Trojaner-Board - Win8.1 64bit / SysWow64: Adware oder Virus?

Hi,
irgendwie habens meine beiden PCs in letzter Zeit in sich:
Gestern der übliche Adware Scan meines Laptops mit dem ich auch Online-Banking mache und raus kam bei JRT, dass sich zwei schädliche Dateien im Ordner SysWow64 verstecken mit der Endung tmp. Hab leider das Log beim zweiten Scannen durch JRT überschrieben (...ohne Worte).

Hier die Logs, Gmer folgt noch im zweiten Post.

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 07:24 on 26/10/2015 (*****)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

Code:

Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version:25-10-2015 02

durchgeführt von ***** (Administrator) auf BENE-LAPTOP (26-10-2015 07:25:19)

Gestartet von C:\Users\*****\Desktop

Geladene Profile: ***** (Verfügbare Profile: *****)

Platform: Windows 8.1 (X64) Sprache: Deutsch (Deutschland)

Internet Explorer Version 11 (Standard-Browser: FF)

Start-Modus: Normal

Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
 

==================== Prozesse (Nicht auf der Ausnahmeliste) =================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe

(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe

(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe

(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe

(arvato digital services llc) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe

(Intel) C:\Program Files\Intel Corporation\Intel WiDi\BrcmSetSecurity.exe

(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\SUSSoundProxy.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe

(Motorola Solutions, Inc.) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe

(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe

(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe

() C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avpui.exe

(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe

(Panda Security) C:\Program Files (x86)\Panda USB Vaccine\USBVaccine.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient.exe

(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe

() C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe

(Cambridge Silicon Radio Limited) C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe

(Cambridge Silicon Radio Limited) C:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\igfxsrvc.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe

(Sony Corporation) C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe

(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VAIO Clip.exe

() C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe

(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe

(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAdmin.exe

(iolo technologies, LLC) C:\Program Files\Sony\VAIO Care\Iolo\ioloTools.exe

(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe
 
 

==================== Registry (Nicht auf der Ausnahmeliste) ===========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
 

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1321688 2013-08-23] (Realtek Semiconductor)

HKLM\...\Run: [CsrHCRPServer] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrHCRPServer.exe [1134288 2012-03-22] (Cambridge Silicon Radio Limited)

HKLM\...\Run: [CsrAudioguiCtrl] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrAudioguiCtrl.exe [511696 2012-03-22] (Cambridge Silicon Radio Limited)

HKLM\...\Run: [CsrSyncMLServer] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe [244944 2012-03-22] ()

HKLM\...\Run: [vksts] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\vksts.exe [25792 2012-03-22] (Cambridge Silicon Radio Limited)

HKLM\...\Run: [HarmonyUserStartup] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\HarmonyUserStartup.exe [39128 2012-03-22] (Cambridge Silicon Radio Limited)

HKLM\...\Run: [CSRHarmonySkypePlugin] => C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe [146656 2012-03-22] (Cambridge Silicon Radio Limited)

HKLM\...\Run: [TrayApplication] => C:\Program Files\CSR\CSR Harmony Wireless Software Stack\TrayApplication.exe [529616 2012-03-22] (Cambridge Silicon Radio Limited)

HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2234144 2014-01-21] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\nvspcap64.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [BTMTrayAgent] => rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll",TrayApp

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [3928264 2015-05-27] (Synaptics Incorporated)

HKLM-x32\...\Run: [PMBVolumeWatcher] => C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe [740376 2013-02-06] (Sony Corporation)

HKLM-x32\...\Run: [Intel AppUp(R) center] => C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [156000 2013-04-15] (Intel Corporation)

HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [IndexSearch] => C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PaperPort PTD] => C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PPort12reminder] => C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFHook] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDF5 Registry Controller] => C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)

HKLM-x32\...\Run: [Adobe Creative Cloud] => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe [2239376 2013-12-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [BlueStacks Agent] => C:\Program Files (x86)\BlueStacks\HD-Agent.exe [855768 2015-02-12] (BlueStack Systems, Inc.)

HKLM-x32\...\Run: [Andy] => C:\Program Files\Andy\HandyAndy.exe [907144 2015-02-03] ()

Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\Run: [SandboxieControl] => C:\Program Files\Sandboxie\SbieCtrl.exe [785416 2015-02-18] (Sandboxie Holdings, LLC)

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\Run: [ISUSPM] => C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\Run: [SecureBanking] => C:\Program Files (x86)\Machinecode Technologies\Secure Banking\SecureBanking.exe

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\MountPoints2: {675148c1-759d-11e3-be90-3c0771733ed8} - "D:\autorun.exe" 

AppInit_DLLs: C:\Windows\system32\nvinitx.dll => C:\Windows\system32\nvinitx.dll [168616 2013-12-19] (NVIDIA Corporation)

AppInit_DLLs: , C:\WINDOWS\system32\nvinitx.dll => C:\WINDOWS\system32\nvinitx.dll [168616 2013-12-19] (NVIDIA Corporation)

AppInit_DLLs-x32: C:\WINDOWS\SysWOW64\nvinit.dll => C:\WINDOWS\SysWOW64\nvinit.dll [141336 2013-12-19] (NVIDIA Corporation)

ShellIconOverlayIdentifiers: [ AccExtIco1] -> {AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll [2013-12-13] ()

ShellIconOverlayIdentifiers: [ AccExtIco2] -> {853B7E05-C47D-4985-909A-D0DC5C6D7303} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll [2013-12-13] ()

ShellIconOverlayIdentifiers: [ AccExtIco3] -> {42D38F2E-98E9-4382-B546-E24E4D6D04BB} => C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll [2013-12-13] ()

ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} =>  Keine Datei

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk [2015-02-19]

ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files (x86)\Secunia\PSI\psi_tray.exe (Secunia)
 

==================== Internet (Nicht auf der Ausnahmeliste) ====================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
 

Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{4FB7096D-F2CF-477B-BB47-5F390F6150AA}: [DhcpNameServer] 192.168.178.1

Tcpip\..\Interfaces\{910F0513-BDC5-4471-80C1-58B36AADF65E}: [DhcpNameServer] 192.168.178.1
 

Internet Explorer:

==================

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://sony13.msn.com/?pc=SEJB

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://vaioportal.sony.eu

SearchScopes: HKLM -> {2BFF1616-0464-4032-9E26-03633AC36B96} URL = hxxp://www.startseite24.net/?q={searchTerms}

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKU\S-1-5-21-3654942749-2469333359-1553951443-1002 -> {2BFF1616-0464-4032-9E26-03633AC36B96} URL = hxxp://www.startseite24.net/?q={searchTerms}

SearchScopes: HKU\S-1-5-21-3654942749-2469333359-1553951443-1002 -> {62A4A403-9F15-43EA-8646-C294E32A98B7} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-&_nkw={searchTerms}

BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_65\bin\ssv.dll [2015-10-25] (Oracle Corporation)

BHO: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab)

BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-25] (Oracle Corporation)

BHO-x32: PlusIEEventHelper Class -> {551A852F-39A6-44A7-9C13-AFBEC9185A9D} -> C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll [2009-02-06] (Zeon Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\ssv.dll [2015-10-25] (Oracle Corporation)

BHO-x32: Kaspersky Protection plugin -> {C66D064F-82FE-4E1A-B06A-B2490BA48B18} -> C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\jp2ssv.dll [2015-10-25] (Oracle Corporation)

Toolbar: HKLM - Kein Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  Keine Datei

Toolbar: HKLM - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab)

Toolbar: HKLM-x32 - Kaspersky Protection toolbar - {3507FA00-ADA2-4A02-99B9-51AD26CA9120} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\IEExt\ie_plugin.dll [2015-10-20] (AO Kaspersky Lab)

DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} hxxp://download.eset.com/special/eos/OnlineScanner.cab

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
 

FireFox:

========

FF ProfilePath: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\hcur0jbp.default

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_19_0_0_226.dll [2015-10-17] ()

FF Plugin: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-25] (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-25] (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin: @videolan.org/vlc,version=2.1.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.2.0 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)

FF Plugin: @videolan.org/vlc,version=2.2.1 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2015-04-16] (VideoLAN)

FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll [Keine Datei]

FF Plugin: adobe.com/AdobeAAMDetect_x86_64 -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect64.dll [2013-12-19] (Adobe Systems)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_19_0_0_226.dll [2015-10-17] ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-19] (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-19] (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\dtplugin\npDeployJava1.dll [2015-10-25] (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=11.65.2 -> C:\Program Files (x86)\Java\jre1.8.0_65\bin\plugin2\npjp2.dll [2015-10-25] (Oracle Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\Sony\MSS\3.8.130\npMcAfeeMss.dll [Keine Datei]

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.40728.0\npctrl.dll [2015-07-28] ( Microsoft Corporation)

FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-09-27] (Adobe Systems Inc.)

FF Plugin-x32: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Adobe\Adobe Creative Cloud\Utils\npAdobeAAMDetect32.dll [2013-12-19] (Adobe Systems)

FF Plugin-x32: adobe.com/AdobeExManDetect -> C:\Program Files (x86)\Adobe\Adobe Extension Manager CS6\npAdobeExManDetectX86.dll [Keine Datei]

FF Plugin HKU\S-1-5-21-3654942749-2469333359-1553951443-1002: intel.com/AppUp -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll [2013-04-15] (Intel)

FF Plugin HKU\S-1-5-21-3654942749-2469333359-1553951443-1002: intel.com/AppUpx64 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll [2013-04-15] (Intel)

FF SearchPlugin: C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\hcur0jbp.default\searchplugins\websuche.xml [2015-06-27]

FF Extension: NoScript - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\hcur0jbp.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2015-10-25]

FF Extension: Adblock Plus - C:\Users\*****\AppData\Roaming\Mozilla\Firefox\Profiles\hcur0jbp.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2015-09-25]

FF HKLM-x32\...\Firefox\Extensions: [light_plugin_D772DC8D6FAF43A29B25C4EBAA5AD1DE@kaspersky.com] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox

FF Extension: Kaspersky Protection - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\FFExt\light_plugin_firefox [2015-10-20] [ist nicht signiert]

FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] - C:\Program Files\McAfee\MSK => nicht gefunden
 

Chrome: 

=======

CHR HKLM\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka

CHR HKLM-x32\...\Chrome\Extension: [eahebamiopdhefndnmappcihfajigkka] - hxxps://chrome.google.com/webstore/detail/eahebamiopdhefndnmappcihfajigkka
 

==================== Dienste (Nicht auf der Ausnahmeliste) ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

R2 AVP16.0.0; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\avp.exe [194000 2015-09-05] (Kaspersky Lab ZAO)

R2 BrcmSetSecurity; C:\Program Files\Intel Corporation\Intel WiDi\BrcmSetSecurity.exe [101536 2013-05-28] (Intel)

R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) [Datei ist nicht signiert]

S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [409304 2015-02-12] (BlueStack Systems, Inc.)

R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [388824 2015-02-12] (BlueStack Systems, Inc.)

R2 BstHdUpdaterSvc; C:\Program Files (x86)\BlueStacks\HD-UpdaterService.exe [794328 2015-02-12] (BlueStack Systems, Inc.)

R2 BtSwitcherService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\BtSwitcherService.exe [64216 2012-03-22] (Cambridge Silicon Radio Limited)

R2 CSRBtAudioService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtAudioService.exe [465624 2012-03-22] (Cambridge Silicon Radio Limited)

R2 CsrBtOBEX-Dienst; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtOBEXService.exe [1041616 2012-03-22] (Cambridge Silicon Radio Limited)

R2 CsrBtService; C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrBtService.exe [825032 2012-03-22] (Cambridge Silicon Radio Limited)

R2 ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [413336 2015-08-26] ()

R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [Datei ist nicht signiert]

S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-19] (Intel Corporation)

R2 Intel(R) Wireless Bluetooth(R) 4.0 Radio Management; C:\Program Files (x86)\Intel\Bluetooth\ibtrksrv.exe [157128 2013-09-27] (Intel Corporation)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-19] (Intel Corporation)

S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1133880 2015-06-18] (Malwarebytes Corporation)

S3 McComponentHostServiceSony; C:\Program Files (x86)\Sony\MSS\3.8.130\McCHSvc.exe [235216 2013-10-16] (McAfee, Inc.)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [265936 2014-10-29] ()

S3 NetworkSupport; C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkSupport.exe [629336 2013-10-10] (Sony Corporation)

R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1593632 2014-01-21] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [16939296 2014-01-21] (NVIDIA Corporation)

R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)

R2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-02-06] (Sony Corporation)

R2 PSI_SVC_2_x64; c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe [336824 2010-11-30] (arvato digital services llc)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-08-23] (Realtek Semiconductor)

R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [175112 2015-02-18] (Sandboxie Holdings, LLC)

R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1363160 2014-11-28] (Secunia)

R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [765144 2014-11-28] (Secunia)

S3 USER_ESRV_SVC; C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe [413336 2015-08-26] ()

S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [972000 2013-01-06] (Sony Corporation)

S3 vssbrigde64; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\x64\vssbridge64.exe [144640 2015-07-08] (AO Kaspersky Lab)

R3 VUAgent; C:\Program Files\Sony\VAIO Update\vuagent.exe [1653272 2015-07-31] (Sony Corporation)

S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [366552 2015-07-07] (Microsoft Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2015-07-07] (Microsoft Corporation)

R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [3818704 2014-10-29] (Intel® Corporation)
 

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

S3 aswTap; C:\Windows\system32\DRIVERS\aswTap.sys [44640 2014-07-24] (The OpenVPN Project)

R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [122072 2015-02-12] (BlueStack Systems)

R3 BthA2DP; C:\Windows\system32\drivers\BthA2DP.sys [132608 2015-01-30] (Microsoft Corporation)

R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)

R3 btmaux; C:\Windows\system32\DRIVERS\btmaux.sys [132920 2013-04-23] (Motorola Solutions, Inc.)

R3 btmhsf; C:\Windows\system32\DRIVERS\btmhsf.sys [1386296 2013-08-19] (Motorola Solutions, Inc.)

R0 cm_km; C:\Windows\System32\DRIVERS\cm_km.sys [389816 2015-07-05] (Kaspersky Lab ZAO)

S3 CsrBtPort; C:\Windows\system32\DRIVERS\CsrBtPort.sys [2784968 2012-03-22] (Cambridge Silicon Radio Limited)

S3 csrpan; C:\Windows\system32\DRIVERS\csrpan.sys [39616 2012-03-22] (Cambridge Silicon Radio Limited)

S3 csrserial; C:\Windows\system32\DRIVERS\csrserial.sys [61128 2012-03-22] (Cambridge Silicon Radio Limited)

S3 csrusb; C:\Windows\System32\Drivers\csrusb.sys [47296 2012-03-22] (Cambridge Silicon Radio Limited)

S3 csrusbfilter; C:\Windows\System32\Drivers\csrusbfilter.sys [23752 2012-03-22] (Cambridge Silicon Radio Limited)

S3 csr_bthav; C:\Windows\system32\drivers\csrbthav.sys [99520 2012-03-22] (Cambridge Silicon Radio Limited)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)

S0 ebdrv; C:\Windows\System32\drivers\evbda.sys [3357024 2013-08-22] (Broadcom Corporation)

R3 ibtusb; C:\Windows\system32\DRIVERS\ibtusb.sys [117192 2013-09-27] (Intel Corporation)

R0 IntelHSWPcc; C:\Windows\System32\drivers\IntelPcc.sys [77992 2013-11-28] (Intel Corporation)

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [478392 2015-06-22] (Kaspersky Lab ZAO)

R0 klbackupdisk; C:\Windows\System32\DRIVERS\klbackupdisk.sys [53432 2015-06-06] (Kaspersky Lab ZAO)

R1 klbackupflt; C:\Windows\System32\DRIVERS\klbackupflt.sys [70512 2015-06-27] (Kaspersky Lab ZAO)

R2 kldisk; C:\Windows\system32\DRIVERS\kldisk.sys [68280 2015-06-06] (Kaspersky Lab ZAO)

S0 klelam; C:\Windows\System32\DRIVERS\klelam.sys [30328 2015-06-24] (Kaspersky Lab)

R3 klflt; C:\Windows\system32\DRIVERS\klflt.sys [181640 2015-10-20] (AO Kaspersky Lab)

R1 klhk; C:\Windows\system32\DRIVERS\klhk.sys [227512 2015-10-20] (AO Kaspersky Lab)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [925064 2015-10-20] (AO Kaspersky Lab)

R1 KLIM6; C:\Windows\system32\DRIVERS\klim6.sys [39608 2015-06-11] (Kaspersky Lab ZAO)

R3 klkbdflt; C:\Windows\system32\DRIVERS\klkbdflt.sys [41656 2015-06-06] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\system32\DRIVERS\klmouflt.sys [41656 2015-06-07] (Kaspersky Lab ZAO)

R1 klpd; C:\Windows\System32\DRIVERS\klpd.sys [41352 2015-09-26] (AO Kaspersky Lab)

R1 klwfp; C:\Windows\system32\DRIVERS\klwfp.sys [87944 2015-10-20] (Kaspersky Lab ZAO)

R1 Klwtp; C:\Windows\system32\DRIVERS\klwtp.sys [102584 2015-06-16] (Kaspersky Lab ZAO)

R1 kneps; C:\Windows\system32\DRIVERS\kneps.sys [187056 2015-06-23] (Kaspersky Lab ZAO)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2015-06-18] (Malwarebytes Corporation)

S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2015-06-18] (Malwarebytes Corporation)

R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)

R3 NETwNb64; C:\Windows\system32\DRIVERS\NETwbw02.sys [3482600 2014-11-06] (Intel Corporation)

S3 NETwNe64; C:\Windows\system32\DRIVERS\NETwew02.sys [3648480 2013-08-30] (Intel Corporation)

R3 nvvad_WaveExtensible; C:\Windows\system32\drivers\nvvad64v.sys [39200 2013-12-27] (NVIDIA Corporation)

R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2014-11-28] (Secunia)

R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [444632 2013-12-19] (Realsil Semiconductor Corporation)

R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [237064 2015-02-18] (Sandboxie Holdings, LLC)

R3 semav6msr64; C:\WINDOWS\system32\drivers\semav6msr64.sys [29352 2015-10-11] ()

S3 semav6thermal64ro; C:\WINDOWS\system32\drivers\semav6thermal64ro.sys [13792 2015-08-29] ()

R3 SensorsServiceDriver; C:\Windows\System32\drivers\WUDFRd.sys [226304 2014-10-29] (Microsoft Corporation)

R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [42696 2015-05-27] (Synaptics Incorporated)

R3 usb3Hub; C:\Windows\System32\drivers\usb3Hub.sys [206744 2013-05-28] (Windows (R) Win 7 DDK provider)

S3 WdBoot; C:\Windows\system32\drivers\WdBoot.sys [44560 2015-07-07] (Microsoft Corporation)

S3 WdFilter; C:\Windows\system32\drivers\WdFilter.sys [270168 2015-07-07] (Microsoft Corporation)

S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [114520 2015-07-07] (Microsoft Corporation)

S0 b06bdrv; System32\drivers\bxvbda.sys [X]

U4 klkbdflt2; \SystemRoot\system32\DRIVERS\klkbdflt2.sys [X]

S3 VBoxNetFlt; \SystemRoot\system32\DRIVERS\VBoxNetFlt.sys [X]
 

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 
 

==================== Ein Monat: Erstellte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-10-26 07:25 - 2015-10-26 07:25 - 00031475 _____ C:\Users\*****\Desktop\FRST.txt

2015-10-26 07:25 - 2015-10-26 07:25 - 00000000 ____D C:\FRST

2015-10-26 07:24 - 2015-10-26 07:24 - 00380416 _____ C:\Users\*****\Desktop\of3gspmf.exe

2015-10-26 07:24 - 2015-10-26 07:24 - 00000478 _____ C:\Users\*****\Desktop\defogger_disable.log

2015-10-26 07:24 - 2015-10-26 07:24 - 00000000 _____ C:\Users\*****\defogger_reenable

2015-10-26 07:23 - 2015-10-26 07:23 - 02197504 _____ (Farbar) C:\Users\*****\Desktop\FRST64.exe

2015-10-26 07:23 - 2015-10-26 07:23 - 00050477 _____ C:\Users\*****\Desktop\Defogger.exe

2015-10-25 22:58 - 2015-10-25 22:58 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bluetooth Devices

2015-10-25 22:55 - 2015-10-25 22:55 - 00000597 _____ C:\Users\*****\Desktop\JRT.txt

2015-10-25 22:15 - 2015-10-25 22:15 - 01798976 _____ (Malwarebytes) C:\Users\*****\Desktop\JRT.exe

2015-10-25 22:15 - 2015-10-25 22:15 - 01691648 _____ C:\Users\*****\Desktop\AdwCleaner_5.014.exe

2015-10-25 22:14 - 2015-10-25 22:14 - 04404952 _____ (Kaspersky Lab ZAO) C:\Users\*****\Desktop\tdsskiller.exe

2015-10-25 22:11 - 2015-10-25 22:11 - 00110176 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge-64.dll

2015-10-25 22:10 - 2015-10-25 22:10 - 00000000 ____D C:\Users\Default\AppData\Roaming\Sun

2015-10-25 22:10 - 2015-10-25 22:10 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Sun

2015-10-25 22:10 - 2015-10-25 22:10 - 00000000 ____D C:\Program Files\Java

2015-10-25 22:10 - 2015-10-25 22:10 - 00000000 _____ C:\WINDOWS\system32\REN2AE6.tmp

2015-10-25 22:09 - 2015-10-25 22:09 - 00000000 ____D C:\Program Files (x86)\Java

2015-10-19 13:28 - 2015-10-25 21:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2015-10-15 09:06 - 2015-09-19 04:18 - 00035384 _____ (Microsoft Corporation) C:\WINDOWS\system32\CompatTelRunner.exe

2015-10-15 09:06 - 2015-09-18 14:42 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll

2015-10-15 09:06 - 2015-09-18 14:42 - 01163776 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll

2015-10-15 09:06 - 2015-09-18 14:42 - 00766464 _____ (Microsoft Corporation) C:\WINDOWS\system32\generaltel.dll

2015-10-15 09:06 - 2015-09-18 14:42 - 00699904 _____ (Microsoft Corporation) C:\WINDOWS\system32\invagent.dll

2015-10-15 09:06 - 2015-09-18 14:42 - 00503296 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll

2015-10-15 09:06 - 2015-09-18 14:42 - 00073216 _____ (Microsoft Corporation) C:\WINDOWS\system32\acmigration.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00901264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ucrtbase.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00066400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-private-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00022368 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-math-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-string-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-convert-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-time-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-process-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-conio-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-utility-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-locale-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:42 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\api-ms-win-crt-environment-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00984448 _____ (Microsoft Corporation) C:\WINDOWS\system32\ucrtbase.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00063840 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-private-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00020832 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-math-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00019808 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-multibyte-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-string-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00017760 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-stdio-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00016224 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-runtime-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00015712 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-convert-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00014176 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-time-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00013664 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-filesystem-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-process-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-heap-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00012640 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-conio-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-utility-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-locale-l1-1-0.dll

2015-10-14 21:15 - 2015-08-22 14:35 - 00012128 _____ (Microsoft Corporation) C:\WINDOWS\system32\api-ms-win-crt-environment-l1-1-0.dll

2015-10-14 21:15 - 2015-08-07 22:40 - 01134752 _____ (Microsoft Corporation) C:\WINDOWS\system32\KernelBase.dll

2015-10-14 21:15 - 2015-08-07 22:40 - 00686960 _____ (Microsoft Corporation) C:\WINDOWS\system32\advapi32.dll

2015-10-14 21:15 - 2015-08-07 22:40 - 00507176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\advapi32.dll

2015-10-14 21:15 - 2015-08-07 15:13 - 00862720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KernelBase.dll

2015-10-14 21:15 - 2015-08-06 18:05 - 00669184 _____ (Microsoft Corporation) C:\WINDOWS\system32\hhctrl.ocx

2015-10-14 21:15 - 2015-08-06 17:47 - 04710400 _____ (Microsoft Corporation) C:\WINDOWS\system32\d2d1.dll

2015-10-14 21:15 - 2015-08-06 17:37 - 00536576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\hhctrl.ocx

2015-10-14 21:15 - 2015-08-06 17:18 - 04068352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d2d1.dll

2015-10-14 21:15 - 2015-07-16 19:58 - 00074752 _____ (Microsoft Corporation) C:\WINDOWS\system32\NcdAutoSetup.dll

2015-10-14 17:15 - 2015-09-29 13:31 - 07457624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe

2015-10-14 17:15 - 2015-09-29 13:31 - 01658536 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi

2015-10-14 17:15 - 2015-09-29 13:31 - 01519592 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe

2015-10-14 17:15 - 2015-09-29 13:31 - 01487008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi

2015-10-14 17:15 - 2015-09-29 13:31 - 01355848 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe

2015-10-14 17:15 - 2015-09-24 17:42 - 00348672 _____ (Microsoft Corporation) C:\WINDOWS\system32\bdesvc.dll

2015-10-14 17:15 - 2015-09-24 17:40 - 00737280 _____ (Microsoft Corporation) C:\WINDOWS\system32\fveapi.dll

2015-10-14 17:15 - 2015-09-10 19:02 - 25851392 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll

2015-10-14 17:15 - 2015-09-10 18:09 - 20358144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll

2015-10-14 17:15 - 2015-08-27 03:43 - 22372152 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll

2015-10-14 17:15 - 2015-08-27 03:42 - 19795904 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll

2015-10-14 17:15 - 2015-08-07 22:40 - 01736520 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll

2015-10-14 17:15 - 2015-08-07 22:40 - 01499920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll

2015-10-14 17:14 - 2015-09-29 13:29 - 00136904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe

2015-10-14 17:14 - 2015-09-28 19:45 - 03705344 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll

2015-10-14 17:14 - 2015-09-28 19:26 - 00409088 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll

2015-10-14 17:14 - 2015-09-28 19:25 - 00140288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuwebv.dll

2015-10-14 17:14 - 2015-09-28 19:25 - 00095744 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll

2015-10-14 17:14 - 2015-09-28 19:25 - 00035840 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapp.exe

2015-10-14 17:14 - 2015-09-28 19:22 - 00124928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuwebv.dll

2015-10-14 17:14 - 2015-09-28 19:22 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll

2015-10-14 17:14 - 2015-09-28 19:22 - 00029696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapp.exe

2015-10-14 17:14 - 2015-09-28 19:15 - 02243072 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll

2015-10-14 17:14 - 2015-09-28 19:13 - 00891904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll

2015-10-14 17:14 - 2015-09-28 19:12 - 00721920 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll

2015-10-14 17:14 - 2015-09-10 18:19 - 00585728 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll

2015-10-14 17:14 - 2015-09-10 18:18 - 02886656 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll

2015-10-14 17:14 - 2015-09-10 18:18 - 00088064 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll

2015-10-14 17:14 - 2015-09-10 18:14 - 05990400 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll

2015-10-14 17:14 - 2015-09-10 18:06 - 00616960 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieui.dll

2015-10-14 17:14 - 2015-09-10 18:04 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript.dll

2015-10-14 17:14 - 2015-09-10 17:51 - 00489984 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll

2015-10-14 17:14 - 2015-09-10 17:39 - 00504832 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll

2015-10-14 17:14 - 2015-09-10 17:37 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll

2015-10-14 17:14 - 2015-09-10 17:37 - 00064000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll

2015-10-14 17:14 - 2015-09-10 17:35 - 00315392 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll

2015-10-14 17:14 - 2015-09-10 17:33 - 02279936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll

2015-10-14 17:14 - 2015-09-10 17:28 - 01032704 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcomm.dll

2015-10-14 17:14 - 2015-09-10 17:28 - 00480256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieui.dll

2015-10-14 17:14 - 2015-09-10 17:27 - 00663552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript.dll

2015-10-14 17:14 - 2015-09-10 17:24 - 14456832 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll

2015-10-14 17:14 - 2015-09-10 17:21 - 00262144 _____ (Microsoft Corporation) C:\WINDOWS\system32\webcheck.dll

2015-10-14 17:14 - 2015-09-10 17:19 - 00801280 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll

2015-10-14 17:14 - 2015-09-10 17:19 - 00720896 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe

2015-10-14 17:14 - 2015-09-10 17:19 - 00374784 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll

2015-10-14 17:14 - 2015-09-10 17:17 - 02126336 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl

2015-10-14 17:14 - 2015-09-10 17:17 - 00416256 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll

2015-10-14 17:14 - 2015-09-10 17:07 - 00076288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll

2015-10-14 17:14 - 2015-09-10 17:05 - 00279040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll

2015-10-14 17:14 - 2015-09-10 17:02 - 04527616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll

2015-10-14 17:14 - 2015-09-10 17:01 - 00880128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcomm.dll

2015-10-14 17:14 - 2015-09-10 17:00 - 12853760 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll

2015-10-14 17:14 - 2015-09-10 16:57 - 02487808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll

2015-10-14 17:14 - 2015-09-10 16:57 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\webcheck.dll

2015-10-14 17:14 - 2015-09-10 16:55 - 02052608 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl

2015-10-14 17:14 - 2015-09-10 16:55 - 00689152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll

2015-10-14 17:14 - 2015-09-10 16:55 - 00327168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll

2015-10-14 17:14 - 2015-09-10 16:45 - 01546752 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll

2015-10-14 17:14 - 2015-09-10 16:34 - 00800768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll

2015-10-14 17:14 - 2015-09-10 16:31 - 02011136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll

2015-10-14 17:14 - 2015-09-10 16:27 - 01311232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll

2015-10-14 17:14 - 2015-09-10 16:26 - 00710144 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll

2015-10-11 21:18 - 2015-10-11 21:18 - 00000000 ____D C:\Program Files (x86)\ESET

2015-10-11 21:17 - 2015-10-11 21:17 - 02870984 _____ (ESET) C:\Users\*****\Desktop\esetsmartinstaller_deu.exe

2015-10-11 18:13 - 2015-10-11 18:13 - 00003142 _____ C:\WINDOWS\System32\Tasks\USER_ESRV_SVC

2015-10-11 18:13 - 2015-10-11 18:13 - 00002020 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care (Desktop).lnk

2015-10-11 18:13 - 2015-10-11 18:13 - 00001952 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Manual.lnk

2015-10-11 18:13 - 2015-10-11 18:13 - 00000000 __RHD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Care

2015-10-11 18:13 - 2015-10-11 18:12 - 00029352 _____ C:\WINDOWS\system32\Drivers\semav6msr64.sys

2015-10-11 18:13 - 2015-10-11 18:12 - 00010324 _____ C:\WINDOWS\system32\Drivers\semav6msr64.cat

2015-10-09 12:23 - 2015-10-09 12:23 - 00001302 _____ C:\Users\*****\Desktop\PC Inspector File Recovery.lnk

2015-10-09 12:23 - 2015-10-09 12:23 - 00000000 ____D C:\Users\*****\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Convar

2015-10-09 12:23 - 2015-10-09 12:23 - 00000000 ____D C:\Program Files (x86)\Convar

2015-10-03 00:31 - 2015-10-03 00:31 - 11526794 _____ C:\Users\*****\Desktop\18121.mp4

2015-10-01 14:26 - 2015-10-01 14:26 - 00074249 _____ C:\Users\*****\Desktop\CBS log.zip

2015-10-01 14:26 - 2015-09-30 15:45 - 01571136 _____ C:\Users\*****\Desktop\CBS.log

2015-09-27 13:44 - 2015-09-27 13:44 - 00000958 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk

2015-09-27 00:17 - 2015-09-27 00:38 - 00000000 ____D C:\Users\*****\Desktop\ball gute

2015-09-27 00:14 - 2015-09-27 00:50 - 00000000 ____D C:\Users\*****\Desktop\Ordner Ball
 

==================== Ein Monat: Geänderte Dateien und Ordner ========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
 

2015-10-26 07:24 - 2013-12-25 00:34 - 00000000 ____D C:\Users\*****

2015-10-26 07:21 - 2013-12-24 22:24 - 00003598 _____ C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3654942749-2469333359-1553951443-1002

2015-10-26 07:19 - 2013-12-25 00:53 - 00003954 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{13A65222-6059-41F8-9D0D-ECF4FFDE9549}

2015-10-26 07:16 - 2015-09-05 12:42 - 00000000 ____D C:\ProgramData\Kaspersky Lab

2015-10-26 07:16 - 2015-03-04 14:53 - 00121929 _____ C:\WINDOWS\setupact.log

2015-10-26 07:16 - 2013-12-25 00:45 - 00000000 __RDO C:\Users\*****\SkyDrive

2015-10-26 07:16 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\system32\sru

2015-10-25 23:03 - 2013-11-14 08:27 - 01776918 _____ C:\WINDOWS\system32\PerfStringBackup.INI

2015-10-25 23:03 - 2013-11-14 08:11 - 00765582 _____ C:\WINDOWS\system32\perfh007.dat

2015-10-25 23:03 - 2013-11-14 08:11 - 00159366 _____ C:\WINDOWS\system32\perfc007.dat

2015-10-25 23:01 - 2014-04-06 12:00 - 02053774 _____ C:\WINDOWS\WindowsUpdate.log

2015-10-25 22:58 - 2013-08-22 15:45 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT

2015-10-25 22:49 - 2015-06-16 19:38 - 00000000 ____D C:\AdwCleaner

2015-10-25 22:32 - 2015-05-21 18:04 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2015-10-25 22:20 - 2013-12-29 03:11 - 00000000 ____D C:\Program Files\Adobe

2015-10-25 22:11 - 2015-03-12 11:11 - 00011297 _____ C:\WINDOWS\SecuniaPackage.log

2015-10-25 22:11 - 2013-12-26 03:55 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2015-10-25 22:09 - 2013-12-26 04:04 - 00000000 ____D C:\Program Files (x86)\Adobe

2015-10-25 22:09 - 2013-12-24 22:13 - 00000000 ____D C:\Users\*****\AppData\Roaming\Adobe

2015-10-25 22:08 - 2013-12-09 14:34 - 00000000 ____D C:\ProgramData\Adobe

2015-10-25 22:07 - 2014-06-19 08:38 - 00000000 ____D C:\Users\*****\AppData\Local\Adobe

2015-10-25 22:06 - 2013-12-29 03:17 - 00000000 ____D C:\ProgramData\regid.1986-12.com.adobe

2015-10-25 21:58 - 2015-03-04 14:52 - 00519692 _____ C:\WINDOWS\PFRO.log

2015-10-25 21:58 - 2013-12-24 22:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2015-10-25 21:58 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\AppReadiness

2015-10-24 09:39 - 2014-01-06 16:15 - 00000000 ____D C:\Users\*****\AppData\Roaming\vlc

2015-10-22 21:19 - 2014-01-05 23:31 - 00000000 ____D C:\Users\*****\AppData\Roaming\Skype

2015-10-20 15:46 - 2013-08-22 16:36 - 00000000 ____D C:\WINDOWS\rescache

2015-10-20 11:46 - 2015-09-05 12:42 - 00925064 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klif.sys

2015-10-20 11:46 - 2015-09-05 12:42 - 00181640 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klflt.sys

2015-10-20 11:46 - 2015-06-26 22:58 - 00087944 _____ (Kaspersky Lab ZAO) C:\WINDOWS\system32\Drivers\klwfp.sys

2015-10-20 11:45 - 2015-07-04 01:18 - 00227512 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klhk.sys

2015-10-20 11:41 - 2012-07-26 08:59 - 00000000 ____D C:\WINDOWS\CbsTemp

2015-10-17 10:32 - 2015-05-21 18:04 - 00003772 _____ C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

2015-10-17 10:17 - 2013-08-22 14:25 - 00524288 ___SH C:\WINDOWS\system32\config\BBI

2015-10-16 23:36 - 2013-12-26 04:04 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2015-10-16 05:51 - 2013-08-22 16:38 - 00810488 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe

2015-10-16 05:51 - 2013-08-22 16:38 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl

2015-10-15 20:23 - 2014-12-18 20:10 - 00000000 ____D C:\WINDOWS\system32\appraiser

2015-10-15 20:23 - 2014-07-13 15:04 - 00000000 ___SD C:\WINDOWS\system32\CompatTel

2015-10-15 13:29 - 2014-06-19 09:20 - 00113880 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2015-10-15 08:56 - 2013-08-22 16:36 - 00000000 ___RD C:\WINDOWS\ToastData

2015-10-15 08:53 - 2013-12-24 23:08 - 00000000 ____D C:\WINDOWS\system32\MRT

2015-10-15 08:49 - 2013-12-24 23:08 - 143481208 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe

2015-10-14 17:05 - 2015-04-15 21:35 - 00000000 ___SD C:\WINDOWS\system32\GWX

2015-10-13 14:03 - 2015-01-07 18:47 - 00003886 _____ C:\WINDOWS\System32\Tasks\Adobe Acrobat Update Task

2015-10-13 14:02 - 2015-04-15 21:35 - 00000000 ___SD C:\WINDOWS\SysWOW64\GWX

2015-10-11 18:14 - 2013-12-24 22:25 - 00000000 ____D C:\Update

2015-10-11 18:13 - 2013-12-09 14:27 - 00000000 ____D C:\Program Files (x86)\Sony

2015-10-11 18:13 - 2013-12-09 13:52 - 00000000 ____D C:\Program Files\Sony

2015-09-27 15:03 - 2015-09-23 23:50 - 177783576 _____ C:\Users\*****\Desktop\Log Dateien.zip

2015-09-27 13:44 - 2013-12-09 14:27 - 00000000 ____D C:\WINDOWS\System32\Tasks\Sony Corporation

2015-09-27 13:44 - 2013-12-09 14:26 - 00000000 ____D C:\ProgramData\Sony Corporation

2015-09-27 13:44 - 2013-12-09 14:19 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2015-09-26 10:20 - 2015-06-08 18:43 - 00041352 _____ (AO Kaspersky Lab) C:\WINDOWS\system32\Drivers\klpd.sys

2015-09-26 10:20 - 2013-08-22 14:25 - 00262144 ___SH C:\WINDOWS\system32\config\ELAM
 

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
 

2014-07-25 11:00 - 2014-07-25 11:00 - 0000132 _____ () C:\Users\*****\AppData\Roaming\Adobe CS6-BMP-Format - Voreinstellungen

2014-01-09 19:21 - 2014-11-25 18:47 - 0000132 _____ () C:\Users\*****\AppData\Roaming\Adobe CS6-PNG-Format - Voreinstellungen

2015-02-18 22:21 - 2015-02-18 22:21 - 0740775 _____ () C:\ProgramData\AndyDrivers.zip

2013-12-25 00:32 - 2013-12-25 00:32 - 0000000 ____H () C:\ProgramData\DP45977C.lfl
 

Einige Dateien in TEMP:

====================

C:\Users\*****\AppData\Local\Temp\OpenOffice_4.1.1_Win_x86_install_de.exe

C:\Users\*****\AppData\Local\Temp\Quarantine.exe

C:\Users\*****\AppData\Local\Temp\SandboxieInstall.exe
 
 

==================== Bamital & volsnap =================
 

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
 

C:\WINDOWS\system32\winlogon.exe => Datei ist digital signiert

C:\WINDOWS\system32\wininit.exe => Datei ist digital signiert

C:\WINDOWS\explorer.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\explorer.exe => Datei ist digital signiert

C:\WINDOWS\system32\svchost.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\svchost.exe => Datei ist digital signiert

C:\WINDOWS\system32\services.exe => Datei ist digital signiert

C:\WINDOWS\system32\User32.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\User32.dll => Datei ist digital signiert

C:\WINDOWS\system32\userinit.exe => Datei ist digital signiert

C:\WINDOWS\SysWOW64\userinit.exe => Datei ist digital signiert

C:\WINDOWS\system32\rpcss.dll => Datei ist digital signiert

C:\WINDOWS\system32\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\SysWOW64\dnsapi.dll => Datei ist digital signiert

C:\WINDOWS\system32\Drivers\volsnap.sys => Datei ist digital signiert
 
 

LastRegBack: 2015-10-18 14:47
 

==================== Ende von FRST.txt ============================

Code:

Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version:25-10-2015 02

durchgeführt von ***** (2015-10-26 07:25:54)

Gestartet von C:\Users\*****\Desktop

Windows 8.1 (X64) (2013-12-24 23:44:00)

Start-Modus: Normal

==========================================================
 
 

==================== Konten: =============================
 

Administrator (S-1-5-21-3654942749-2469333359-1553951443-500 - Administrator - Disabled)

***** (S-1-5-21-3654942749-2469333359-1553951443-1002 - Administrator - Enabled) => C:\Users\*****

Gast (S-1-5-21-3654942749-2469333359-1553951443-501 - Limited - Disabled)
 

==================== Sicherheits-Center ========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
 

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Kaspersky Internet Security (Enabled - Up to date) {B41C7598-35F6-4D89-7D0E-7ADE69B4047B}

AS: Kaspersky Internet Security (Enabled - Up to date) {0F7D947C-13CC-4207-47BE-41AC12334EC6}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

FW: Kaspersky Internet Security (Enabled) {8C27F4BD-7F99-4CD1-5651-D3EB97674300}
 

==================== Installierte Programme ======================
 

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
 

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 19.0.0.213 - Adobe Systems Incorporated)

Adobe Creative Cloud (HKLM-x32\...\Adobe Creative Cloud) (Version: 2.3.0.322 - Adobe Systems Incorporated)

Adobe Flash Player 19 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 19.0.0.226 - Adobe Systems Incorporated)

Adobe Help Manager (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.13) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.13 - Adobe Systems Incorporated)

Adobe® Content Viewer (HKLM-x32\...\com.adobe.dmp.contentviewer) (Version: 3.3.0 - Adobe Systems Incorporated)

Age of Empires II - The Conquerors - 1.0e Patch FINAL (HKLM-x32\...\Age of Empires II - The Conquerors - 1.0e Patch FINAL_is1) (Version: 1.0e - tOrMeNtIuM/m0d)

Age of Empires II: HD Edition (HKLM-x32\...\Steam App 221380) (Version:  - Hidden Path Entertainment, Ensemble Studios)

Amazon Kindle (HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\Amazon Kindle) (Version:  - Amazon)

BlueStacks App Player (HKLM-x32\...\BlueStacks App Player) (Version: 0.9.13.5006 - BlueStack Systems, Inc.)

BlueStacks Notification Center (HKLM-x32\...\{AFB3E440-3705-45C5-9D00-C26A2F3A3D5C}) (Version: 0.9.13.5006 - BlueStack Systems, Inc.)

Brother MFL-Pro Suite MFC-J430W (HKLM-x32\...\{A1B36B88-AF90-43A3-8906-6DBEE89B4FBD}) (Version: 1.1.6.0 - Brother Industries, Ltd.)

CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform)

ChrisPC Win Experience Index 1.05 (HKLM-x32\...\{1116089C-14B5-1A23-8113-6124567ABCDE}_is1) (Version:  - Chris P.C. srl)

Corel Painter 12 - IPM (Version: 12.4 - Corel Corporation) Hidden

Corel Painter 12 (HKLM\...\_{08A8CCEA-36DC-4634-AAAA-79463D644C0E}) (Version: 12.0.1.914 - Corel Corporation)

CSR Harmony Wireless Software Stack (HKLM\...\{17DEA095-8EE1-49A2-AC5A-9663DB098FA9}) (Version: 2.1.63.0 - CSR Plc.)

Einstellungen für VAIO Media Server (HKLM\...\{62A172B2-550E-499D-9A82-5190D18390AA}) (Version: 1.1.0.02220 - Sony Corporation)

ESDL (x32 Version: 1.0.0 - Sony Corporation) Hidden

ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version:  - )

FDUx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden

FotoPremio Gestaltungssoftware (HKLM-x32\...\{159618E2-96F1-4DD2-ADCE-B94BA7989DE7}}_is1) (Version: 3.5.9.0 - Foto Online Service GmbH)

GameRanger (HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\GameRanger) (Version:  - GameRanger Technologies)

GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden

IconHandler 64 bit (Version: 2.0 - Corel Corporation) Hidden

Intel AppUp(R) center (HKLM-x32\...\Intel AppUp(R) center 43953) (Version: 3.9.0.43953.7 - Intel)

Intel Collaborative Processor Performance Control (HKLM-x32\...\0E7DAF70-FB54-4B91-B192-7E771C25AEEB) (Version: 1.0.0.1015 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.3.1520 - Intel Corporation)

Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3304 - Intel Corporation)

Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1335.5) (HKLM\...\{302600C1-6BDF-4FD1-1307-148929CC1385}) (Version: 3.1.1307.0362 - Intel Corporation)

Intel(R) WiDi (HKLM\...\{90621A56-901E-417D-A8CB-E8E3A6793C29}) (Version: 4.1.19.0 - Intel Corporation)

Intel® PROSet/Wireless Software (HKLM-x32\...\{c78a13fd-4324-4ddb-a613-746d2461441d}) (Version: 17.13.1 - Intel Corporation)

Java 8 Update 65 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418065F0}) (Version: 8.0.650.17 - Oracle Corporation)

Java 8 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218065F0}) (Version: 8.0.650.17 - Oracle Corporation)

Kaspersky Internet Security (HKLM-x32\...\InstallWIX_{77E7AE5C-181C-4CAF-ADBF-946F11C1CE26}) (Version: 16.0.0.614 - Kaspersky Lab)

Kaspersky Internet Security (x32 Version: 16.0.0.614 - Kaspersky Lab) Hidden

Malwarebytes Anti-Malware Version 2.1.8.1057 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.1.8.1057 - Malwarebytes Corporation)

Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version:  - )

Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version:  - )

Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)

Microsoft Office Word Viewer 2003 (HKLM-x32\...\{90850407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40728.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)

Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation)

Microsoft XNA Framework Redistributable 4.0 (HKLM-x32\...\{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}) (Version: 4.0.20823.0 - Microsoft Corporation)

Mozilla Firefox 41.0.2 (x86 de) (HKLM-x32\...\Mozilla Firefox 41.0.2 (x86 de)) (Version: 41.0.2 - Mozilla)

Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 41.0.2.5765 - Mozilla)

MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)

MusicBee 2.2 (HKLM-x32\...\MusicBee) (Version: 2.2 - Steven Mayall)

Nuance PaperPort 12 (HKLM-x32\...\{6C0A559F-8583-4B5A-8B50-20BEE15D8E64}) (Version: 12.1.0000 - Nuance Communications, Inc.)

Nuance PDF Viewer Plus (HKLM-x32\...\{28656860-4728-433C-8AD4-D1A930437BC8}) (Version: 5.30.3290 - Nuance Communications, Inc)

NVIDIA GeForce Experience 1.8.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8.2 - NVIDIA Corporation)

NVIDIA Grafiktreiber 332.21 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 332.21 - NVIDIA Corporation)

NVIDIA PhysX-Systemsoftware 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)

NVIDIA Virtual Audio 1.2.20 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.20 - NVIDIA Corporation)

NXPProximityInstaller (HKLM-x32\...\NXPProximityInstaller) (Version: 6.5.2.0 - NXP Semiconductors)

OpenOffice 4.1.1 (HKLM-x32\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)

Painter 12 - Content (Version: 12.4 - Corel Corporation) Hidden

Painter 12 - Core (Version: 12.4 - Corel Corporation) Hidden

Painter 12 - Corex64 (Version: 12.1.1 - Corel Corporation) Hidden

Painter 12 - DE (Version: 12.4 - Corel Corporation) Hidden

Painter 12 - EN (Version: 12.4 - Corel Corporation) Hidden

Painter 12 - FR (Version: 12.4 - Corel Corporation) Hidden

Painter 12 - IT (Version: 12.4 - Corel Corporation) Hidden

Painter 12 - Setup Files (Version: 12.1.1 - Corel Corporation) Hidden

Panda USB Vaccine 1.0.1.4 (HKLM-x32\...\{55A41219-9B22-4098-BAE7-AE289B3C569A}_is1) (Version:  - Panda Security)

PaperPort Image Printer 64-bit (HKLM\...\{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}) (Version: 1.00.0001 - Nuance Communications, Inc.)

Pixum Fotobuch (HKLM-x32\...\Pixum Fotobuch) (Version: 5.1.7 - CEWE Stiftung u Co. KGaA)

PlayMemories Home (HKLM-x32\...\{1E5C7043-09C5-4974-A69F-A5271FD82BBC}) (Version: 7.0.02.14060 - Sony Corporation)

Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9600.21243 - Realtek Semiconductor Corp.)

Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.15.410.2013 - Realtek)

Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7016 - Realtek Semiconductor Corp.)

Restore (x32 Version: 1.0.0 - Sony Corporation) Hidden

Sandboxie 4.16 (64-bit) (HKLM\...\Sandboxie) (Version: 4.16 - Sandboxie Holdings, LLC)

Scansoft PDF Professional (x32 Version:  - ) Hidden

SeaTools for Windows 1.4.0.2 (HKLM-x32\...\SeaTools for Windows) (Version: 1.4.0.2 - Seagate Technology)

Secunia PSI (3.0.0.10004) (HKLM-x32\...\Secunia PSI) (Version: 3.0.0.10004 - Secunia)

Shared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)

SHIELD Streaming (Version: 1.7.306 - NVIDIA Corporation) Hidden

Skype™ 7.8 (HKLM-x32\...\{6A0549A9-1B96-498C-ACBC-3943001FEB19}) (Version: 7.8.102 - Skype Technologies S.A.)

SSDlife Free (HKLM-x32\...\{01005A18-DD20-4D81-9AB3-E2B870FE491F}) (Version: 2.3.54 - BinarySense Inc.)

SSLx64 (Version: 1.0.0 - Sony Corporation ) Hidden

SSLx86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden

StarMoney (x32 Version: 4.0.7.94 - StarFinanz) Hidden

Steam (HKLM-x32\...\Steam) (Version:  - Valve Corporation)

Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 19.0.5.0 - Synaptics Incorporated)

System Requirements Lab for Intel (HKLM-x32\...\{53C63F43-B827-42D9-8886-4698D91EA33B}) (Version: 4.5.15.0 - Husdawg, LLC)

VAIO BIOS Data Transfer Utility (x32 Version: 1.0.0.02050 - Sony Corporation) Hidden

VAIO Care (HKLM\...\{036400BD-B717-4D50-ACDC-96480C99EDD3}) (Version: 8.4.4.09186 - Sony Corporation)

VAIO Care Recovery (HKLM\...\{15B9204E-BA09-485E-8F2C-094AC0077664}) (Version: 1.1.2.13230 - Sony Corporation)

VAIO Care-Hardwarediagnose-Plugin (HKLM-x32\...\{EC153498-00E1-4C9C-89BE-81527C6750BE}) (Version: 4.11.1.11210 - Sony Corporation)

VAIO Control Center (HKLM-x32\...\{8E797841-A110-41FD-B17A-3ABC0641187A}) (Version: 6.3.8.13060 - Sony Corporation)

VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.11.0.13250 - Sony Corporation)

VAIO Easy Connect (x32 Version: 8.4.4.07220 - Sony Corporation) Hidden

VAIO Sample Music (HKLM-x32\...\{FBEE3D44-0933-4B84-BB6A-49957F89187F}) (Version: 1.0.0.03051 - Sony Corporation)

VAIO Touch Search (HKLM\...\{F792DDDD-71C8-419E-AE05-46B0CDB1BEC8}) (Version: 1.1.0.1511 - Sony Corporation)

VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 7.1.0.08060 - Sony Corporation)

VAIO*CPU-Lüfterdiagnose (HKLM-x32\...\{BCE6E3D7-B565-4E1B-AC77-F780666A35FB}) (Version: 1.2.0.03050 - Sony Corporation)

VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.9.0.11060 - Sony Corporation)

VCCx64 (Version: 1.0.0 - Sony Corporation) Hidden

VCCx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden

VHD (x32 Version: 1.0.0 - Sony Corporation) Hidden

VLC media player (HKLM\...\VLC media player) (Version: 2.2.1 - VideoLAN)

VPMx64 (Version: 1.0.0 - Sony Corporation ) Hidden

VSSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden

VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden

VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden

VWSTx86 (x32 Version: 1.0.0 - Sony Corporation) Hidden

WinRAR 5.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 5.20.0 - win.rar GmbH)
 

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

CustomCLSID: HKU\S-1-5-21-3654942749-2469333359-1553951443-1002_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AC}\InprocServer32 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)

CustomCLSID: HKU\S-1-5-21-3654942749-2469333359-1553951443-1002_Classes\CLSID\{9E506282-69D3-5ABA-9C1D-15994B37F4AD}\InprocServer32 -> C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp_x64.dll (Intel)
 

==================== Wiederherstellungspunkte =========================
 

27-09-2015 13:43:36 Entfernt VAIO Update

09-10-2015 15:22:16 Geplanter Prüfpunkt

11-10-2015 18:13:13 Entfernt VAIO Easy Connect

14-10-2015 19:02:17 Windows Update

20-10-2015 11:41:14 Windows Update

25-10-2015 22:21:54 JRT Pre-Junkware Removal
 

==================== Hosts Inhalt: ===============================
 

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
 

2013-08-22 14:25 - 2015-10-25 22:48 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts
 
 

==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

Task: {11C486F7-2341-4635-9F48-13E266AFC7DB} - System32\Tasks\Sony Corporation\VAIO Care\DeployVAIOManual => %ProgramData%\Sony Corporation\VAIO Care\VAIOUserGuideUpdate.exe

Task: {1996377D-F8FA-48ED-AB04-985E0FC2CF2E} - System32\Tasks\Sony Corporation\VAIO Care\UpdateSolution => C:\Program Files\Sony\VAIO Care\Solution.Updater.exe [2015-07-23] (Sony Corporation)

Task: {24318F6B-3D56-4583-A134-A5D7FF497B8D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-09-14] (Adobe Systems Incorporated)

Task: {2811A154-120E-473E-AE3D-C36EEAF84103} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterSystem => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-07-26] (Sony Corporation)

Task: {2E08F4B4-7042-4622-9EF0-8EEAF138526B} - System32\Tasks\Sony Corporation\VAIO Control Center\NetworkSetting\NetworkSetting Logon Start => C:\Program Files (x86)\Sony\VAIO Control Center\NetworkSetting\NetworkClient

Task: {3F0819B7-3E4B-4EBD-9ED2-02AACFF6B6F4} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2015-08-06] (Sony Corporation)

Task: {41AB756D-8FFB-4C8C-8F75-19018005C477} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd)

Task: {4C1E65C6-43EF-4402-A22F-FC75B27ACB24} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIolo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {4F39EDCC-5614-4140-86F5-56146FBEE597} - System32\Tasks\Sony Corporation\VAIO Care\ActiveStatusCollect => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {5A05ED04-4A4C-4172-AEEF-81C19C413F78} - System32\Tasks\Adobe Flash Player Updater => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-10-17] (Adobe Systems Incorporated)

Task: {5D350E8E-E007-4752-9DC7-F6C3B6D0318D} - System32\Tasks\Sony Corporation\VAIO Care\VCRLog => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {5F6B745F-E4B0-4DC9-AE0B-9CC86EEC562F} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {6698C7D1-8AA7-434B-8983-1A866489D6B3} - System32\Tasks\Sony Corporation\VAIO Care\VCSelfHeal => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {687B0779-40E9-4507-A962-CF31148416A2} - System32\Tasks\USER_ESRV_SVC => Wscript.exe //B //NoLogo "C:\Program Files\Sony\VAIO Care\ESRV\task.vbs"

Task: {696CED0E-4FCA-4846-8BE2-63F0C419D3EC} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIO Capture\VAIO Clip => C:\Program Files (x86)\Sony\VAIO Control Center\VAIO Clip.exe [2013-07-26] (Sony Corporation)

Task: {79E6B753-401B-486B-A01F-B108B65E6F8A} - System32\Tasks\Sony Corporation\VAIO Care\UploadPOT => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {7EB238F9-5260-420E-9C6F-8A963C0C9BBC} - System32\Tasks\Sony Corporation\VAIO Control Center\VAIOControlCenterUser => C:\Program Files (x86)\Sony\VAIO Control Center\vim.exe [2013-07-26] (Sony Corporation)

Task: {90A45870-7463-464C-8769-2F6573993B59} - System32\Tasks\Sony Corporation\VAIO Care\GetPOTInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {912862F4-68AC-46EE-AC25-7B7171CC64ED} - System32\Tasks\{7F51232E-FEA8-4C93-8E2F-7206E50391DF} => pcalua.exe -a "C:\Program Files (x86)\JoWooD\SpellForce\SpellForce.exe" -d C:\PROGRA~2\JoWooD\SPELLF~1

Task: {934485BC-DA8A-4F29-90A4-864CA439A0F8} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2015-10-15] (Microsoft Corporation)

Task: {A25C80C1-3F26-4C41-AFAF-95B7F743D98B} - System32\Tasks\{CBECC929-B36B-46FE-8C53-6B0631DA9A69} => pcalua.exe -a "C:\Program Files (x86)\StarCraft II\StarCraft II.exe" -d "C:\Program Files (x86)\StarCraft II"

Task: {AE70E917-60E0-4008-9733-2ED64018315C} - System32\Tasks\Sony Corporation\VAIO Care\VCMetrics => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {B1045CA4-8E66-4202-9FD1-002BFB618CBC} - System32\Tasks\Sony Corporation\VAIO Care\UpdateContacts => %ProgramData%\Sony Corporation\VAIO Care\UpdateContacts.exe

Task: {BA2CAC9C-AABE-496F-B037-433FCD02AC51} - System32\Tasks\Sony Corporation\VAIO Care\CheckSystemInfo => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {CD477B39-45AD-4DEA-BD5A-F5D03A69FF85} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2015-07-31] (Sony Corporation)

Task: {D03134CF-316A-4271-AA2E-DCF9B38D85D2} - System32\Tasks\Sony Corporation\VAIO Care\DeployCRMflag => C:\Program Files\Sony\VAIO Care\DeployCRMflag.exe [2015-02-04] (Sony Corporation)

Task: {E00EE8A7-3402-4C1A-BDBD-1273C9DD1B6B} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe [2015-08-20] (Sony Corporation)

Task: {E23B84CC-FA20-4392-BA26-32C16EDCC1AD} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe [2009-09-23] ()

Task: {F63EA839-6B98-4548-85CE-840C0D1153DB} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2013-07-26] (Sony Corporation)

Task: {F6CC748B-17B8-4F8B-9626-3C9FA1C01208} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2013-07-26] (Sony Corporation)
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
 

Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\WINDOWS\Tasks\Synaptics TouchPad Enhancements.job => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
 

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
 

2015-08-26 12:11 - 2015-08-26 12:11 - 00413336 _____ () C:\Program Files\Sony\VAIO Care\ESRV\esrv_svc.exe

2015-08-26 12:11 - 2015-08-26 12:11 - 00709272 _____ () C:\Program Files\Sony\VAIO Care\ESRV\intel_modeler.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00130712 _____ () C:\Program Files\Sony\VAIO Care\ESRV\intel_process_input.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00025752 _____ () C:\Program Files\Sony\VAIO Care\ESRV\intel_system_power_state_input.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00059544 _____ () C:\Program Files\Sony\VAIO Care\ESRV\intel_quality_and_reliability_input.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00194712 _____ () C:\Program Files\Sony\VAIO Care\ESRV\acpi_battery_input.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00159896 _____ () C:\Program Files\Sony\VAIO Care\ESRV\sema_thermal_input.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00158360 _____ () C:\Program Files\Sony\VAIO Care\ESRV\wifi_input.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00050840 _____ () C:\Program Files\Sony\VAIO Care\ESRV\devices_use_input.dll

2015-08-26 12:11 - 2015-08-26 12:11 - 00032920 _____ () C:\Program Files\Sony\VAIO Care\ESRV\intel_disktrace_input.dll

2015-09-18 08:58 - 2015-09-18 08:58 - 00244888 _____ () C:\Program Files\Sony\VAIO Care\analyzer.dll

2013-09-05 02:36 - 2013-12-19 21:33 - 00013088 _____ () C:\Program Files\NVIDIA Corporation\CoProcManager\detoured.dll

2014-01-25 03:31 - 2013-12-19 19:53 - 00117536 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll

2013-12-13 12:20 - 2013-12-13 12:20 - 03359600 _____ () C:\Program Files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll

2012-03-22 21:11 - 2012-03-22 21:11 - 00244944 _____ () C:\Program Files\CSR\CSR Harmony Wireless Software Stack\CsrSyncMLServer.exe

2015-08-26 12:11 - 2015-08-26 12:11 - 00458904 _____ () C:\Program Files\Sony\VAIO Care\ESRV\esrv.exe

2015-08-26 12:11 - 2015-08-26 12:11 - 00185496 _____ () C:\Program Files\Sony\VAIO Care\ESRV\foreground_window_input.dll

2015-03-04 16:11 - 2015-03-04 16:11 - 01782784 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.App640a3541#\3f4dc590466037f015f65bc07d1ea923\Windows.ApplicationModel.ni.dll

2014-10-27 01:57 - 2014-10-27 01:57 - 00632320 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Security\c7f6d022c5d5aec4891cb6b3b9934336\Windows.Security.ni.dll

2014-10-27 01:57 - 2014-10-27 01:57 - 01278464 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Storage\f9ac074d298db459c5eff6d3256861c8\Windows.Storage.ni.dll

2014-10-27 01:57 - 2014-10-27 01:57 - 00207872 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.System\a4efa88b742703220e527956d8ab4e84\Windows.System.ni.dll

2015-03-04 16:10 - 2015-03-04 16:10 - 00363520 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Foundation\6382e6f5ad8b7a9db4f5cd4817e70319\Windows.Foundation.ni.dll

2014-10-27 01:57 - 2014-10-27 01:57 - 00521216 _____ () C:\WINDOWS\assembly\NativeImages_v4.0.30319_64\Windows.Data\fae2b750f87849ca11806d20b2504bf2\Windows.Data.ni.dll

2015-07-08 22:18 - 2015-07-08 22:18 - 00794920 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 16.0.0\kpcengine.2.3.dll

2014-01-07 14:38 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll

2013-12-29 05:39 - 2013-09-19 09:31 - 01199576 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

2014-01-25 03:34 - 2013-12-19 21:33 - 00013088 _____ () C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll

2015-02-04 16:29 - 2015-02-04 16:29 - 00347136 _____ () C:\Program Files\Sony\VAIO Care\Iolo\vosges.dll
 

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
 
 

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
 
 

==================== EXE Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
 
 

==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
 
 

==================== Andere Bereiche ============================
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\Control Panel\Desktop\\Wallpaper -> C:\Users\*****\Pictures\clear_beach_sky-wide.jpg

DNS Servers: 192.168.178.1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 2) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)

Windows Firewall ist deaktiviert.
 

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
 

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
 

HKLM\...\StartupApproved\Run32: => "Adobe Creative Cloud"

HKLM\...\StartupApproved\Run32: => "PDF5 Registry Controller"

HKLM\...\StartupApproved\Run32: => "PDFHook"

HKLM\...\StartupApproved\Run32: => "BlueStacks Agent"

HKLM\...\StartupApproved\Run32: => "Andy"

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\StartupApproved\Run: => "SandboxieControl"

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\StartupApproved\Run: => "ISUSPM"

HKU\S-1-5-21-3654942749-2469333359-1553951443-1002\...\StartupApproved\Run: => "SecureBanking"
 

==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============
 

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
 

FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139

FirewallRules: [{7D802054-6523-4965-93EB-F58F23A73BCE}] => (Allow) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe

FirewallRules: [{980ACC21-C20B-4CD5-8969-805521D7C5A7}] => (Allow) C:\Program Files\Intel Corporation\Intel WiDi\WiDiApp.exe

FirewallRules: [{A317DBB8-E40A-4005-AEF1-D0B9BBD65BE6}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe

FirewallRules: [{EA7740AB-5A26-4985-A667-47B0826806EE}] => (Allow) C:\Program Files\Common Files\mcafee\platform\McSvcHost\McSvHost.exe

FirewallRules: [{8DAF9710-2D70-45FC-B14F-6FA5F083A230}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

FirewallRules: [{42C52E2A-D740-4E43-8C71-9C0B60C6AAC5}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

FirewallRules: [{BC8ADF45-5E1B-4B09-B4BD-0E1E6EBF7B54}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe

FirewallRules: [{77D14E96-9225-4F22-B459-2E83CACDB7F8}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe

FirewallRules: [{7149160B-5714-4FA0-8C78-983F2AC6C1A0}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe

FirewallRules: [{B4507720-B8CE-4412-BC4F-1A32E7EE88FB}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1675\Agent.exe

FirewallRules: [{C307AD2B-235A-4A97-B477-007643EA575A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe

FirewallRules: [{5EA28053-623D-4B25-8FBC-DE8F5DFD7173}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe

FirewallRules: [TCP Query User{EA075CE0-C352-4BC8-8358-545B2220BDA9}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe

FirewallRules: [UDP Query User{C6FA6F2E-C5C2-4453-A48B-07AAA10860A5}C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base26490\sc2.exe

FirewallRules: [{5081F568-9F18-4F96-B7AB-098D96D69501}] => (Allow) C:\Program Files (x86)\Adobe\Adobe Flash Builder 4.6\FlashBuilder.exe

FirewallRules: [{DA6AAE31-6FC5-486B-85D4-A0FF6AAB25A0}] => (Allow) C:\Program Files (x86)\Adobe\Adobe Flash Builder 4.6\FlashBuilder.exe

FirewallRules: [{1FBDDFC2-B547-4560-8EA3-258716721D66}] => (Allow) LPort=7935

FirewallRules: [{9B072C11-E0DB-4795-B4CB-76CA785F4AAF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{2C39DD53-A91B-4F3E-8B78-A34CE91BF6BF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{6A95B9E8-DB93-4AC1-8365-6DD5F5791AC3}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{2EE204F1-878F-4CFE-9746-27E177707239}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{6331E848-83D9-458F-856A-100845F6A5F8}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{8E398D8A-A07D-401D-B889-94F86A0E2983}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{CDB3BAF9-ACA1-476B-8889-6ACDCFDE58E8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{BC19B6CB-F91A-44C0-8D17-90EA1936868A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{D08E9F62-F0F2-496F-9DB0-A8A5EC39FC27}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{8BA0603B-D6C3-4290-84BA-8C5D3A07D717}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [TCP Query User{6E93BEDF-2515-46B3-A04C-5F37009ACCDA}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe

FirewallRules: [UDP Query User{D7BDD179-B081-46DD-845A-A864401B1C78}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe

FirewallRules: [{6388C248-5341-403E-8664-C69929C96955}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe

FirewallRules: [{74A9671E-0D0C-44EC-9C67-EFD74ED74660}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2380\Agent.exe

FirewallRules: [TCP Query User{D9476801-EE7F-4CA5-AE01-5EADED1768C3}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{B15DD18B-F981-4FCE-95B6-F8E1B624173D}C:\program files (x86)\skype\phone\skype.exe] => (Allow) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [TCP Query User{0AD93610-9A56-4A4A-9266-247BA6F41378}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [UDP Query User{2BE23D80-CBF9-4183-A2ED-70F46C2B29ED}C:\program files (x86)\skype\phone\skype.exe] => (Block) C:\program files (x86)\skype\phone\skype.exe

FirewallRules: [{0BE75289-A54F-47FF-850E-21ADF2F9B6CE}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe

FirewallRules: [{698A6EC9-384D-4930-AFBB-F4286D15E8B0}] => (Allow) C:\Program Files (x86)\Steam\SteamApps\common\Age2HD\Launcher.exe

FirewallRules: [TCP Query User{222E97A5-419B-4AAD-88F5-03993A9C12D6}C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe

FirewallRules: [UDP Query User{773E0F50-CF7E-496E-93F0-4FC161943629}C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe] => (Allow) C:\users\*****\appdata\roaming\gameranger\gameranger\gameranger.exe

FirewallRules: [TCP Query User{8CA44F5D-EA7F-4DC9-A505-56CE3B35E781}C:\windows\syswow64\dplaysvr.exe] => (Allow) C:\windows\syswow64\dplaysvr.exe

FirewallRules: [UDP Query User{812377CC-09AD-4F31-A87D-098968726CC8}C:\windows\syswow64\dplaysvr.exe] => (Allow) C:\windows\syswow64\dplaysvr.exe

FirewallRules: [{3AA748D5-7613-4A36-8345-49D4B98F6F4F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{A3927EF1-3A09-4DCA-8730-4F0BBA122472}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{738F3D99-CF89-4364-9443-1D0E6A343ED9}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{DEB10D54-89C2-4902-9331-7A9F6A4F0A6E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{D72A503D-9B4D-4D6D-BCA0-68B72A4BF290}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{58FEA869-C03D-4FEA-AE9E-ABA4E56B7135}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{BA5A0C9E-F513-4887-9A76-625C51AE1312}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{4078EE63-104A-457C-B863-8E2BB519C8A2}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{5CC08DC4-2CA0-4A09-ACE8-8A96B4663E74}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{E62D2583-ECEB-4ED1-9671-F3027744E3FF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{81AF10B6-6170-4BD2-83E0-3A0337DEB97A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{E7F412D0-FF60-4AFB-9114-2906E65E1D0E}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{0E8FFA7D-C982-4E0A-9625-E02D29F0F576}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{92571B79-DB59-47B1-9AFC-39B030CC7B5F}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe

FirewallRules: [{4061E69F-2E5F-4881-B76E-E76C32DB10F8}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{9CD05140-D93F-4F62-ABE2-B0103E62B7DF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

FirewallRules: [{45C78CA0-D623-400D-94F3-22435966CB59}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{BDF08A11-A8AF-425B-A092-35041B788B56}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe

FirewallRules: [{616805ED-15C0-4119-B436-B069B626FF7E}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{E24AE355-A603-4358-BD2F-C40AC960702C}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{4A9243F8-1763-413B-94AB-243E2E9A2A50}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{C584B1D4-1123-4A9B-B2F2-92661B039252}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe

FirewallRules: [{E2A5FB3D-46E6-4449-B595-4E51E0941565}] => (Allow) C:\windows\syswow64\dplaysvr.exe

FirewallRules: [{06D65929-C099-4136-8B19-7AF44BFFC7B5}] => (Allow) C:\windows\syswow64\dplaysvr.exe

FirewallRules: [{5D0AA298-B067-462C-838D-20FF12914B30}] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe

FirewallRules: [{F9EA65FA-7298-43FB-A11C-DC91F5425F8A}] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x2.exe

FirewallRules: [TCP Query User{C900BD3E-D157-4D6A-BEBA-D01B88EB1F02}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe

FirewallRules: [UDP Query User{C8DB6BFC-07B6-4903-B734-4CC694EE5D80}C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe] => (Allow) C:\program files (x86)\microsoft games\age of empires ii\age2_x1\age2_x1.exe

FirewallRules: [TCP Query User{F1F5CD56-D272-4E27-AC21-17C3B9FB3683}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe

FirewallRules: [UDP Query User{5C9DD565-33C9-4FE8-BF7A-42F1D2ED0448}C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe] => (Allow) C:\program files (x86)\starcraft ii\versions\base28667\sc2.exe

FirewallRules: [{E28A2A2D-C516-4055-90AE-DB4434053FF7}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [{FD2A05D0-B19C-48BD-8D14-D9D708B913A9}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

FirewallRules: [TCP Query User{66781E34-E6E7-43CE-AD5A-0150BCDB8828}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [UDP Query User{F6746961-3C5F-4872-9922-578D54D2F893}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe

FirewallRules: [{912CECDE-84E2-48B1-AC00-2865BC7BE190}] => (Allow) C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

FirewallRules: [{F0580F28-4B38-4DA6-90D3-BD30ABC48647}] => (Allow) C:\Program Files\Sony\VAIO Care\VCAgent.exe

FirewallRules: [{2761773F-5B76-4F0E-B4DB-7755102B2E59}] => (Allow) C:\Program Files\Sony\VAIO Care\VCAdmin.exe

FirewallRules: [{C29CBF9D-27D4-4E96-8FD0-DB9B84161415}] => (Allow) C:\Program Files\Sony\VAIO Care\VCSystemTray.exe

FirewallRules: [{CF0704C1-EAA7-4A7B-9B00-9FFE24D20682}] => (Allow) C:\Program Files\Sony\VAIO Care\VAIOShell.exe
 

==================== Fehlerhafte Geräte im Gerätemanager =============
 
 

==================== Fehlereinträge in der Ereignisanzeige: =========================
 

Applikationsfehler:

==================

Error: (10/25/2015 11:10:24 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: CsrBtOBEXService.exe, Version: 2.1.63.0, Zeitstempel: 0x4f68683b

Name des fehlerhaften Moduls: CsrBtOBEXService.exe, Version: 2.1.63.0, Zeitstempel: 0x4f68683b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000006f58

ID des fehlerhaften Prozesses: 0x820

Startzeit der fehlerhaften Anwendung: 0xCsrBtOBEXService.exe0

Pfad der fehlerhaften Anwendung: CsrBtOBEXService.exe1

Pfad des fehlerhaften Moduls: CsrBtOBEXService.exe2

Berichtskennung: CsrBtOBEXService.exe3

Vollständiger Name des fehlerhaften Pakets: CsrBtOBEXService.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CsrBtOBEXService.exe5
 

Error: (10/25/2015 11:10:24 PM) (Source: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe) (EventID: 1) (User: )

Description: C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exeCan't get user token [1008]
 

Error: (10/25/2015 11:09:49 PM) (Source: SideBySide) (EventID: 78) (User: )

Description: Fehler beim Generieren des Aktivierungskontexts für "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest2" in Zeile C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest3.

Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion.

In Konflikt stehende Komponenten:.

Komponente 1: C:\WINDOWS\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_623f33d3ecbe86e8.manifest.

Komponente 2: C:\WINDOWS\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9600.18006_none_a9ec6aab013aafee.manifest.
 

Error: (10/25/2015 10:58:25 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: nvxdsync.exe, Version: 8.17.13.3221, Zeitstempel: 0x52b32dce

Name des fehlerhaften Moduls: nvxdsync.exe, Version: 8.17.13.3221, Zeitstempel: 0x52b32dce

Ausnahmecode: 0xc0000005

Fehleroffset: 0x000000000001d067

ID des fehlerhaften Prozesses: 0x3d8

Startzeit der fehlerhaften Anwendung: 0xnvxdsync.exe0

Pfad der fehlerhaften Anwendung: nvxdsync.exe1

Pfad des fehlerhaften Moduls: nvxdsync.exe2

Berichtskennung: nvxdsync.exe3

Vollständiger Name des fehlerhaften Pakets: nvxdsync.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: nvxdsync.exe5
 

Error: (10/25/2015 10:58:24 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )

Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.

   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)

   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 

Error: (10/25/2015 10:35:04 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: CsrBtOBEXService.exe, Version: 2.1.63.0, Zeitstempel: 0x4f68683b

Name des fehlerhaften Moduls: CsrBtOBEXService.exe, Version: 2.1.63.0, Zeitstempel: 0x4f68683b

Ausnahmecode: 0xc0000005

Fehleroffset: 0x0000000000006f58

ID des fehlerhaften Prozesses: 0x2af8

Startzeit der fehlerhaften Anwendung: 0xCsrBtOBEXService.exe0

Pfad der fehlerhaften Anwendung: CsrBtOBEXService.exe1

Pfad des fehlerhaften Moduls: CsrBtOBEXService.exe2

Berichtskennung: CsrBtOBEXService.exe3

Vollständiger Name des fehlerhaften Pakets: CsrBtOBEXService.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: CsrBtOBEXService.exe5
 

Error: (10/25/2015 10:21:02 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )

Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.

   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)

   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 

Error: (10/25/2015 10:14:17 PM) (Source: Application Error) (EventID: 1000) (User: )

Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 41.0.2.5765, Zeitstempel: 0x561ef9f1

Name des fehlerhaften Moduls: mozglue.dll, Version: 41.0.2.5765, Zeitstempel: 0x561ee53f

Ausnahmecode: 0x80000003

Fehleroffset: 0x0000ec91

ID des fehlerhaften Prozesses: 0xcd8

Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0

Pfad der fehlerhaften Anwendung: plugin-container.exe1

Pfad des fehlerhaften Moduls: plugin-container.exe2

Berichtskennung: plugin-container.exe3

Vollständiger Name des fehlerhaften Pakets: plugin-container.exe4

Anwendungs-ID, die relativ zum fehlerhaften Paket ist: plugin-container.exe5
 

Error: (10/25/2015 10:03:10 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )

Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.

   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)

   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 

Error: (10/25/2015 09:58:36 PM) (Source: BstHdAndroidSvc) (EventID: 0) (User: )

Description: Der Dienst kann nicht gestartet werden. System.ApplicationException: Cannot start service.  Service did not stop gracefully the last time it was run.

   bei BlueStacks.hyperDroid.Service.Service.OnStart(String[] args)

   bei System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)
 
 

Systemfehler:

=============

Error: (10/25/2015 11:10:27 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "CSR OBEX-Dienst" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
 

Error: (10/25/2015 10:58:24 PM) (Source: Service Control Manager) (EventID: 7023) (User: )

Description: Der Dienst "BlueStacks Android Service" wurde mit folgendem Fehler beendet: 

%%1064
 

Error: (10/25/2015 10:57:59 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
 

Error: (10/25/2015 10:57:59 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
 

Error: (10/25/2015 10:57:58 PM) (Source: DCOM) (EventID: 10010) (User: NT-AUTORITÄT)

Description: {B3E53F1A-1C31-4A43-A66D-321FA322BCE7}
 

Error: (10/25/2015 10:57:57 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)

Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x8024001e fehlgeschlagen: Definitionsupdate für Windows Defender – KB2267602 (Definition 1.209.461.0)
 

Error: (10/25/2015 10:57:57 PM) (Source: Microsoft-Windows-WLAN-AutoConfig) (EventID: 10003) (User: NT-AUTORITÄT)

Description: Das WLAN-Erweiterungsmodul wurde unerwartet beendet.
 

Modulpfad: C:\WINDOWS\System32\IWMSSvc.dll
 

Error: (10/25/2015 10:50:58 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "BrYNSvc" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
 

Error: (10/25/2015 10:50:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "CSR OBEX-Dienst" wurde unerwartet beendet. Dies ist bereits 3 Mal passiert.
 

Error: (10/25/2015 10:50:55 PM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: Dienst "CSR Bluetooth Audio-Service" wurde unerwartet beendet. Dies ist bereits 2 Mal passiert.
 
 

CodeIntegrity:

===================================

  Date: 2015-09-05 13:46:47.951

  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-05 13:46:47.406

  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-05 13:46:46.770

  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 

  Date: 2015-09-05 13:46:45.869

  Description: Code Integrity determined that a process (\Device\HarddiskVolume5\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume5\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements.
 
 

==================== Speicherinformationen =========================== 
 

Prozessor: Intel(R) Core(TM) i7-4500U CPU @ 1.80GHz

Prozentuale Nutzung des RAM: 34%

Installierter physikalischer RAM: 8087.8 MB

Verfügbarer physikalischer RAM: 5296.33 MB

Summe virtueller Speicher: 9367.8 MB

Verfügbarer virtueller Speicher: 6351.96 MB
 

==================== Laufwerke ================================
 

Drive c: () (Fixed) (Total:201.27 GB) (Free:90.62 GB) NTFS
 

==================== MBR & Partitionstabelle ==================
 

========================================================

Disk: 0 (Size: 238.5 GB) (Disk ID: 1B9A29CC)
 

Partition: GPT.
 

==================== Ende von Addition.txt ============================

Hab doch noch Gmer geschafft - dabei wurden mir 2 Fehlermeldungen angezeigt.
1) C:\Windows\system32\config\system: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird
2) C:\Users\*****\ntuser.dat: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2015-10-26 07:37:06

Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002f SAMSUNG_MZNTD256HAGL-00000 rev.DXT2300Q 238,47GB

Running: of3gspmf.exe; Driver: C:\Users\*****\AppData\Local\Temp\kwlyypow.sys
 
 

---- User code sections - GMER 2.1 ----
 

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation                                                                                       00007ffc26b73e10 7 bytes JMP 00007ffd264502d0

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW                                                                                              00007ffc26b73e20 7 bytes JMP 00007ffd26450308

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW                                                                                                00007ffc26c239b0 7 bytes JMP 00007ffd264503b0

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW                                                                                               00007ffc26c23ef0 7 bytes JMP 00007ffd26450340

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA                                                                                                00007ffc26c23fe0 7 bytes JMP 00007ffd26450378

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx                                                                                       00007ffc26c506c0 7 bytes JMP 00007ffd26450228

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW                                                                                         00007ffc26c50730 7 bytes JMP 00007ffd26450298

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleFileNameExW                                                                                       00007ffc26c50760 7 bytes JMP 00007ffd26450260

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary                                                                                                 00007ffc264621d0 5 bytes JMP 00007ffd26450180

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW                                                                                            00007ffc264629d0 7 bytes JMP 00007ffd264500d8

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW                                                                                          00007ffc26464310 5 bytes JMP 00007ffd26450110

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW                                                                                              00007ffc26468900 5 bytes JMP 00007ffd26450148

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\USER32.dll!CreateWindowExW                                                                                                 00007ffc28a76d90 10 bytes JMP 00007ffd26450490

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW                                                                                             00007ffc28a874a0 5 bytes JMP 00007ffd26450458

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                                      00007ffc28a87560 1 byte JMP 00007ffd264503e8

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo + 2                                                                                  00007ffc28a87562 7 bytes {JMP 0xfffffffffd9c8e88}

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA                                                                                             00007ffc28a96b10 5 bytes JMP 00007ffd26450420

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                                         00007ffc27161500 8 bytes JMP 00007ffd264501b8

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                                           00007ffc27161750 8 bytes JMP 00007ffd264501f0

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory                                                                                                 00007ffc1f5a7750 5 bytes JMP 00007ffd1f5900d8

.text   C:\WINDOWS\System32\dwm.exe[4692] C:\WINDOWS\System32\dxgi.dll!CreateDXGIFactory1                                                                                                00007ffc1f5a8ee0 5 bytes JMP 00007ffd1f590110

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                      00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                          00007ffc28f64f3c 8 bytes [60, 6E, 45, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                      00007ffc28f65216 8 bytes [50, 6E, 45, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                            00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                       00007ffc28f657af 8 bytes [30, 6E, 45, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                              00007ffc28f65964 8 bytes [20, 6E, 45, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                         00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                            00007ffc28f65f5e 8 bytes [F0, 6D, 45, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                         00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                       00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                             00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                           00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                               00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                               00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                             00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                             00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                         00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                         00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                               00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                         00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                     00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                 00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe[7448] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                              00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                  00007ffc28f64f3c 8 bytes [60, 6E, 07, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                              00007ffc28f65216 8 bytes [50, 6E, 07, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                    00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                               00007ffc28f657af 8 bytes [30, 6E, 07, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                      00007ffc28f65964 8 bytes [20, 6E, 07, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                 00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                    00007ffc28f65f5e 8 bytes [F0, 6D, 07, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                 00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                               00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                     00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                   00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                       00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                       00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                     00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                     00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                 00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                 00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                       00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                 00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                             00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                         00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\TabTip32.exe[1780] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                        00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                    00007ffc28f64f3c 8 bytes [60, 6E, 82, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                00007ffc28f65216 8 bytes [50, 6E, 82, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                      00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                 00007ffc28f657af 8 bytes [30, 6E, 82, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                        00007ffc28f65964 8 bytes [20, 6E, 82, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                   00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                      00007ffc28f65f5e 8 bytes [F0, 6D, 82, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                   00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                 00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                       00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                     00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                         00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                         00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                       00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                       00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                   00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                   00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                         00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                   00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                               00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                           00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[7204] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                          00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                            00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                00007ffc28f64f3c 8 bytes [60, 6E, C6, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                            00007ffc28f65216 8 bytes [50, 6E, C6, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                  00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                             00007ffc28f657af 8 bytes [30, 6E, C6, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                    00007ffc28f65964 8 bytes [20, 6E, C6, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                               00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78  00007ffc28f65f5e 8 bytes [F0, 6D, C6, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                               00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                             00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                   00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                     00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                   00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                   00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                               00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                               00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                     00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                               00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                           00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                       00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\CSR\CSR Harmony Wireless Software Stack\CSRHarmonySkypePlugin.exe[980] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                      00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                    00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                        00007ffc28f64f3c 8 bytes [60, 6E, 1E, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                    00007ffc28f65216 8 bytes [50, 6E, 1E, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                          00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                     00007ffc28f657af 8 bytes [30, 6E, 1E, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                            00007ffc28f65964 8 bytes [20, 6E, 1E, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                       00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                          00007ffc28f65f5e 8 bytes [F0, 6D, 1E, 7E, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                       00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                     00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                           00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                         00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                             00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                             00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                                           00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                                           00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                                       00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                                       00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                             00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                                       00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                   00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                               00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2096] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                              00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                 00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                     00007ffc28f64f3c 8 bytes [60, 6E, 21, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                 00007ffc28f65216 8 bytes [50, 6E, 21, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                       00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                  00007ffc28f657af 8 bytes [30, 6E, 21, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                         00007ffc28f65964 8 bytes [20, 6E, 21, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                    00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                       00007ffc28f65f5e 8 bytes [F0, 6D, 21, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                    00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                  00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                        00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                      00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                          00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                          00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                        00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                        00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                    00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                    00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                          00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                    00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                            00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Sony\PlayMemories Home\PMBVolumeWatcher.exe[5660] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                           00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                               00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                   00007ffc28f64f3c 8 bytes [60, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                               00007ffc28f65216 8 bytes [50, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                     00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                00007ffc28f657af 8 bytes [30, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                       00007ffc28f65964 8 bytes [20, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                  00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                     00007ffc28f65f5e 8 bytes [F0, 6D, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                  00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                      00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                    00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                        00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                        00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                                      00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                                      00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                                  00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                                  00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                        00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                                  00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                              00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                          00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe[5716] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                         00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                    00007ffc28f64f3c 8 bytes [60, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                00007ffc28f65216 8 bytes [50, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                      00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                 00007ffc28f657af 8 bytes [30, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                        00007ffc28f65964 8 bytes [20, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                   00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                      00007ffc28f65f5e 8 bytes [F0, 6D, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                   00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                 00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                       00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                     00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                         00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                         00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                                       00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                                       00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                                   00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                                   00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                         00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                                   00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                               00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                           00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe[696] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                          00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                 00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                     00007ffc28f64f3c 8 bytes [60, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                 00007ffc28f65216 8 bytes [50, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                       00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                  00007ffc28f657af 8 bytes [30, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                         00007ffc28f65964 8 bytes [20, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                    00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                       00007ffc28f65f5e 8 bytes [F0, 6D, F8, 7F, 00, 00, 00, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                    00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                  00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                        00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                      00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                          00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                          00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                                        00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                                        00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                                    00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                                    00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                          00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                                    00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                            00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe[668] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                           00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!K32GetModuleInformation                                                                  00007ffc26b73e10 7 bytes JMP 00007ffd264503b0

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!RegQueryValueExW                                                                         00007ffc26b73e20 7 bytes JMP 00007ffd264503e8

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!RegSetValueExW                                                                           00007ffc26c239b0 7 bytes JMP 00007ffd26450490

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!RegDeleteValueW                                                                          00007ffc26c23ef0 7 bytes JMP 00007ffd26450420

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!RegSetValueExA                                                                           00007ffc26c23fe0 7 bytes JMP 00007ffd26450458

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                                  00007ffc26c506c0 7 bytes JMP 00007ffd26450308

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!K32GetMappedFileNameW                                                                    00007ffc26c50730 7 bytes JMP 00007ffd26450378

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                                  00007ffc26c50760 7 bytes JMP 00007ffd26450340

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance                                                                          00007ffc26ced050 7 bytes JMP 00007ffd26450228

.text   C:\Program Files\Sony\VAIO Care\VCSystemTray.exe[2204] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                         00007ffc26d1b170 5 bytes JMP 00007ffd26450260

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!K32GetModuleInformation                                                                       00007ffc26b73e10 7 bytes JMP 00007ffd264503b0

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!RegQueryValueExW                                                                              00007ffc26b73e20 7 bytes JMP 00007ffd264503e8

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!RegSetValueExW                                                                                00007ffc26c239b0 7 bytes JMP 00007ffd26450490

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!RegDeleteValueW                                                                               00007ffc26c23ef0 7 bytes JMP 00007ffd26450420

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!RegSetValueExA                                                                                00007ffc26c23fe0 7 bytes JMP 00007ffd26450458

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!K32EnumProcessModulesEx                                                                       00007ffc26c506c0 7 bytes JMP 00007ffd26450308

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!K32GetMappedFileNameW                                                                         00007ffc26c50730 7 bytes JMP 00007ffd26450378

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNEL32.dll!K32GetModuleFileNameExW                                                                       00007ffc26c50760 7 bytes JMP 00007ffd26450340

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary                                                                                 00007ffc264621d0 5 bytes JMP 00007ffd26450180

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW                                                                            00007ffc264629d0 7 bytes JMP 00007ffd264500d8

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW                                                                          00007ffc26464310 5 bytes JMP 00007ffd26450110

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW                                                                              00007ffc26468900 5 bytes JMP 00007ffd26450148

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\SYSTEM32\combase.dll!CoCreateInstance                                                                               00007ffc26ced050 7 bytes JMP 00007ffd26450228

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\SYSTEM32\combase.dll!CoSetProxyBlanket                                                                              00007ffc26d1b170 5 bytes JMP 00007ffd26450260

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\USER32.dll!CreateWindowExW                                                                                 00007ffc28a76d90 10 bytes JMP 00007ffd26450570

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW                                                                             00007ffc28a874a0 5 bytes JMP 00007ffd26450538

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo                                                                      00007ffc28a87560 9 bytes JMP 00007ffd264504c8

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA                                                                             00007ffc28a96b10 5 bytes JMP 00007ffd26450500

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                         00007ffc27161500 8 bytes JMP 00007ffd264501b8

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                           00007ffc27161750 8 bytes JMP 00007ffd264501f0

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\SYSTEM32\d3d9.dll!Direct3DCreate9Ex                                                                                 00007ffc1b72ead0 5 bytes JMP 00007ffc264502d0

.text   C:\Program Files\Sony\VAIO Care\VCAdmin.exe[7660] C:\WINDOWS\SYSTEM32\d3d9.dll!Direct3DCreate9                                                                                   00007ffc1b75eb90 6 bytes JMP 00007ffc26450298

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                        00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                            00007ffc28f64f3c 8 bytes [60, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                        00007ffc28f65216 8 bytes [50, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                              00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                         00007ffc28f657af 8 bytes [30, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                                00007ffc28f65964 8 bytes [20, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                           00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                              00007ffc28f65f5e 8 bytes [F0, 6D, F8, 7F, 00, 00, 00, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                           00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                         00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                               00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                             00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                 00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                 00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                                               00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                                               00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                                           00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                                           00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                                 00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                                           00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                       00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                                   00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\PROGRA~1\Sony\VAIOCA~1\Iolo\IOLOTO~1.EXE[3408] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                                  00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlDecompressBuffer + 132                                                                             00007ffc28f64b14 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlPrefixString + 316                                                                                 00007ffc28f64f3c 8 bytes [60, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocIoCompletion + 710                                                                             00007ffc28f65216 8 bytes [50, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitForWnfMetaNotification + 479                                                                   00007ffc28f6540f 8 bytes {JMP 0xffffffffffffffee}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUserThreadStart + 911                                                                              00007ffc28f657af 8 bytes [30, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!TpAllocWork + 420                                                                                     00007ffc28f65964 8 bytes [20, 6E, F8, 7F, 00, 00, 00, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlWaitOnAddress + 657                                                                                00007ffc28f65f01 8 bytes {JMP 0xffffffffffffff9e}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!RtlUnsubscribeWnfNotificationWaitForCompletion + 78                                                   00007ffc28f65f5e 8 bytes [F0, 6D, F8, 7F, 00, 00, 00, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetInformationThread                                                                                00007ffc28fe12a0 8 bytes {JMP QWORD [RIP-0x7baf7]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueryInformationThread                                                                              00007ffc28fe1420 8 bytes {JMP QWORD [RIP-0x7bac2]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtMapViewOfSection                                                                                    00007ffc28fe1450 8 bytes {JMP QWORD [RIP-0x7c51a]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                                                                  00007ffc28fe1570 8 bytes {JMP QWORD [RIP-0x7c167]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtQueueApcThread                                                                                      00007ffc28fe1620 8 bytes {JMP QWORD [RIP-0x7c410]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtCreateThreadEx                                                                                      00007ffc28fe1ce0 8 bytes {JMP QWORD [RIP-0x7bd88]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtGetContextThread                                                                                    00007ffc28fe1fe0 8 bytes {JMP QWORD [RIP-0x7c0e5]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\SYSTEM32\ntdll.dll!NtSetContextThread                                                                                    00007ffc28fe2860 8 bytes {JMP QWORD [RIP-0x7cbfe]}

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\system32\wow64cpu.dll!CpuSetContext + 438                                                                                00000000773f13f6 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\system32\wow64cpu.dll!CpuGetContext + 387                                                                                00000000773f1583 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\system32\wow64cpu.dll!CpuSetInstructionPointer + 49                                                                      00000000773f1621 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\system32\wow64cpu.dll!CpuProcessInit + 68                                                                                00000000773f1674 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\system32\wow64cpu.dll!CpuGetStackPointer + 23                                                                            00000000773f16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 9                                                                        00000000773f16e9 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]

.text   C:\Users\*****\Desktop\of3gspmf.exe[8104] C:\WINDOWS\system32\wow64cpu.dll!CpuNotifyAffinityChange + 71                                                                       00000000773f1727 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
 

---- Threads - GMER 2.1 ----
 

Thread  C:\WINDOWS\system32\csrss.exe [8096:4116]                                                                                                                                        fffff9600082f2d0

Thread  C:\WINDOWS\Explorer.EXE [4892:3128]                                                                                                                                              00007ffc0d83e630

Thread  C:\WINDOWS\SYSTEM32\ntdll.dll [6472:4888]                                                                                                                                        0000000000f3a794

Thread  C:\WINDOWS\SYSTEM32\ntdll.dll [6472:7092]                                                                                                                                        0000000000f34980
 

---- Disk sectors - GMER 2.1 ----
 

Disk    \Device\Harddisk0\DR0                                                                                                                                                            unknown MBR code
 

---- EOF - GMER 2.1 ----