5540] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                      000007fefd5dbe40 8 bytes JMP 000007fffd1c01b8
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\kernel32.dll!RegQueryValueExW                                                00000000757a1efe 7 bytes JMP 000000016d413dd0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\kernel32.dll!RegSetValueExW                                                  00000000757a5b9d 7 bytes JMP 000000016d4140e0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  00000000757b13f9 7 bytes JMP 000000016d413f10
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\kernel32.dll!RegDeleteValueW                                                  00000000757bea45 7 bytes JMP 000000016d413dc0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                          0000000075848ea4 7 bytes JMP 000000016d413b50
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                          0000000075848f29 5 bytes JMP 000000016d413c00
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                            0000000075849281 5 bytes JMP 000000016d413b60
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              0000000076fd1d29 5 bytes JMP 000000016d413b00
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            0000000076fd1dd7 5 bytes JMP 000000016d413ab0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                0000000076fd2ab1 5 bytes JMP 000000016d413c10
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    0000000076fd2d1d 5 bytes JMP 000000016d413890
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                            0000000075a2e96b 5 bytes JMP 000000016d4133e0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                              0000000075a2eba5 5 bytes JMP 000000016d4133f0
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                    0000000076de8a29 5 bytes JMP 000000016d413370
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                0000000076df4572 5 bytes JMP 000000016d413810
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesW                                                0000000076e0e567 5 bytes JMP 000000016d413880
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\USER32.dll!ChangeDisplaySettingsExW                                          0000000076e307d7 5 bytes JMP 000000016d413280
.text  C:\Users\Schneider\Desktop\Gmer-19357.exe[4948] C:\Windows\syswow64\USER32.dll!DisplayConfigGetDeviceInfo                                        0000000076e47a5c 5 bytes JMP 000000016d413800

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af7c9255                                                                     
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af7c9255 (not active ControlSet)                                                 

---- EOF - GMER 2.1 ----

Hier noch eine kurze Info (weiß nicht, ob sie relevant ist): bevor ich die neuen Scans als Admin durchgeführt habe, habe ich über das Lenovo System Update Tool 16 Treiber und den BIOS-Treiber aktualisiert.

DANKE für die Hilfe

Warlord711 10.06.2015 16:09

Lade Dir bitte von hier Revo Uninstaller Download Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.
  • Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
  • Klicke auf Optionen und wähle als Sprache Deutsch.
  • Suche im Uninstallerfeld nach den Programmen:

    FileZilla Packages

  • Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .

 



Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

volkyleo 10.06.2015 17:41

Nach dem Scan mit dem AdwCleaner gab es beim Runterfahren wieder einen Bluescreen "Driver_Power_State_Failure) und beim Hochfahren gab es keine Logfile. Ich weiß aber, dass er ein paar Sachen gefunden hatte in den Sektionen "Ordner" usw.
Ich hab dann nochmal einen Scan mit AdwCleaner gemacht und er hat nichts mehr gefunden. Beim Hochfahren gab es wieder keine Log-File. Was soll ich jetzt als nächstes machen? So fortfahren, wie du es schon beschrieben hast, oder muss ich was anderes machen?

Warlord711 10.06.2015 17:47

Unter C:\AdwCleaner\ sind auch keine Logfiles ?

Die aktuellste C:\AdwCleaner\AdwCleaner[Sx].txt. (x = fortlaufende Nummer).

volkyleo 10.06.2015 20:35

Doch. Hier die beiden Logfiles der beiden letzten Scans:

Code:

# AdwCleaner v4.206 - Bericht erstellt 10/06/2015 um 18:05:38
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-09.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Sch_ - SCH_-PC
# Gestarted von : C:\Users\Schneider\Desktop\AdwCleaner_4.206.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SuperEasy Software
Ordner Gelöscht : C:\Program Files (x86)\SuperEasy Software
Ordner Gelöscht : C:\Users\Schneider\AppData\Roaming\SuperEasy Software
Ordner Gelöscht : C:\Users\Sch_\AppData\Roaming\SuperEasy Software
Ordner Gelöscht : C:\Users\Schneider\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg
Ordner Gelöscht : C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg

***** [ Geplante Tasks ] *****

Task Gelöscht : SuperEasyDriverUpdater_UPDATES

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\SuperEasy Software
Schlüssel Gelöscht : HKLM\SOFTWARE\SuperEasy Software
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{039BC111-D60F-A6FF-85F4-7992EA886B8D}_is1
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\Users\Sch_\AppData\Local\Smartbar\Application\Resources\crdlil64.dll,C:\Windows\system32\nvinitx.dll

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v38.0.6 (x86 en-US)


-\\ Google Chrome v43.0.2357.124


*************************

AdwCleaner[R0].txt - [10075 Bytes] - [16/09/2014 10:04:38]
AdwCleaner[R1].txt - [1354 Bytes] - [16/09/2014 10:17:11]
AdwCleaner[R2].txt - [2063 Bytes] - [10/06/2015 18:00:23]
AdwCleaner[R3].txt - [2382 Bytes] - [10/06/2015 18:04:30]
AdwCleaner[S0].txt - [7521 Bytes] - [16/09/2014 10:07:55]
AdwCleaner[S1].txt - [2142 Bytes] - [10/06/2015 18:05:38]

########## EOF - \AdwCleaner\AdwCleaner[S1].txt - [2201  Bytes] ##########

Code:

# AdwCleaner v4.206 - Bericht erstellt 10/06/2015 um 18:27:25
# Aktualisiert 01/06/2015 von Xplode
# Datenbank : 2015-06-09.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Sch_ - SCH_-PC
# Gestarted von : C:\Users\Schneider\Desktop\AdwCleaner_4.206.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v38.0.6 (x86 en-US)


-\\ Google Chrome v43.0.2357.124


*************************

AdwCleaner[R0].txt - [10075 Bytes] - [16/09/2014 10:04:38]
AdwCleaner[R1].txt - [1354 Bytes] - [16/09/2014 10:17:11]
AdwCleaner[R2].txt - [2063 Bytes] - [10/06/2015 18:00:23]
AdwCleaner[R3].txt - [2382 Bytes] - [10/06/2015 18:04:30]
AdwCleaner[R4].txt - [1205 Bytes] - [10/06/2015 18:26:05]
AdwCleaner[S0].txt - [7521 Bytes] - [16/09/2014 10:07:55]
AdwCleaner[S1].txt - [2283 Bytes] - [10/06/2015 18:05:38]
AdwCleaner[S2].txt - [1128 Bytes] - [10/06/2015 18:27:25]

########## EOF - \AdwCleaner\AdwCleaner[S2].txt - [1187  Bytes] ##########

Ich mach jetzt mal die beiden letzen Scans aus deiner Anleitung: JRT und Malwarebytes und poste dann die Logfiles.

Warlord711 10.06.2015 20:37

Supi !

volkyleo 10.06.2015 21:26

irgendwas scheint mit meinem Notebook los zu sein. Ich hab jetzt 2 mal versucht den JRT Scan durchzuführen und er ist 2 mal bei dem Scan der Registry abgestürzt. Ich hatte in den letzen 4 Wochen öfters Abstürze (Lüfter läuft laut und Notebook stürzt dann ab - dann wenn etwas herausfordernde Programme laufen oder Flash im Browser) und heute hatte ich zum ersten Mal 2x den Blue Screen ... kannst du dir vorstellen, was da los ist? Treiberupdates habe ich mit Lenovo System Update bereits gemacht und auch mit Easy Driver gecheckt. Was soll ich nun machen ... ?

Warlord711 11.06.2015 08:11

Überspring erstmal JRT und mach mit Malwarebytes weiter.

Danach schauen wir, ob ggf. ein Fehler im Windows vorhanden und reparieren diesen, falls möglich.

volkyleo 11.06.2015 10:29

Hier die Logfile von Malwarebytes. Die 2 gefundenen Ergebnisse habe ich in Quarantäne verschoben. FRST habe ich auch laufen lassen und poste anschließend die Ergebnisse.

Code:

Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 11.06.2015
Suchlauf-Zeit: 10:42:04
Logdatei: mbytes.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.06.11.01
Rootkit Datenbank: v2015.06.02.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Sch_Business

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 452198
Verstrichene Zeit: 31 Min, 16 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 2
Spyware.Pony, C:\Program Files (x86)\SRecorder\SRecorder.exe, In Quarantäne, [bfae0baeafdbd462e0b685d48d75649c],
PUP.Optional.VeriStaff, C:\Windows\Installer\1089e4.msi, In Quarantäne, [511cd4e5a8e21422520fbca39868f10f],

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Code:

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:08-06-2015
Ran by Sch_ (administrator) on SCH_-PC on 11-06-2015 11:20:59
Running from C:\Users\Schneider\Desktop
Loaded Profiles: Sch_ & Schneider (Available Profiles: Sch_ & UpdatusUser & Schneider)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: Chrome)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPOSDSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\shtctky.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Dell Inc.) C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlsdbnt.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(creativbox.net, Torsten Leithold & Georg von Kries GbR) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE
(Piriform Ltd) C:\Program Files\CCleaner\CCleaner64.exe
() C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
(Microsoft Corporation) C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
() C:\ProgramData\MobileBrServ\mbbService.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
(QUALCOMM, Inc.) C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Dell Inc.) C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\dlpwdnt.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Lenovo) C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Dropbox, Inc.) C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Lenovo) C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\WerFault.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [307768 2009-11-15] ()
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [228744 2012-09-20] (Lenovo.)
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [60920 2013-05-29] (Lenovo Group Limited)
HKLM\...\Run: [DLPSP] => C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPSP.EXE [421016 2007-07-25] (Dell Inc.)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63376 2012-09-07] (Lenovo)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916592 2014-07-28] (Synaptics Incorporated)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [PWMTRV] => rundll32 "C:\Program Files (x86)\ThinkPad\Utilities\PWMTR64V.DLL",PwrMgrBkGndMonitor
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [111928 2013-05-03] (Intel Corporation)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] => C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840592 2015-04-30] (Adobe Systems Inc.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [730416 2015-06-09] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\Launcher\Avira.Systray.exe [130864 2015-05-21] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2015-04-14] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-20\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [AdobeBridge] => [X]
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Run: [Mobile Partner] => C:\Program Files (x86)\MobileWiFi\MobileWiFi
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\RunOnce: [DeleteMarkAny] => C:\Windows\SysWOW64\MASetupCleaner.exe [24576 2013-02-05] ((주)마크애니)
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\RunOnce: [Report] => \AdwCleaner\AdwCleaner[S2].txt [1249 2015-06-10] ()
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [SimpleSYN.NET] => C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe [2562352 2015-03-28] (creativbox.net, Torsten Leithold & Georg von Kries GbR)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [OfficeSyncProcess] => C:\Program Files\Microsoft Office\Office14\MSOSYNC.EXE [911032 2015-03-18] (Microsoft Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [CCleaner Monitoring] => C:\Program Files\CCleaner\CCleaner64.exe [8322328 2015-05-08] (Piriform Ltd)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [FileHippo.com] => C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe [2926800 2015-01-27] ()
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Run: [OneDrive] => C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-26] (Microsoft Corporation)
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.0.4041.0512\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4713.0209\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.4726.0226\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\RunOnce: [Uninstall C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5849.0427\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5849.0427\amd64"
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {1b0dc35a-0670-11e4-81aa-f0def15a0d0a} - G:\LG_PC_Programs.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {22791074-b1f6-11e4-8767-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4911ad02-b367-11e4-bf67-f0def15a0d0a} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4c47e6e6-b358-11e4-8ba9-806e6f6e6963} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {4c47e717-b358-11e4-8ba9-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {ac36bd99-61a7-11e3-ad0d-cc52af7c9255} - F:\DTLplus_Launcher.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\MountPoints2: {fb634da8-b69c-11e4-84e7-00a0c6000000} - G:\AutoRun.exe
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Control Panel\Desktop\\SCRNSAVE.EXE ->
HKU\S-1-5-18\Control Panel\Desktop\\SCRNSAVE.EXE ->
AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [167312 2015-02-25] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll => C:\Windows\SysWOW64\nvinit.dll [147576 2015-02-25] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli ACGina
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk [2013-01-15]
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2013-11-14]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.26.dll [2015-06-02] (Dropbox, Inc.)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
GroupPolicyUsers\S-1-5-21-3128309724-421563842-2291253580-1002\User: Group Policy Restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3128309724-421563842-2291253580-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3128309724-421563842-2291253580-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-16] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-16] (Oracle Corporation)
BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL [2013-12-19] (Microsoft Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper -> {AE7CD045-E861-484f-8273-0445EE161910} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: SmartSelect Class -> {F4971EE7-DAA0-4053-9964-665D8EE6A077} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2015-04-30] (Adobe Systems Incorporated)
Toolbar: HKU\S-1-5-21-3128309724-421563842-2291253580-1002 -> No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -  No File
DPF: HKLM-x32 {8FEFF364-6A5F-4966-A917-A3AC28411659} hxxp://download.easetuner.com/download/SOPCORE.CAB
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Sch_\AppData\Roaming\Mozilla\Firefox\Profiles\ckb2i04g.default-1386154641997
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-11] ()
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-16] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-16] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-02-15] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.2 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [2013-03-21] (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-11] ()
FF Plugin-x32: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2013-02-15] (Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-02-04] (NVIDIA Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-27] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-27] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.0.8 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.0 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-02-05] (VideoLAN)
FF Plugin-x32: Adobe Acrobat -> C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll [2013-03-21] (Adobe Systems)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-04-30] (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-16]
FF HKU\.DEFAULT\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12
FF Extension: ThinkVantage Password Manager - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12 [2015-06-10]
FF HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\Firefox\Extensions: [{F74D5734-46F5-4B16-96F0-1E7FBF41B750}] - C:\Program Files (x86)\Lenovo\Password Manager\PWM Firefox Extension\2.0b12

Chrome:
=======
CHR Profile: C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-04]
CHR Extension: (Google Drive) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-04]
CHR Extension: (YouTube) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-04]
CHR Extension: (Google Search) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-04]
CHR Extension: (Bookmark Manager) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmlllbghnfkpflemihljekbapjopfjik [2015-06-11]
CHR Extension: (Google Wallet) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-04]
CHR Extension: (Gmail) - C:\Users\Sch_\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-04]
CHR HKU\S-1-5-21-3128309724-421563842-2291253580-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - C:\Users\SCHNEI~1\AppData\Local\Google\Drive\apdfllckaahabafndbhieahigkjlhalf_live.crx [2014-08-14]
CHR HKU\S-1-5-21-3128309724-421563842-2291253580-1002\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [lmjegmlicamnimmfhcmpkclmigmmcbeh] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [lpdfbkehegfmedglgemnhbnpmfmioggj] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827184 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [450808 2015-06-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1188360 2015-06-09] (Avira Operations GmbH & Co. KG)
R2 Avira.ServiceHost; C:\Program Files (x86)\Avira\Launcher\Avira.ServiceHost.exe [208632 2015-05-21] (Avira Operations GmbH & Co. KG)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-05] (Dropbox, Inc.)
S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [134512 2015-06-05] (Dropbox, Inc.)
R2 DLPWD; C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLPWDNT.EXE [107928 2006-12-07] (Dell Inc.)
R2 DLSDB; C:\Program Files\Dell Printers\Additional Color Laser Software\Status Monitor\DLSDBNT.EXE [191896 2006-12-07] (Dell Inc.)
S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [319536 2015-04-17] (Lenovo.)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [351824 2013-02-06] ()
S3 Lenovo EasyPlus Hotspot; C:\Program Files (x86)\Common Files\LENOVO\easyplussdk\bin\EPHotspot64.exe [619776 2015-01-15] (Lenovo)
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 Mobile Broadband HL Service; C:\ProgramData\MobileBrServ\mbbservice.exe [239184 2014-02-15] ()
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 QDLService2kLenovo; C:\Program Files (x86)\QUALCOMM\QDLService2k\QDLService2kLenovo.exe [1688384 2011-05-23] (QUALCOMM, Inc.)
S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [49136 2015-05-15] ()
U2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 AndNetDiag; C:\Windows\System32\DRIVERS\lgandnetdiag64.sys [29184 2013-04-18] (LG Electronics Inc.)
S3 ANDNetModem; C:\Windows\System32\DRIVERS\lgandnetmodem64.sys [36352 2013-06-28] (LG Electronics Inc.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31920 2014-04-09] (Wondershare)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [153256 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132656 2015-06-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-11] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 qcfilterlno2k; C:\Windows\System32\DRIVERS\qcfilterlno2k.sys [6400 2011-05-23] (QUALCOMM Incorporated)
R3 qcusbnetlno2k; C:\Windows\System32\DRIVERS\qcusbnetlno2k.sys [444416 2011-05-23] (QUALCOMM Incorporated)
R3 qcusbserlno2k; C:\Windows\System32\DRIVERS\qcusbserlno2k.sys [231040 2011-05-23] (QUALCOMM Incorporated)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [45296 2014-07-28] (Synaptics Incorporated)
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-11 11:20 - 2015-06-11 11:21 - 00033176 _____ C:\Users\Schneider\Desktop\FRST.txt
2015-06-11 11:14 - 2015-06-11 11:14 - 00001379 _____ C:\Users\Sch_\Desktop\mbam.txt
2015-06-11 10:40 - 2015-06-11 10:41 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-11 10:40 - 2015-06-11 10:40 - 00001108 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2015-06-11 10:40 - 2015-06-11 10:40 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2015-06-11 10:40 - 2015-06-11 10:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware
2015-06-11 10:40 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-11 10:40 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-11 10:40 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-10 21:37 - 2015-06-10 21:37 - 00000207 _____ C:\Windows\tweaking.com-regbackup-SCH_-PC-Windows-7-Professional-(64-bit).dat
2015-06-10 21:37 - 2015-06-10 21:37 - 00000000 ____D C:\RegBackup
2015-06-10 18:37 - 2015-06-10 18:37 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Schneider\Desktop\mbam-setup-2.1.6.1022.exe
2015-06-10 18:37 - 2015-06-10 18:37 - 02943663 _____ (Thisisu) C:\Users\Schneider\Downloads\JRT.exe
2015-06-10 18:37 - 2015-06-10 18:37 - 02943663 _____ (Thisisu) C:\Users\Schneider\Desktop\JRT.exe
2015-06-10 18:36 - 2015-06-10 18:37 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Schneider\Downloads\mbam-setup-2.1.6.1022.exe
2015-06-10 18:17 - 2015-06-10 18:18 - 00442624 _____ C:\Windows\Minidump\061015-42557-01.dmp
2015-06-10 17:46 - 2015-06-10 17:47 - 02231296 _____ C:\Users\Schneider\Downloads\AdwCleaner_4.206.exe
2015-06-10 17:42 - 2015-06-10 17:42 - 00001270 _____ C:\Users\Sch_\Desktop\Revo Uninstaller.lnk
2015-06-10 17:41 - 2015-06-10 17:41 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Schneider\Downloads\revosetup95.exe
2015-06-10 17:41 - 2015-06-10 17:41 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Schneider\Desktop\revosetup95.exe
2015-06-10 16:43 - 2015-06-11 11:15 - 00001560 _____ C:\Windows\PFRO.log
2015-06-10 16:04 - 2011-01-14 08:23 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\umpo.dll
2015-06-10 16:00 - 2015-06-10 16:01 - 00011710 _____ C:\Windows\DPINST.LOG
2015-06-10 16:00 - 2015-06-10 16:01 - 00001464 _____ C:\Windows\Synaptics.log
2015-06-10 16:00 - 2015-06-10 16:00 - 00001577 _____ C:\Windows\Delfg.cmd
2015-06-10 16:00 - 2015-06-10 16:00 - 00000146 _____ C:\Windows\launchpw.cmd
2015-06-10 16:00 - 2015-06-10 16:00 - 00000006 _____ C:\Windows\systemtype.txt
2015-06-10 16:00 - 2014-07-28 12:25 - 00536304 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynCOM.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00461552 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\SynTP.sys
2015-06-10 16:00 - 2014-07-28 12:25 - 00224496 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPAPI.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00173808 _____ (Synaptics Incorporated) C:\Windows\system32\SynTPCo14.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00114416 _____ (Synaptics Incorporated) C:\Windows\SysWOW64\SynTPCOM.dll
2015-06-10 16:00 - 2014-07-28 12:25 - 00045296 _____ (Synaptics Incorporated) C:\Windows\system32\Drivers\Smb_driver_Intel.sys
2015-06-10 16:00 - 2014-05-16 14:56 - 04456520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc110u.dll
2015-06-10 16:00 - 2014-05-16 14:56 - 04423680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc110.dll
2015-06-10 16:00 - 2014-05-16 14:56 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110u.dll
2015-06-10 16:00 - 2014-05-16 14:56 - 00098304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfcm110.dll
2015-06-10 15:59 - 2015-06-10 16:00 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage
2015-06-10 15:57 - 2015-06-10 15:57 - 00003020 _____ C:\Windows\System32\Tasks\PMTask
2015-06-10 15:54 - 2015-06-10 15:54 - 00002057 _____ C:\Users\Public\Desktop\REACHit.lnk
2015-06-10 15:54 - 2015-06-10 15:54 - 00001673 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\REACHit Drive.lnk
2015-06-10 15:54 - 2015-06-10 15:54 - 00001673 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\REACHit Drive.lnk
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Windows\SysWOW64\REACHit
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\Lenovo
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default\AppData\Local\Downloaded Installations
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\Lenovo
2015-06-10 15:54 - 2015-06-10 15:54 - 00000000 ____D C:\Users\Default User\AppData\Local\Downloaded Installations
2015-06-10 15:53 - 2015-06-10 15:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo
2015-06-10 15:53 - 2015-06-10 15:53 - 00001053 _____ C:\Users\Public\Desktop\SHAREit.lnk
2015-06-10 15:46 - 2015-06-10 15:46 - 00000000 ____D C:\Users\Schneider\AppData\Local\Tvsukernel
2015-06-10 15:32 - 2015-06-10 15:32 - 12471264 _____ ( ) C:\Users\Schneider\Downloads\systemupdate506-05-15-2015.exe
2015-06-10 14:45 - 2015-06-10 14:45 - 00004274 _____ C:\Users\Schneider\Downloads\Kontoumsatz_vom_10062015.csv
2015-06-10 14:02 - 2015-06-10 14:02 - 00000000 ____D C:\Users\Sch_\AppData\Local\GWX
2015-06-10 10:59 - 2015-06-10 18:16 - 778307699 _____ C:\Windows\MEMORY.DMP
2015-06-10 10:59 - 2015-06-10 10:59 - 00265144 _____ C:\Windows\Minidump\061015-19765-01.dmp
2015-06-10 10:45 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 10:45 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 10:45 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 10:45 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 10:45 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 10:45 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 10:45 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 10:45 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 10:45 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 10:45 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 10:45 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 10:45 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 10:45 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 10:45 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 10:40 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 10:40 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 10:40 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 10:40 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 10:40 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 10:40 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 10:40 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 10:40 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 10:40 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 10:40 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 10:40 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 10:40 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 10:40 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 10:40 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 10:40 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 10:40 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 10:40 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 10:40 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 10:40 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 10:40 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 10:40 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 10:40 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 10:40 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 10:40 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 10:39 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 10:39 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 10:34 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 10:33 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 10:33 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 10:33 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 10:33 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 10:33 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 10:33 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 10:33 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 10:33 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 10:33 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 10:33 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 10:33 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 10:33 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 10:33 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 10:33 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 10:33 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 10:33 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 10:33 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 10:33 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 10:33 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 10:33 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 10:33 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 10:33 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 10:33 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 10:33 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 10:33 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 10:33 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 10:33 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 10:33 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 10:33 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 10:33 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 10:33 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 10:33 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 10:33 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 10:33 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 10:33 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 10:33 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 10:33 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 10:33 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 10:33 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 10:33 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 10:33 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 10:33 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 10:33 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 10:33 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 10:33 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 10:33 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 10:33 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 10:33 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 10:33 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 10:33 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 10:33 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 10:33 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 10:33 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 10:33 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 10:33 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 10:33 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 10:33 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 10:33 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 10:33 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 10:33 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 09:37 - 2015-06-10 09:37 - 00380416 _____ C:\Users\Schneider\Downloads\Gmer-19357.exe
2015-06-10 09:34 - 2015-06-11 11:21 - 00000000 ____D C:\FRST
2015-06-10 09:33 - 2015-06-10 09:33 - 02108928 _____ (Farbar) C:\Users\Schneider\Downloads\FRST64.exe
2015-06-10 09:33 - 2015-06-10 09:33 - 02108928 _____ (Farbar) C:\Users\Schneider\Desktop\FRST64.exe
2015-06-10 09:33 - 2015-06-10 09:33 - 00000000 _____ C:\Users\Sch_\defogger_reenable
2015-06-10 09:32 - 2015-06-10 09:32 - 00050477 _____ C:\Users\Schneider\Downloads\Defogger.exe
2015-06-10 09:21 - 2015-06-10 09:21 - 00059121 _____ C:\Users\Schneider\Desktop\Regression.xlsx
2015-06-09 15:02 - 2015-06-09 15:03 - 40301384 _____ C:\Users\Schneider\Downloads\Firefox Setup 38.0.6.exe
2015-06-09 15:01 - 2015-06-09 21:23 - 02678968 _____ C:\Users\Schneider\Desktop\Akquise .xlsx
2015-06-09 14:47 - 2015-06-09 14:47 - 18054744 _____ (Adobe Systems Inc.) C:\Users\Schneider\Downloads\AdobeAIRInstaller.exe
2015-06-09 13:17 - 2015-06-09 13:17 - 00025998 _____ C:\Users\Schneider\Downloads\FirmenadressenBSP.xlsx
2015-06-08 22:43 - 2015-06-08 22:44 - 01330371 _____ C:\Users\Schneider\Downloads\LA Open 2015.zip
2015-06-06 20:22 - 2015-06-06 20:22 - 00000000 ____D C:\Users\Schneider\AppData\Local\GWX
2015-06-05 23:00 - 2015-06-05 23:00 - 82771853 _____ C:\Users\Schneider\Downloads\nice slow cock massage - Pornhubcom.mp4.crdownload
2015-06-05 19:14 - 2015-06-05 19:14 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox
2015-06-05 19:13 - 2015-06-11 11:18 - 00001226 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job
2015-06-05 19:13 - 2015-06-11 11:16 - 00001222 _____ C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job
2015-06-05 19:13 - 2015-06-05 19:15 - 00000000 ____D C:\Program Files (x86)\Dropbox
2015-06-05 19:13 - 2015-06-05 19:13 - 00004222 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineUA
2015-06-05 19:13 - 2015-06-05 19:13 - 00003970 _____ C:\Windows\System32\Tasks\DropboxUpdateTaskMachineCore
2015-06-05 19:13 - 2015-06-05 19:13 - 00000000 ____D C:\Users\Schneider\AppData\Local\Dropbox
2015-06-05 19:13 - 2015-06-05 19:13 - 00000000 ____D C:\ProgramData\Dropbox
2015-06-05 14:15 - 2015-06-09 15:04 - 00001153 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2015-06-05 14:12 - 2015-06-05 14:15 - 51306608 _____ (Dropbox, Inc.) C:\Users\Schneider\Downloads\Dropbox 3.6.5.exe
2015-06-05 14:05 - 2015-06-05 14:05 - 00002032 _____ C:\Users\Public\Desktop\Adobe Acrobat X Pro.lnk
2015-06-05 12:08 - 2015-06-09 12:50 - 00011824 _____ C:\Users\Schneider\Desktop\CRM Entscheidungsmatrix.xlsx
2015-06-04 22:38 - 2015-06-04 22:38 - 16429971 _____ C:\Users\Schneider\Downloads\_exchange_picture_170372.zip
2015-06-04 19:45 - 2015-06-04 19:45 - 00000000 ____D C:\Users\Schneider\Desktop\NPS
2015-06-03 17:59 - 2015-06-03 17:59 - 00989511 _____ C:\Users\Schneider\Desktop\Präsentation1.pptx
2015-06-03 14:15 - 2015-06-03 14:15 - 00023552 _____ C:\Users\Schneider\Downloads\LISRELTrialData.xls
2015-06-03 14:09 - 2015-06-03 14:09 - 00002651 _____ C:\Users\Public\Desktop\LISREL 9.2 Student.lnk
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SSI, Inc
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\Program Files (x86)\LISREL9S
2015-06-03 14:09 - 2015-06-03 14:09 - 00000000 ____D C:\LISREL9 Student Examples
2015-06-03 14:07 - 2015-06-04 19:44 - 00000000 ____D C:\Users\Schneider\Desktop\Strukturgleichungsmodell
2015-06-02 15:07 - 2015-06-04 19:45 - 00000000 ____D C:\Users\Schneider\Desktop\IHK
2015-05-29 13:54 - 2015-06-03 10:12 - 00917243 _____ C:\Users\Schneider\Desktop\Alte_Prognosemodelle.pptx
2015-05-29 13:07 - 2015-06-05 19:13 - 00000000 ____D C:\Users\Sch_\AppData\Local\Dropbox
2015-05-29 13:04 - 2015-05-29 13:05 - 51079592 _____ (Dropbox, Inc.) C:\Users\Schneider\Downloads\Dropbox 3.6.4.exe
2015-05-28 13:24 - 2015-05-28 14:31 - 17791197 _____ C:\Users\Schneider\Downloads\PM Benchmarking v.11_aktuell.pptx
2015-05-27 12:14 - 2015-05-27 17:32 - 00039464 _____ C:\Users\Schneider\Downloads\Kontoumsatz_vom_27052015.xlsx
2015-05-27 00:17 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-05-13 14:48 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 14:48 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-13 11:41 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-13 11:41 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-13 11:40 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-13 11:40 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-13 11:40 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-13 11:40 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-13 11:39 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-13 11:39 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-13 11:39 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\apphelp.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\aelupsvc.dll
2015-05-13 11:39 - 2015-03-04 06:41 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\sdbinst.exe
2015-05-13 11:39 - 2015-03-04 06:41 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\shimeng.dll
2015-05-13 11:39 - 2015-03-04 06:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shimeng.dll
2015-05-13 11:39 - 2015-03-04 06:10 - 00295936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apphelp.dll
2015-05-13 11:39 - 2015-03-04 06:10 - 00020992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sdbinst.exe
2015-05-13 11:39 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-13 11:39 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 11:39 - 2015-01-29 05:19 - 02543104 _____ (Microsoft Corporation) C:\Windows\system32\wpdshext.dll
2015-05-13 11:39 - 2015-01-29 05:02 - 02311168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wpdshext.dll
2015-05-13 11:31 - 2015-05-13 11:31 - 00000000 ____D C:\Users\Schneider\AppData\Local\NVIDIA
2015-05-13 11:30 - 2015-05-13 11:30 - 00000000 ____D C:\Windows\SysWOW64\NV
2015-05-13 11:30 - 2015-05-13 11:30 - 00000000 ____D C:\Windows\system32\NV
2015-05-13 11:24 - 2015-02-04 02:00 - 00608072 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe
2015-05-13 11:19 - 2015-03-14 05:21 - 01632768 _____ (Microsoft Corporation) C:\Windows\system32\dwmcore.dll
2015-05-13 11:19 - 2015-03-14 05:21 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\dwmapi.dll
2015-05-13 11:19 - 2015-03-14 05:04 - 01372160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmcore.dll
2015-05-13 11:19 - 2015-03-14 05:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dwmapi.dll
2015-05-12 07:27 - 2015-05-12 07:27 - 00102376 _____ (Lenovo.) C:\Windows\system32\ibmpmsvc.exe
2015-05-12 07:27 - 2015-05-12 07:27 - 00074728 _____ (Lenovo.) C:\Windows\system32\ibmpmctl.exe
2015-05-12 07:27 - 2015-05-12 07:27 - 00063464 _____ (Lenovo.) C:\Windows\system32\Drivers\ibmpmdrv.sys
2015-05-12 07:27 - 2015-05-12 07:27 - 00042472 _____ (Lenovo.) C:\Windows\system32\tpinspm.dll

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-11 11:19 - 2013-01-17 17:09 - 00000000 ____D C:\Users\Schneider\Documents\Outlook-Dateien
2015-06-11 11:16 - 2013-01-15 23:42 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-06-11 11:16 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-11 11:15 - 2015-04-24 12:15 - 00006312 _____ C:\Windows\setupact.log
2015-06-11 11:15 - 2013-01-15 16:25 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-11 11:15 - 2009-07-14 07:37 - 00000000 ____D C:\Windows\DigitalLocker
2015-06-11 11:14 - 2015-02-01 23:12 - 00000000 ____D C:\Program Files (x86)\SRecorder
2015-06-11 11:14 - 2013-01-15 16:12 - 01374368 _____ C:\Windows\WindowsUpdate.log
2015-06-11 10:54 - 2015-04-26 19:47 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-11 10:48 - 2013-01-15 23:42 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-06-11 10:00 - 2013-02-04 18:26 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\SuperMailer
2015-06-11 09:55 - 2015-05-11 15:43 - 00000000 ____D C:\Users\Schneider\Desktop\diupp
2015-06-11 09:54 - 2015-04-26 19:47 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-11 09:54 - 2015-04-26 19:47 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-11 09:54 - 2015-04-26 19:47 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-11 09:53 - 2013-02-04 18:25 - 00000000 ____D C:\Program Files\SuperMailer
2015-06-11 09:51 - 2009-07-14 06:45 - 00026672 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-11 09:51 - 2009-07-14 06:45 - 00026672 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-11 09:47 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\WinBioDatabase
2015-06-11 09:12 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2015-06-10 18:41 - 2013-08-16 16:13 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\KeePass
2015-06-10 18:27 - 2014-09-16 10:04 - 00000000 ____D C:\AdwCleaner
2015-06-10 18:17 - 2013-04-18 09:50 - 00000000 ____D C:\Windows\Minidump
2015-06-10 17:50 - 2013-01-15 18:35 - 00000000 ____D C:\ProgramData\Lenovo
2015-06-10 17:42 - 2014-09-16 09:56 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2015-06-10 17:25 - 2014-12-05 00:27 - 00000000 ____D C:\Users\Schneider\Desktop\Desktop_Stuff
2015-06-10 16:43 - 2013-12-15 16:45 - 00000000 ____D C:\ProgramData\Avira
2015-06-10 16:37 - 2013-12-15 16:45 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-06-10 16:37 - 2013-12-15 16:45 - 00000000 ____D C:\Program Files (x86)\Avira
2015-06-10 16:37 - 2013-10-09 11:12 - 00000000 ____D C:\ProgramData\Package Cache
2015-06-10 16:00 - 2013-01-15 18:35 - 00000000 ___HD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2015-06-10 16:00 - 2013-01-15 16:21 - 00000000 ____D C:\Program Files (x86)\Lenovo
2015-06-10 16:00 - 2013-01-15 16:15 - 00000000 ____D C:\Program Files\Lenovo
2015-06-10 16:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\Help
2015-06-10 15:59 - 2013-01-15 16:36 - 00000000 ____D C:\Windows\System32\Tasks\Lenovo
2015-06-10 15:59 - 2013-01-15 16:35 - 00000000 ____D C:\Windows\Downloaded Installations
2015-06-10 15:57 - 2009-07-14 05:20 - 00000000 __RSD C:\Windows\Media
2015-06-10 15:54 - 2013-01-15 20:23 - 00000000 ____D C:\Users\Schneider\AppData\Local\Lenovo
2015-06-10 15:42 - 2013-03-05 10:28 - 00111008 _____ C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT
2015-06-10 15:34 - 2013-01-15 18:38 - 00000000 ____D C:\Windows\System32\Tasks\TVT
2015-06-10 13:46 - 2013-08-16 16:13 - 00046286 _____ C:\Users\Schneider\Desktop\volky.kdbx
2015-06-10 13:36 - 2009-07-14 12:57 - 00699682 _____ C:\Windows\system32\perfh007.dat
2015-06-10 13:36 - 2009-07-14 12:57 - 00149790 _____ C:\Windows\system32\perfc007.dat
2015-06-10 13:36 - 2009-07-14 07:13 - 01620684 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-10 13:30 - 2009-07-14 06:45 - 00427992 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-10 13:28 - 2014-12-10 12:09 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-10 13:28 - 2014-05-06 17:18 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-10 13:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-10 12:12 - 2013-01-16 00:23 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-10 12:09 - 2009-07-14 04:34 - 00000478 _____ C:\Windows\win.ini
2015-06-10 12:08 - 2013-08-11 17:49 - 00000000 ____D C:\Windows\system32\MRT
2015-06-10 12:02 - 2013-01-15 21:29 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 09:33 - 2013-01-15 16:12 - 00000000 ____D C:\Users\Sch_
2015-06-10 09:19 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2015-06-09 15:05 - 2013-01-16 02:38 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\Skype
2015-06-09 15:04 - 2014-02-21 11:01 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2015-06-09 15:04 - 2014-02-21 11:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-09 15:03 - 2014-12-21 13:08 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2015-06-09 11:29 - 2013-12-15 16:45 - 00153256 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-06-09 11:29 - 2013-12-15 16:45 - 00132656 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-06-08 22:50 - 2013-01-17 20:46 - 00000000 ____D C:\Users\Schneider\Documents\eXtremeGammon
2015-06-08 09:35 - 2013-03-12 18:49 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\Dropbox
2015-06-05 19:13 - 2013-03-12 18:49 - 00000000 ____D C:\Users\Sch_\AppData\Roaming\Dropbox
2015-06-05 14:15 - 2013-01-16 02:37 - 00000000 ____D C:\ProgramData\Skype
2015-06-05 14:05 - 2013-01-16 00:13 - 00002465 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat Distiller X.lnk
2015-06-05 14:05 - 2013-01-16 00:13 - 00002453 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Acrobat X Pro.lnk
2015-06-05 14:05 - 2013-01-16 00:13 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe LiveCycle ES2
2015-06-05 14:04 - 2014-09-26 09:41 - 00000000 ____D C:\Intel
2015-06-03 15:03 - 2013-01-15 20:23 - 00111008 _____ C:\Users\Schneider\AppData\Local\GDIPFONTCACHEV1.DAT
2015-06-02 11:37 - 2015-03-16 15:19 - 00000000 ____D C:\Users\Schneider\AppData\Local\CrashDumps
2015-06-01 15:08 - 2013-07-02 20:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2015-05-30 00:18 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-05-27 17:32 - 2014-02-22 00:51 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\vlc
2015-05-27 00:43 - 2013-01-15 23:42 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-27 00:43 - 2013-01-15 23:42 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-27 00:39 - 2014-04-08 10:25 - 00000000 ____D C:\Users\Sch_\AppData\Roaming\Notepad++
2015-05-27 00:39 - 2014-04-08 10:25 - 00000000 ____D C:\Program Files (x86)\Notepad++
2015-05-27 00:36 - 2013-11-22 13:10 - 00000000 ____D C:\Program Files\CCleaner
2015-05-27 00:10 - 2015-04-04 22:42 - 00000000 ___SD C:\Windows\SysWOW64\GWX
2015-05-27 00:10 - 2015-04-04 22:42 - 00000000 ___SD C:\Windows\system32\GWX
2015-05-26 23:45 - 2014-07-22 11:40 - 00002203 _____ C:\Users\Schneider\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-14 17:06 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-05-13 20:11 - 2009-07-14 13:21 - 00000000 ____D C:\Program Files\Windows Journal
2015-05-13 20:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\AdvancedInstallers
2015-05-13 14:47 - 2013-07-10 14:38 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-13 14:46 - 2013-07-10 14:36 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2015-05-13 14:46 - 2013-07-10 14:36 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 11:27 - 2013-12-12 22:04 - 01594964 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2015-05-13 11:24 - 2013-01-15 16:24 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2015-05-12 14:53 - 2015-01-07 16:07 - 00000000 ____D C:\Users\Schneider\AppData\Roaming\avidemux

==================== Files in the root of some directories =======

2015-04-24 13:28 - 2015-04-24 13:28 - 6103040 _____ () C:\Program Files (x86)\GUT3ED4.tmp
2013-01-15 23:48 - 2013-01-15 23:48 - 4096000 _____ () C:\Program Files (x86)\GUTC957.tmp
2013-10-09 11:24 - 2013-10-09 11:24 - 0000106 _____ () C:\ProgramData\Microsoft.SqlServer.Compact.400.64.bc

Some files in TEMP:
====================
C:\Users\Schneider\AppData\Local\Temp\avgnt.exe
C:\Users\Schneider\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp6yzwg8.dll
C:\Users\Sch_\AppData\Local\Temp\Quarantine.exe
C:\Users\Sch_\AppData\Local\Temp\sqlite3.dll
C:\Users\Sch_\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-03 12:37

==================== End of log ============================


volkyleo 11.06.2015 10:30

[CODE]Additional
FRST Logfile:
Code:

scan result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Sch_ at 2015-06-11 11:22:16
Running from C:\Users\Schneider\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3128309724-421563842-2291253580-500 - Administrator - Disabled)
Gast (S-1-5-21-3128309724-421563842-2291253580-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3128309724-421563842-2291253580-1008 - Limited - Enabled)
Schneider (S-1-5-21-3128309724-421563842-2291253580-1002 - Limited - Enabled) => C:\Users\Schneider
Sch_ (S-1-5-21-3128309724-421563842-2291253580-1000 - Administrator - Enabled) => C:\Users\Sch_
UpdatusUser (S-1-5-21-3128309724-421563842-2291253580-1001 - Limited - Enabled) => C:\Users\UpdatusUser

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (HKLM-x32\...\{AC76BA86-1033-F400-7760-000000000005}) (Version: 10.1.14 - Adobe Systems)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 18.0.0.144 - Adobe Systems Incorporated)
Adobe Bridge CC (64 Bit) (HKLM-x32\...\{359F8007-6486-429C-A8C5-D67F6897C88C}) (Version: 6.0 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.73.01 - )
Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.8.9046 - )
Avira (HKLM-x32\...\{0696cc37-db90-4000-be99-4a173ca7c8af}) (Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.39.17987 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.11.574 - Avira Operations GmbH & Co. KG)
Brother MFL-Pro Suite MFC-7360N (HKLM-x32\...\{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}) (Version: 1.0.9.0 - Brother Industries, Ltd.)
CCleaner (HKLM\...\CCleaner) (Version: 5.06 - Piriform)
Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Conexant 20585 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.95.48.50 - Conexant)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DataQualityTools (x32 Version: 4.1 - Thomas Hainke Dipl. Inform. Univ.) Hidden
Dell-Druckersoftware (HKLM-x32\...\{105F3CE5-FE55-408E-BF30-E78F85BA0B12}) (Version: 1.00.000 - Dell Inc.)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Dropbox (HKLM-x32\...\Dropbox) (Version: 3.6.5 - Dropbox, Inc.)
Dropbox Update Helper (x32 Version: 1.3.27.23 - Dropbox, Inc.) Hidden
Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 6.67.5 - Lenovo Group Limited)
eXtreme Gammon 2 (HKLM-x32\...\{2F5AF5E1-E021-4832-A423-EF480EC58A0B}_is1) (Version: 2.10 - GameSite 2000, Ltd.)
FileHippo App Manager (HKLM-x32\...\FileHippo.com) (Version:  - FileHippo.com)
FileZilla Packages (HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\FileZilla Packages) (Version:  - ) <==== ATTENTION
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Full Tilt Poker.Eu (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.30.43.WIN.FullTilt.EU - )
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
GNU Backgammon (Version 1_03_000, 20140804) (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\GNU Backgammon_is1) (Version:  - Free Software Foundation)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 43.0.2357.124 - Google Inc.)
Google Drive (HKLM-x32\...\{CBC9F5FD-5CFA-4A33-81CD-369EAB77E3A6}) (Version: 1.22.9403.0223 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
GridGammon 3.8.0 (Build 896) (HKLM-x32\...\GridGammon) (Version: 3.8.0 (Build 896) - Jensen-Barclay, LLC)
IBM SPSS Statistics 22 (HKLM\...\{104875A1-D083-4A34-BC4F-3F635B7F8EF7}) (Version: 22.0.0.0 - IBM Corp)
Integrated Camera Driver Installer Package Ver.1.1.0.48 (HKLM-x32\...\{C3CD17B4-08B0-492D-8A4C-81716D33E520}) (Version: 1.1.0.48 - RICOH)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.2.50.1050 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2253 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{D75AEB5B-FA18-4BD4-9EED-54CA46DB5AE8}) (Version: 13.04.0000 - Intel Corporation)
Java 8 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
KeePass Password Safe 2.29 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.29 - Dominik Reichl)
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.11 - )
Lenovo Battery Utility 2014 1.2 (HKLM-x32\...\{62D5A67D-E5CC-4D79-8998-DDFDB7750346}_is1) (Version: 1.2 - Lenovo Corp)
Lenovo Mobile Broadband Activation (HKLM-x32\...\{A95D9DF7-CF34-421A-A1DC-936A49A4DAEA}) (Version: 4.2.1003.00 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{6E6E7725-C7BC-4C39-8B3F-14B67331A120}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility (HKLM-x32\...\{A7BB9BBD-DFE4-4276-820A-7CD141FC09E6}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)
Lenovo Patch Utility 64 bit (HKLM\...\{1C83CB66-D345-4D6C-95A2-63A03269ADA0}) (Version: 1.3.0.007 - Lenovo Group Limited)
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.10.07 - )
Lenovo Solution Center (HKLM\...\{4041B18B-DE30-4D78-9D60-6ADC586C5E00}) (Version: 2.1.003.00 - Lenovo Group Limited)
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.06.0037 - Lenovo)
LG PC Suite (HKLM-x32\...\LG PC Suite) (Version: 5.3.06.20130913 - LG Electronics)
LG United Mobile Drivers (HKLM-x32\...\{55031CEF-CE75-4A5C-8DEA-60577820529B}) (Version: 3.10.1.0 - LG Electronics)
LISREL 9.2 for Windows (Student) (HKLM-x32\...\{1DDDDB1A-DBE8-449F-9016-819A423B5832}) (Version: 9.2 - SSI)
Malwarebytes Anti-Malware Version 2.1.6.1022 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.6.1022 - Malwarebytes Corporation)
Message Center Plus (HKLM\...\{C2C2DB64-1BCE-4FA7-962D-457795ECCEC0}) (Version: 3.3.0004.00 - Lenovo Group Limited)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Metric Collection SDK 35 (x32 Version: 1.2.0006.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (HKLM\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-Bit (HKLM\...\{95140000-007A-0407-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Hotmail Connector 64-bit (HKLM\...\{95140000-007A-0409-1000-0000000FF1CE}) (Version: 14.0.5118.5000 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 64-bit (HKLM\...\{95140000-007D-0409-1000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Mobile Broadband HL Service (HKLM-x32\...\Mobile Broadband HL Service) (Version: 22.001.25.00.03 - Huawei Technologies Co.,Ltd)
MobileWiFi (HKLM-x32\...\MobileWiFi) (Version: TOOL-ConnLaucher_WIN1.12.05.00 - Huawei Technologies Co.,Ltd)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 38.0.6 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 38.0.6 (x86 en-US)) (Version: 38.0.6 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 38.0.6 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.7.8.2 - Notepad++ Team)
Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)
Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)
NVIDIA 3D Vision Treiber 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 341.44 - NVIDIA Corporation)
NVIDIA Grafiktreiber 341.44 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 341.44 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.2.22.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.2.22.1 - NVIDIA Corporation)
Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version:  - Panda Security)
PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)
partypoker (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\PartyPoker) (Version:  - )
partypoker backgammon (HKU\S-1-5-21-3128309724-421563842-2291253580-1002\...\PartyGammon) (Version:  - )
PokerSnowie (HKLM-x32\...\PokerSnowie_is1) (Version:  - Snowie Games Ltd)
Qualcomm Gobi 2000 Package for Lenovo (HKLM-x32\...\{666C9123-1AEC-446F-8AA8-28256B1953D4}) (Version: 1.1.250 - QUALCOMM)
REACHit (HKLM-x32\...\{4532E4C5-C84D-4040-A044-ECFCC5C6995B}) (Version: 2.0.5.2 - Lenovo, Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
RICOH R5U230 Media Driver ver.2.06.02.02 (HKLM-x32\...\{022CBB38-CEF0-42BA-906A-A49BEFAE0BEE}) (Version: 2.06.02.02 - RICOH)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Scansoft PDF Professional (x32 Version:  - ) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (HKLM\...\{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{A3364707-2F53-4C83-8F68-C9877A9080C7}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition (Version:  - Microsoft) Hidden
SHAREit (HKLM-x32\...\SHAREit_is1) (Version: 2.1.15.0 - Lenovo Group Limited)
SimpleSYN 3.5  (HKLM-x32\...\{bd41baf4-c624-43d4-8770-50c80d735148}) (Version: 3.5.7528 - creativbox.net)
SimpleSYN 3.5  (Version: 3.5.7528 - creativbox.net) Hidden
Skype™ 7.5 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.5.102 - Skype Technologies S.A.)
SRecorder (HKLM-x32\...\SRecorder_is1) (Version: 2.0.0.0 - SRecorder Company)
SuperMailer 8.00 (HKLM\...\Newsletter Software SuperMailer (x64)_is1) (Version: 8.00 - Mirko Boeer Softwareentwicklungen)
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.3200 - Broadcom Corporation)
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.42 - )
ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.14 - )
ThinkPad Wireless LAN Adapter Software (HKLM-x32\...\{9D3D2C60-A55F-4fed-B2B9-17394396DF01}) (Version: 1.00.0029.8 - REALTEK Semiconductor Corp.)
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.24 - Lenovo)
ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 2.11.0.0 - Lenovo)
ThinkVantage GPS (HKLM-x32\...\{6DB21B2C-2BEF-44B4-B264-8EC2BC2369C6}) (Version: 2.81 - Lenovo)
ThinkVantage Password Manager (HKLM-x32\...\{70EE2BAA-F82A-4B8A-950E-649EFD64D5B9}) (Version: 4.70.2.0 - Lenovo Group Limited)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.77.0.9 - Lenovo)
UseNeXT by Tangysoft (HKLM-x32\...\UseNeXT by Tangysoft_is1) (Version:  - Tangysoft Ltd.)
Verizon Wireless Mobile Broadband Self Activation (HKLM-x32\...\{193CA6A6-E735-40B1-AA92-F611B291792C}) (Version: 3.2.2 - Smith Micro Software, Inc.)
VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)
VLC media player 2.1.3 (HKLM-x32\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Webinaria 2.0 (HKLM-x32\...\Webinaria_is1) (Version:  - Charlwood eMarketing)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430) (HKLM\...\DE7217D2A8B057F15EC6E52329FDAB84231521E8) (Version: 04/08/2010 6.3.5.430 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{ECD97DE5-3C8F-4ACB-AEEE-CCAB78F7711C}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Schneider\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll No File
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-3128309724-421563842-2291253580-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

03-06-2015 14:08:38 Installed LISREL 9.2 for Windows (Student).
05-06-2015 19:18:05 Windows Update
09-06-2015 14:38:32 Windows Update
10-06-2015 12:00:06 Windows Update
10-06-2015 15:33:14 Installed Lenovo System Update.
10-06-2015 15:53:39 Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {0F076846-17F4-4790-8E7C-6E1A2C3CC3A0} - System32\Tasks\Lenovo\Message Center Plus Launcher => C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe [2014-09-13] (Lenovo)
Task: {0F52BA4F-0907-4B16-89CA-A8CA8BCF3496} - System32\Tasks\FileHippo.com-Online-Aktualisierungsprogramm => C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
Task: {1A510C0A-3CA9-4FE6-940A-F4492E609F91} - System32\Tasks\Lenovo\REACHit Agent Startup => C:\Program Files (x86)\Lenovo\REACHit\webAgent.exe [2015-02-09] (Lenovo)
Task: {2395A7E6-2DAF-4DAC-86D8-20C9E7858D19} - System32\Tasks\{5B56D82C-92EE-4E0A-A65B-B66E40706CF6} => pcalua.exe -a C:\Users\Sch_\Downloads\AdobeAIRInstaller.exe -d C:\Users\Sch_\Downloads
Task: {2C18C0FC-6513-40C6-B33D-66456161598F} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2015-05-15] ()
Task: {2D5059EF-1694-41D2-AADF-3A9028E48403} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 35 => C:\Program Files (x86)\Lenovo\Customer Feedback Program 35\Lenovo.TVT.CustomerFeedback.Agent35.exe [2014-09-10] (Lenovo)
Task: {31D4F55C-4895-4A5B-83B9-E6027C20B0DC} - System32\Tasks\Lenovo\REACHit Agent Update => C:\Program Files (x86)\Lenovo\REACHit\webAgent.exe [2015-02-09] (Lenovo)
Task: {3DDABD6B-5547-4D91-BD0B-6F52AC00E458} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2013-02-15] (Microsoft Corporation)
Task: {52E4876B-8840-47EC-9BCF-42084E6525BA} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-06-05] (Dropbox, Inc.)
Task: {554E53B4-EDA5-4E16-9FF8-55D8D0E3CC6B} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {5B7AE85F-F880-473D-80B5-1FF6DE92EECF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-15] (Google Inc.)
Task: {65FED530-4B60-4111-9225-CDB26ADB39D6} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-01-15] (Google Inc.)
Task: {7D69B9DA-9F78-4E4E-ACE0-13931D9DAAC4} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-06-05] (Dropbox, Inc.)
Task: {7E515CBE-ADC0-4DC1-9396-7A35E3516E97} - System32\Tasks\Lenovo\LSC\RebootCountTask => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {824E4734-FD2D-4FD0-AE0C-8B1ED7F3B81E} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()
Task: {8FF45B59-652A-4B1E-9E4D-2DAEC463B475} - System32\Tasks\Lenovo\Lenovo Solution Center Launcher => C:\Program Files\lenovo\lenovo solution center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {A1A4BCA8-7F7A-493F-A9CA-08BDE9237A11} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {A3C128FE-30A7-493E-8C8D-05F46E5E6C84} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program => C:\Program Files\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2013-05-17] (Lenovo)
Task: {B29AAC44-ED1F-4DC4-802B-D61A66A336F9} - System32\Tasks\Lenovo\LSC\Time72Task => C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCService.exe [2013-05-17] (Lenovo)
Task: {B42B9487-3CBA-4116-ACE9-88A19C5DEF42} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {B4EC8C9C-866A-46DE-B28E-55BB3161F4C5} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: {D4728376-8DA0-427A-9C29-5EC0EE86A42A} - System32\Tasks\PMTask => C:\Program Files (x86)\ThinkPad\Utilities\PwmIdTsv.exe [2015-04-17] (Lenovo Group Limited)
Task: {D7EF94A7-C4AD-4C45-8099-CA623FBA5999} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-11] (Adobe Systems Incorporated)
Task: {D811E3DD-4A89-41F3-B793-23523544D5F7} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {DB3E32FF-DE22-4A97-928B-A892D14874A1} - System32\Tasks\Lenovo\LSC\LSCHardwareScan => C:\Program Files\Lenovo\Lenovo Solution Center\LSC.exe [2013-05-17] ()
Task: {E599D675-5D75-4874-85BA-AE0E81554F58} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2015-05-08] (Piriform Ltd)
Task: {E9A0B661-0ADD-4B3D-A81D-49E815F3DFFA} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {F1E46004-8F2D-485B-A88C-C942FB2A81B4} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)
Task: {F64ED8D7-C7CE-47BF-9725-D93BCD54CE50} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2010-10-19 14:39 - 2010-10-19 14:39 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2015-02-25 12:52 - 2015-02-25 12:52 - 00010952 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll
2013-01-15 22:14 - 2015-02-04 04:21 - 00115400 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2015-04-15 22:13 - 2015-04-15 22:13 - 00222720 _____ () C:\Program Files (x86)\Notepad++\NppShell_06.dll
2011-06-13 20:37 - 2011-06-13 20:37 - 00173344 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2011-09-06 16:34 - 2010-11-28 20:34 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\office14\Cultures\office.odf
2015-03-28 13:42 - 2015-03-28 13:42 - 00107312 _____ () C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.Engine.XmlSerializers.dll
2014-03-14 14:31 - 2014-03-14 14:31 - 00061752 _____ () C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.WCF.XmlSerializers.dll
2015-01-27 14:18 - 2015-01-27 14:18 - 02926800 _____ () C:\Program Files (x86)\FileHippo.com\FileHippo.AppManager.exe
2013-01-15 18:34 - 2015-04-17 06:07 - 00118272 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2013-02-06 08:10 - 2013-02-06 08:10 - 00351824 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2015-02-11 16:15 - 2014-02-15 08:59 - 00239184 _____ () C:\ProgramData\MobileBrServ\mbbservice.exe
2014-01-21 13:15 - 2005-04-22 06:36 - 00143360 ____R () C:\Windows\system32\BrSNMP64.dll
2012-09-06 20:18 - 2012-09-06 20:18 - 00086016 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2015-02-25 12:52 - 2015-02-25 12:52 - 00012104 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2015-04-30 00:16 - 2015-04-30 00:16 - 00019968 _____ () C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\locale\de_de\acrotray.deu

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3128309724-421563842-2291253580-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Sch_\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
HKU\S-1-5-21-3128309724-421563842-2291253580-1002\Control Panel\Desktop\\Wallpaper ->
DNS Servers: Media is not connected to internet.

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Adobe Acrobat Speed Launcher => "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe"
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: AdobeAAMUpdater-1.0 => "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
MSCONFIG\startupreg: ApowersoftScreenCapture => C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe /autoStart
MSCONFIG\startupreg: BCSSync => "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
MSCONFIG\startupreg: BrStsMon00 => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
MSCONFIG\startupreg: ControlCenter4 => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun
MSCONFIG\startupreg: Dropbox => "C:\Program Files (x86)\Dropbox\Client\Dropbox.exe" /systemstartup
MSCONFIG\startupreg: Google+ Auto Backup => "C:\Users\Sch_\AppData\Local\Programs\Google\Google+ Auto Backup\Google+ Auto Backup.exe" /autostart
MSCONFIG\startupreg: IndexSearch => "C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe"
MSCONFIG\startupreg: KeePass 2 PreLoad => "C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe" --preload
MSCONFIG\startupreg: NvBackend => "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
MSCONFIG\startupreg: PaperPort PTD => "C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe"
MSCONFIG\startupreg: PasswordManager => "C:\Program Files\Lenovo\Password Manager\password_manager.exe"
MSCONFIG\startupreg: PDF5 Registry Controller => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe
MSCONFIG\startupreg: PDFHook => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
MSCONFIG\startupreg: SRecorder => C:\Program Files (x86)\SRecorder\SRecorder.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{0177C179-5A17-4DC3-B7F3-4CA2E396168D}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{D5A40BBA-3515-4CB9-AC1B-D6A996211BDE}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
FirewallRules: [{B35DABEB-105A-4271-A8D8-5D98FE961F47}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{88A966CC-5EBF-4ECB-BA84-4EB0AB253802}C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [UDP Query User{247A6B68-1635-43AC-A4CF-83CFE8C40250}C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe] => (Allow) C:\users\schneider\appdata\roaming\dropbox\bin\dropbox.exe
FirewallRules: [{C2500268-171F-49B8-8AFB-469468D61094}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{B7744C75-B336-449B-80C5-838BFA32522A}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [TCP Query User{619C759E-E4F6-4D05-AEFA-9DD14DE2E5A2}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{364DFD2B-928E-441A-9F38-3173B14FF6AC}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [{9D80FF1E-6EF6-476D-A249-18A3B58E2C43}] => (Allow) C:\Program Files (x86)\Brother\Brmfl10f\FAXRX.exe
FirewallRules: [{E018E007-1CB5-46D4-87E8-822DEB1CE7CC}] => (Allow) C:\Program Files (x86)\Brother\Brmfl10f\FAXRX.exe
FirewallRules: [{F00692B4-B2C4-445D-8B0B-C79A61D93201}] => (Allow) LPort=54925
FirewallRules: [TCP Query User{99319B7C-37DB-4498-8DB0-373D0C469523}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [UDP Query User{09336A13-8ABA-4F12-A7D8-B2C971265816}C:\program files (x86)\sopcast\sopcast.exe] => (Allow) C:\program files (x86)\sopcast\sopcast.exe
FirewallRules: [{FE117F15-FCDE-4F57-A594-DBFDEC0886CB}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{7040AA9B-A43A-4F40-9FF5-D95F6C3B89F5}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{14ED3387-E667-4906-8FBE-95D2652107A8}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{FD2120EC-AAE4-46F1-AEA1-4EBCF6E5FF13}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{E45D337E-4545-423F-BCD5-D2AEE72B96A4}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{C1F24B9E-E2D0-4EF1-9494-8435F7A14672}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{B0D57C34-96BA-4B3E-B795-407158E1AC0A}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{7638B9C5-8675-4EF4-88AB-CEE3EC7A95F5}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{AD295283-7A34-42B0-8279-3A66C420A1D9}] => (Allow) C:\Program Files\creativbox.net\SimpleSYN\CBN.SimpleSYN.NET.exe
FirewallRules: [{6124F19C-1465-4430-A220-D6200989C37B}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{E5EEA0AE-B5FE-48C8-9529-4CF61BA2E3C6}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.com
FirewallRules: [{FE52A2E8-3B8D-4E86-ABE8-08FD31F94707}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{9FC99164-FCF5-4981-B726-0ACD37FA6C19}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\WinWrapIDE.exe
FirewallRules: [{E115D3DB-8CEA-49FE-8782-4B7FCEC1E00F}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [{58668C00-1FE6-4E90-A422-D1C50CFB59A1}] => (Allow) C:\Program Files\IBM\SPSS\Statistics\22\stats.exe
FirewallRules: [TCP Query User{5DE1D668-E486-44CB-ABEE-CE03FDE43835}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [UDP Query User{E8F22B0B-D2A4-42EE-9970-7572AF76041D}C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe] => (Allow) C:\program files\ibm\spss\statistics\22\jre\bin\javaw.exe
FirewallRules: [TCP Query User{441653E0-09D4-4255-B889-0C095D9629E0}C:\program files\ibm\spss\statistics\22\stats.exe] => (Allow) C:\program files\ibm\spss\statistics\22\stats.exe
FirewallRules: [UDP Query User{E96ABC1B-CCDE-4227-8035-8BCAF1BB0B71}C:\program files\ibm\spss\statistics\22\stats.exe] => (Allow) C:\program files\ibm\spss\statistics\22\stats.exe
FirewallRules: [{BC6D5EAC-2B23-4351-9F4B-7D745288C668}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{478E6377-6B9D-4BFF-A95B-C350E388330B}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{593992C3-F247-460D-B2AC-A2D546F89B9B}] => (Allow) C:\Users\Sch_\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [{145EEBA0-5E57-487F-9C77-4C3BC458977C}] => (Allow) C:\Users\Schneider\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{5E7F4C91-CC57-4891-8D2D-03791B99ECFE}C:\program files\microsoft office\office14\groove.exe] => (Block) C:\program files\microsoft office\office14\groove.exe
FirewallRules: [UDP Query User{D320306A-E334-40E4-B9B6-0487B1A48994}C:\program files\microsoft office\office14\groove.exe] => (Block) C:\program files\microsoft office\office14\groove.exe
FirewallRules: [{9C1843E9-C58C-43EA-B151-F5355B79CA6C}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro\Apowersoft Screen Recorder Pro.exe
FirewallRules: [{D8AD5A46-6223-4994-84A7-3ACC33B2D882}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Screen Recorder Pro\Apowersoft Screen Recorder Pro.exe
FirewallRules: [{CD78455F-A95F-4A5C-9881-E13F258914B0}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\VideoEditor.exe
FirewallRules: [{4EE8DD7F-5E4E-4B7F-B941-4A36AC918538}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\VideoEditor.exe
FirewallRules: [{7C7FD931-1293-4EA8-9DEC-FE8E00C83690}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\Updater.exe
FirewallRules: [{F83B214C-D8FB-46E9-82E1-F7C11B3539EE}] => (Allow) C:\Program Files (x86)\FlashIntegro\VideoEditor\Updater.exe
FirewallRules: [{8EED3E8E-22F6-4351-9AC3-61774226AD38}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{3E353B2C-4F01-41D3-97CA-E6755F4ABBAD}] => (Allow) LPort=2869
FirewallRules: [{981AC201-7A99-454B-BB59-58ACAE95A989}] => (Allow) LPort=1900
FirewallRules: [{9AC5B808-1CB2-4856-AEB5-400EDE36655B}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{992EA5EF-FC4C-4C53-8814-9ED7D0C5F4FC}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe
FirewallRules: [{3F8DC095-1F92-46C0-B62B-82891C82E8ED}] => (Allow) C:\Program Files\Lightworks\ntcardvt.exe
FirewallRules: [{81F38556-5395-4EE1-AB88-FB3F6694C9AD}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{EDDF0EFE-3669-4174-9EB7-07779F1CAA8D}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{555EBA7D-A3DA-4BC9-BFAB-C0DF5CBC38AE}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe
FirewallRules: [{0D2A86BA-2433-49F9-8A64-36F131C78D1B}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Capture\Apowersoft Free Screen Capture.exe
FirewallRules: [{FC82A0FF-96BF-4B79-AA65-D02FF388E73B}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{9CC77F6E-D172-40F6-9A58-B3FFBD2E47EB}] => (Allow) C:\Program Files (x86)\Apowersoft\Apowersoft Free Screen Recorder\Apowersoft Free Screen Recorder.exe
FirewallRules: [{08261FE2-45A6-427F-ADD4-160AC8C7A0AE}] => (Allow) C:\Users\Schneider\AppData\Local\Microsoft\OneDrive\OneDrive.exe
FirewallRules: [{12C2F115-32E5-44BA-8F39-0B6218940ECE}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe
FirewallRules: [{CB8F560E-3C39-4A79-9456-CDEF7E056208}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
FirewallRules: [{A5815DB5-9213-4E4F-BB04-4417B80AC197}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{1D40E93B-5087-4161-8E9A-9F76AA471E55}] => (Allow) C:\Program Files (x86)\Lenovo\System Update\uncserver.exe
FirewallRules: [{0417101C-BFDF-40C5-B8E1-65F39882A5C2}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe
FirewallRules: [{900EFFBA-462F-4EF3-987B-B180AE9D6C8C}] => (Allow) C:\Program Files (x86)\Lenovo\SHAREit\SHAREit.exe

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/11/2015 11:20:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: svchost.exe_WbioSrvc, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc3c1
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18869, Zeitstempel: 0x556366fd
Ausnahmecode: 0x80004004
Fehleroffset: 0x000000000000b3dd
ID des fehlerhaften Prozesses: 0x7a4
Startzeit der fehlerhaften Anwendung: 0xsvchost.exe_WbioSrvc0
Pfad der fehlerhaften Anwendung: svchost.exe_WbioSrvc1
Pfad des fehlerhaften Moduls: svchost.exe_WbioSrvc2
Berichtskennung: svchost.exe_WbioSrvc3

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=43, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=25, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=17, Autor-ID=9, Lieferant-ID=0, Lieferant-Typ=0

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=23, Autor-ID=8086, Lieferant-ID=0, Lieferant-Typ=0

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=21, Autor-ID=8086, Lieferant-ID=0, Lieferant-Typ=0

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Überspringen: Eap method DLL path Fehler bei der Überprüfung. Fehler: Type-ID=18, Autor-ID=8086, Lieferant-ID=0, Lieferant-Typ=0

Error: (06/10/2015 06:05:08 PM) (Source: VSS) (EventID: 12289) (User: )
Description: Volumeschattenkopie-Dienstfehler: Unerwarteter Fehler "DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 0000000000000138,0x0053c008,00000000001D8150,0,00000000002ED080,4096,[0])". hr = 0x80070079, Das Zeitlimit für die Semaphore wurde erreicht.
.


Vorgang:
  EndPrepareSnapshots wird verarbeitet

Kontext:
  Ausführungskontext: System Provider

Error: (06/10/2015 05:54:55 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\revouninstaller.exe Files (x86)\VS Revo Group\Revo Uninstaller\revouninstaller.exe"; Beschreibung = Revo Uninstaller's restore point - FileZilla Client 3.11.0.2; Fehler = 0x81000101).

Error: (06/10/2015 04:04:33 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\servicing\TrustedInstaller.exe; Beschreibung = Windows Modules Installer; Fehler = 0x80042313).


System errors:
=============
Error: (06/11/2015 11:21:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/11/2015 11:21:23 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/11/2015 11:21:00 AM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "Windows-Biometriedienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/11/2015 11:17:56 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "MBAMService" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (06/11/2015 11:17:56 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst MBAMService erreicht.

Error: (06/11/2015 11:17:19 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (06/11/2015 11:17:19 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (06/11/2015 09:30:59 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069

Error: (06/11/2015 09:30:59 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (06/11/2015 09:27:12 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


Microsoft Office:
=========================
Error: (06/11/2015 11:20:58 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: svchost.exe_WbioSrvc6.1.7600.163854a5bc3c1KERNELBASE.dll6.1.7601.18869556366fd80004004000000000000b3dd7a401d0a4273fc2cbfbC:\Windows\system32\svchost.exeC:\Windows\system32\KERNELBASE.dll2b0a886a-101b-11e5-ab76-00a0c6000000

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path43900

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path25900

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path17900

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path23808600

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path21808600

Error: (06/11/2015 11:20:03 AM) (Source: Microsoft-Windows-EapHost) (EventID: 2002) (User: NT-AUTORITÄT)
Description: Eap method DLL path18808600

Error: (06/10/2015 06:05:08 PM) (Source: VSS) (EventID: 12289) (User: )
Description: DeviceIoControl(\\?\Volume{cc3fea47-5f1c-11e2-b1ff-806e6f6e6963} - 0000000000000138,0x0053c008,00000000001D8150,0,00000000002ED080,4096,[0])0x80070079, Das Zeitlimit für die Semaphore wurde erreicht.


Vorgang:
  EndPrepareSnapshots wird verarbeitet

Kontext:
  Ausführungskontext: System Provider

Error: (06/10/2015 05:54:55 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Program Files (x86)\VS Revo Group\Revo Uninstaller\revouninstaller.exe Files (x86)\VS Revo Group\Revo Uninstaller\revouninstaller.exe"Revo Uninstaller's restore point - FileZilla Client 3.11.0.20x81000101

Error: (06/10/2015 04:04:33 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\servicing\TrustedInstaller.exeWindows Modules Installer0x80042313


==================== Memory info ===========================

Processor: Intel(R) Core(TM) i5 CPU M 480 @ 2.67GHz
Percentage of memory in use: 42%
Total physical RAM: 7987.67 MB
Available physical RAM: 4570.08 MB
Total Pagefile: 15973.54 MB
Available Pagefile: 12696.77 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:193.08 GB) (Free:42.08 GB) NTFS
Drive d: () (Fixed) (Total:94.07 GB) (Free:49.26 GB) NTFS
Drive e: (Lenovo_Recovery) (Fixed) (Total:9.77 GB) (Free:1.25 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298.1 GB) (Disk ID: 07628771)
Partition 1: (Active) - (Size=1.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=193.1 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=94.1 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=9.8 GB) - (Type=07 NTFS)

==================== End of log ============================

--- --- ---

Warlord711 11.06.2015 11:18

Hat das Deinstallieren von FileZilla Packages nicht geklappt ?

Zitat:

FileZilla Packages (HKU\S-1-5-21-3128309724-421563842-2291253580-1000\...\FileZilla Packages) (Version: - ) <==== ATTENTION

Bitte mit Revo (wie anfangs aufgeführt) deinstallieren !





Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

GroupPolicyUsers\S-1-5-21-3128309724-421563842-2291253580-1002\User: Group Policy Restriction detected <======= ATTENTION
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
emptytemp:


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




Danach, oder falls zwischendurch wieder ein Bluescreen auftritt:

Bitte lade dir die neuste Version von WhoCrashed auf deinen Computer: WhoCrashed Download
  • Installiere es
  • Starte es als Administrator
  • Klicke oben links auf den Button "Analyze"
  • Scrolle herunter, die Bereiche Crash Dump Analysis und Conclusion bitte ins Forum kopieren
Bitte poste dein Ergebnis zwischen Code-Tags

Wenn ein Log zu lange ist, teile ihn bitte auf mehrere Antworten.

volkyleo 12.06.2015 11:15

Hallo, ich hab jetzt alles durchgeführt. Ich hatte das Filezilla Package übersehen und hatte stattdessen Filezilla entfernt. Hab es jetzt mit Revo problemlos entfernt.

Beim ESET Scan hatte ich leider den ersten Scan ohne die Archiv-Prüfung durchgeführt. Deshalb habe ich 2 mal gescannt. Beim ersten Scan hatte er Sachen gefunden (siehe Logfile) beim zweiten Scan dann mit den richtigen Einstellungen nichts mehr. Sorry ...

Code:

Fix result of Farbar Recovery Scan Tool (x64) Version:08-06-2015
Ran by Sch_Business at 2015-06-11 12:45:03 Run:1
Running from C:\Users\Schneider\Desktop
Loaded Profiles: Sch_Business & UpdatusUser & Schneider (Available Profiles: Sch_Business & UpdatusUser & Schneider)
Boot Mode: Normal
==============================================

fixlist content:
*****************
GroupPolicyUsers\S-1-5-21-3128309724-421563842-2291253580-1002\User: Group Policy Restriction detected <======= ATTENTION
HKU\S-1-5-21-3128309724-421563842-2291253580-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
emptytemp:
*****************

C:\Windows\system32\GroupPolicyUsers\S-1-5-21-3128309724-421563842-2291253580-1002\User => moved successfully.
C:\Windows\system32\GroupPolicy\GPT.ini => moved successfully.
"HKU\S-1-5-21-3128309724-421563842-2291253580-1000\SOFTWARE\Policies\Microsoft\Internet Explorer" => key removed successfully
EmptyTemp: => 165.8 MB temporary data Removed.


The system needed a reboot..

==== End of Fixlog 12:45:09 ====

Code:

Results of screen317's Security Check version 1.002 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Avira Antivirus 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java version 32-bit out of Date!
 Adobe Flash Player 17.0.0.188 
 Mozilla Firefox (38.0.6)
 Google Chrome (43.0.2357.124)
 Google Chrome (43.0.2357.81)
````````Process Check: objlist.exe by Laurent```````` 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

Code:

ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=697c71c8c2354a42b33239c10aeb7a52
# end=init
# utc_time=2015-06-11 11:01:09
# local_time=2015-06-11 01:01:09 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24281
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=697c71c8c2354a42b33239c10aeb7a52
# end=updated
# utc_time=2015-06-11 11:07:40
# local_time=2015-06-11 01:07:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=697c71c8c2354a42b33239c10aeb7a52
# engine=24281
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-11 12:22:40
# local_time=2015-06-11 02:22:40 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 5828 185655210 0 0
# scanned=267890
# found=38
# cleaned=38
# scan_time=4500
sh=301D2B274C943B153C50B191ABC4F6CBAC9EBD0B ft=1 fh=b37ff355ff82ccc8 vn="Variante von MSIL/Toolbar.Linkury.M.gen evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\smia.exe.vir"
sh=24951A42C26425159CF1B31F66F067EB15EC7D22 ft=1 fh=0c07906b05095be5 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\sppsm.dll.vir"
sh=E044E7B0064DED7817B8B3C5FB5BA68433ECD973 ft=1 fh=1735ff76e2e0f193 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\spusm.dll.vir"
sh=054265382594BE05D86CFF3588D253E7D9DDC2CB ft=1 fh=84b96bedb35ba1b6 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srbs.dll.vir"
sh=78E6BF2EE1C0050559D191737650FCB85B59EDC0 ft=1 fh=3ff0ee62006dd2d9 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srbu.dll.vir"
sh=A6DEE8EFB44BF896C8E07667F5CDDD4D96571B8B ft=1 fh=2eaa3812cf903e3d vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srptc.dll.vir"
sh=1CE587751758296B41C4F58F569ACE3A7E69995E ft=1 fh=18eeaa88990c5ef8 vn="Variante von MSIL/Toolbar.Linkury.M.gen evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\srut.dll.vir"
sh=FE9EC7A22C4CE65A839E25D9633859698EAE1CC7 ft=1 fh=8982ae43d3d34dc1 vn="Variante von Win32/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\Resources\ntdis_32.dll.vir"
sh=4514CBEB39E29B9968CB22D249098E2A1B05C885 ft=1 fh=feb674e06fbf3db5 vn="Variante von Win64/Toolbar.Linkury.A.gen evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\LPT\Resources\ntdis_64.dll.vir"
sh=B769E896816BCCCA909BA712A993DE15021ED20A ft=1 fh=30d2e17a95811690 vn="Variante von Win32/Systweak.R evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\SuperEasy Software\Driver Updater\supereasydu.exe.vir"
sh=AD1BF4CF62786788C0440C060BCFBCA0A06A3188 ft=1 fh=a16c06f51dd861fe vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\sppsm.dll.vir"
sh=DDE17349886FC1A7D13E8D0F41D6A4CE5A394D01 ft=1 fh=c9bce873ebed2a5f vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\spusm.dll.vir"
sh=C7ACB89F4541A3F65D5CFE90B9004C6BFEC2C8FA ft=1 fh=9e66ceb26218c551 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\srbs.dll.vir"
sh=A635383BF892E60B0DE808B31A7E30FA1E98F92E ft=1 fh=1dc9762e5beb06d7 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\srbu.dll.vir"
sh=542C70B56113D6CB5A2FD51DAFA02FB3FDEE1917 ft=1 fh=9bb68e157a308082 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\srptc.dll.vir"
sh=542BFF23509A0078717DA1C3533BB01D2A50ADF4 ft=1 fh=bcc46a7eca536e19 vn="Variante von MSIL/Toolbar.Linkury.M.gen evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\srut.dll.vir"
sh=827BABFD4DD95A1E2B20F6C04B221CBFC25D49D6 ft=1 fh=e52d10822f527b5e vn="Variante von Win32/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\Resources\ntdis_32.dll.vir"
sh=10A12FA897B32ECE8962A4BE61D61FAE9F0528B9 ft=1 fh=a5fd307b2a7d5c6f vn="Variante von Win64/Toolbar.Linkury.A.gen evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\LPT\Resources\ntdis_64.dll.vir"
sh=B259A9B9B4BE9F714DF89106D353513B4EDB0D78 ft=1 fh=f8ef9f638f298490 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\Lrcnta.exe.vir"
sh=33224B3D1BBA5C2CE24A4E34DDC2C790D8E9A31C ft=1 fh=ead666245e64cdff vn="Variante von MSIL/Toolbar.Linkury.M.gen evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\smsp.dll.vir"
sh=BEDFB3D29E373B74434F03C20C729E573298437C ft=1 fh=38e22b291e012044 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\smta.dll.vir"
sh=445CE2C35CFA3E69223C6FBC4977BB71EA44C1B6 ft=1 fh=50756c2b03e83e74 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\smtu.dll.vir"
sh=6F2CF5D559C132552216BBAB4A7EAD039B3C354B ft=1 fh=d33429d7807f71d3 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\spbe.dll.vir"
sh=C5C79E290675D5661CCA2EAB9EE78EC7D2796046 ft=1 fh=810b3e2dfb050ba2 vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\spbl.dll.vir"
sh=AD1BF4CF62786788C0440C060BCFBCA0A06A3188 ft=1 fh=a16c06f51dd861fe vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\sppsm.dll.vir"
sh=DDE17349886FC1A7D13E8D0F41D6A4CE5A394D01 ft=1 fh=c9bce873ebed2a5f vn="Variante von MSIL/Toolbar.Linkury.G evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\spusm.dll.vir"
sh=C7ACB89F4541A3F65D5CFE90B9004C6BFEC2C8FA ft=1 fh=9e66ceb26218c551 vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\srbs.dll.vir"
sh=A635383BF892E60B0DE808B31A7E30FA1E98F92E ft=1 fh=1dc9762e5beb06d7 vn="Variante von MSIL/Toolbar.Linkury.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\srbu.dll.vir"
sh=1A08E05B5A128B54699B0F9E01F1555C73723657 ft=1 fh=ea33e6a58b6d597e vn="Variante von MSIL/Toolbar.Linkury.I evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\srpu.dll.vir"
sh=542BFF23509A0078717DA1C3533BB01D2A50ADF4 ft=1 fh=bcc46a7eca536e19 vn="Variante von MSIL/Toolbar.Linkury.M.gen evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\srut.dll.vir"
sh=70511E1DC237B11EB2DA47764E2F58D66884A8D4 ft=1 fh=8926dceffb73a01c vn="Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\amfclgbdpgndipgoegfpkkgobahigbcl\GoogleChromeRemotePlugin.dll.vir"
sh=857CC3345A3822AF53B1929B8A2BBCF72BB1391E ft=1 fh=acc9f12da781c207 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_26.dll.vir"
sh=0414957AE0D2B342AB58CA7C0DEB191EB252F689 ft=1 fh=513fca58ac50a90d vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_27.dll.vir"
sh=2A78FC37034AA9C58B1B2D47929D23620D62C657 ft=1 fh=3d7c65ead160cf01 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_28.dll.vir"
sh=D0E111B46081B7F29F5F97BBD27826BE7FF2D100 ft=1 fh=8fb3d533241ad012 vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_29.dll.vir"
sh=DA8A32C2FC62802F155C7B8DC2B3DFBB58672098 ft=1 fh=6e51ce951b902f0d vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_30.dll.vir"
sh=FA63E2B986E0D6F5312E74B7AFFF49030529B199 ft=1 fh=5eb8c17bce0f839a vn="Variante von Win32/Toolbar.Linkury.D evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Sch_Business\AppData\Local\Smartbar\Application\helperbar@helperbar.com\components\SmartbarFireFoxRemotePlugin_31.dll.vir"
sh=AF48C8AFE90C5609634816B263C6876A17A42CCB ft=1 fh=00888405c157c070 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="D:\Programme_Downloads_Installer\Installer_April_2014\SoftonicDownloader_fuer_usenext-by-tangysoft.exe"
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=697c71c8c2354a42b33239c10aeb7a52
# end=init
# utc_time=2015-06-12 07:36:45
# local_time=2015-06-12 09:36:45 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24293
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=697c71c8c2354a42b33239c10aeb7a52
# end=updated
# utc_time=2015-06-12 07:37:53
# local_time=2015-06-12 09:37:53 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=697c71c8c2354a42b33239c10aeb7a52
# engine=24293
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-12 09:24:54
# local_time=2015-06-12 11:24:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 6826 185730944 0 0
# scanned=267963
# found=0
# cleaned=0
# scan_time=6421

Anbei auch die Analyse von whocrashed:

Code:

Crash Dump Analysis
________________________________________

Crash dump directory: C:\Windows\Minidump

Crash dumps are enabled on your computer.

On Wed 10.06.2015 16:15:55 GMT your computer crashed
crash dump file: C:\Windows\Minidump\061015-42557-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x770AA)
Bugcheck code: 0x1000009F (0x4, 0x258, 0xFFFFFA8006C60B50, 0xFFFFF80004C1E510)
Error: CUSTOM_ERROR
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 10.06.2015 16:15:55 GMT your computer crashed
crash dump file: C:\Windows\memory.dmp
This was probably caused by the following module: ntkrnlmp.exe (nt!KeBugCheckEx+0x0)
Bugcheck code: 0x9F (0x4, 0x258, 0xFFFFFA8006C60B50, 0xFFFFF80004C1E510)
Error: DRIVER_POWER_STATE_FAILURE
Bug check description: This bug check indicates that the driver is in an inconsistent or invalid power state.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.



On Wed 10.06.2015 08:56:53 GMT your computer crashed
crash dump file: C:\Windows\Minidump\061015-19765-01.dmp
This was probably caused by the following module: ntoskrnl.exe (nt+0x748C0)
Bugcheck code: 0x9F (0x4, 0x258, 0xFFFFFA8006C61660, 0xFFFFF80004C1E510)
Error: DRIVER_POWER_STATE_FAILURE
file path: C:\Windows\system32\ntoskrnl.exe
product: Microsoft® Windows® Operating System
company: Microsoft Corporation
description: NT Kernel & System
Bug check description: This bug check indicates that the driver is in an inconsistent or invalid power state.
This appears to be a typical software driver bug and is not likely to be caused by a hardware problem.
The crash took place in the Windows kernel. Possibly this problem is caused by another driver that cannot be identified at this time.


________________________________________
Conclusion
________________________________________

3 crash dumps have been found and analyzed. No offending third party drivers have been found. Connsider using WhoCrashed Professional which offers more detailed analysis using symbol resolution. Also configuring your system to produce a full memory dump may help you.


Read the topic general suggestions for troubleshooting system crashes for more information.

Note that it's not always possible to state with certainty whether a reported driver is actually responsible for crashing your system or that the root cause is in another module. Nonetheless it's suggested you look for updates for the products that these drivers belong to and regularly visit Windows update or enable automatic updates for Windows. In case a piece of malfunctioning hardware is causing trouble, a search with Google on the bug check errors together with the model name and brand of your computer may help you investigate this further.


Warlord711 12.06.2015 12:39

Kannst du prüfen ob für deine Grafikkarte aktuellere Treiber vorhanden sind ?
353.06 sollten die aktuellsten sein, falls die GraKa das mitmacht.

Der/die Bluescreens sind durch Treiber verursacht, aber nicht klar erkennbar, welche.

Die ESET Logs haben anfangs nur die Quarantäne von AdwCleaner "entdeckt" ansonsten ist das Log sauber.

Du kannst bereits DelFix anwenden:

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.




Schau nach dem Treiber-Update, ob du einen BlueScreen provozieren kannst oder warte einige Tage ab, ob ein Bluescreen auftritt.

Dann schauen wir weiter, ok ?

volkyleo 12.06.2015 13:10

Danke für deine Hilfe. Ich werde den DelFix nachher anwenden.

Ich hab mal nach Treibern geschaut: im Gerätemanager gibt es 2 Grafikkarten:
Intel(R) HD Graphics mit Treiberversion 8.15.10.2253 vom 28.11.2010 und die NVIDIA NVS 3100M mit Treiberversion 9.18.13.4144 vom 03.02.2015.

Bei Lenovo hab ich das gefunden: hxxp://support.lenovo.com/us/en/downloads/ds013659 und bei NVIDIA das hier hxxp://www.nvidia.com/download/driverResults.aspx/84585/en-us. Sind das die richtigen? Keiner der Treiber hat deine Endung.

Wäre es möglich, dass du mir einen Link zum richtigen Treiber gibst, damit ich nichts falsch mache? Vielen Dank im Voraus.
Volker

hab grad selber nochmal gegoogelt und den von dir gemeinten Treiber gefunden. Danke !

Warlord711 12.06.2015 15:56

Hmm bei ner Optimus Karte, also Intel HD für 2d und NVS für 3d, bleib lieber doch bei den Herstellertreibern bzw. aktualisieer über die Lenovo Webseite bzw. Programme.

Hast du Lenovo System Update mal gestartet ob es neue Treiber gibt ?

volkyleo 16.06.2015 15:42

Hallo nochmal, sorry für die verspätete Rückmeldung. Ja, Lenovo System Update hatte ich laufen lassen und alle Treiber sind aktuell. Ich schau mal, wie es sich weiter entwickelt ... sonst frag ich halt noch mal einen Experten :)

Sind wir soweit eigentlich mit der Bereinigung fertig?

Wenn Ja, vielen Dank für deine Hilfe - es ist ein super Service, den ihr anbietet.

Warlord711 17.06.2015 07:46

Naja, selbsternannte Experten gibt es ja zu Hauf...

Ja, die Bereinigung ist durch.

Abschließend habe ich noch ein paar Tipps zur Absicherung deines Systems.

Ändere regelmäßig alle deine Passwörter, jetzt, nach der Bereinigung ist ein idealer Zeitpunkt dafür
  • verwende für jede Anwendung und jeden Account ein anderes Passwort
  • ändere regelmäßig dein Passwort, vor allem bei Onlinebanking oder deinem Emailpostfach ist dieses sehr wichtig
  • speichere keine Passwörter auf deinem PC, gib diese nicht an dritte weiter
  • ein sicheres Passwort besteht aus mindestens 8 Zeichen und beinhaltet Groß- und Kleinbuchstaben, Zahlen und Sonderzeichen
  • benutze keine Zahlen- oder Buchstabenkombinationen, ( zB 12345678, qwertzui) auch keine Zahlen oder Buchstabenmuster
  • verwende keine Passwörter die einen Bezug zu dir, deinem Wohnort, Familienmitglied oder Haustier (Geburtsdatum, Postleitzahl, Adresse, Name) haben

Ich kann gar nicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7 / 8 : Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti-Viren-Programm und zusätzlicher Schutz
  • Gehe sicher, dass du immer nur eine Anti-Viren Software installiert hast und dass diese auch up to date ist!
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demand Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion bietet zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • AdwCleaner
    Dieses Tool erkennt eine Vielzahl von Werbeprogrammen (Adware) und unerwünschten Programmen (PUPs).
    Starte das Tool einmal die Woche und lass es laufen. Sollte eine neue Version verfügbar sein, so wird dies angezeigt und du kannst dir die neueste Version direkt auf den Desktop downloaden.
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • WOT (Web of trust)
    Dieses AddOn warnt dich, bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser
Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Mozilla Firefox
  • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
  • NoScript
    Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt, wenn Du es bestätigst.
  • AdblockPlus
    Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
    Es spart außerdem Downloadkapazität.


Performance
  • Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
  • Halte dich fern von Registry Cleanern.
    Diese Schaden deinem System mehr als dass sie helfen. Hier ein englischer Link:
    Miekemoes Blogspot ( MVP )


Was du vermeiden solltest:
  • Klicke nicht auf alles, nur weil es dich dazu auffordert und schön bunt ist.
  • Verwende keine P2P oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie z.B. deinFoto.jpg.exe.
  • Lade keine Software von Softonic oder Chip herunter, da diese Installer oft mit Adware oder unerünschter Software versehen sind!



Nun bleibt mir nur noch dir viel Spaß beim sicheren Surfen zu wünschen... ... und vielleicht möchtest du ja das Trojaner-Board unterstützen oder Lob, Kritik und Wünsche loswerden?


Alle Zeitangaben in WEZ +1. Es ist jetzt 21:36 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131