Systemzeit setzt sich ständig zurück, Anwendungen hängen etc.

hotte90 · 27.11.2013, 10:11

Hallo,

seit 2-3 Tagen habe ich das Problem, dass sich die Systemzeit zurücksetzt, und Anwendungen teilweisen hängen bzw. nicht starten.

Hab denn mal mit Avast, Malwarebytes und mit mbar nen Vollscan gemacht - ohne Befunde.
AdwCleaner & JRT laufen lassen !

Code:

ATTFilter

# AdwCleaner v3.009 - Bericht erstellt am 27/11/2013 um 08:10:36
# Updated 19/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : root - ROOT-PC
# Gestartet von : C:\Users\root\Desktop\AdwCleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v25.0 (de)

[ Datei : C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\prefs.js ]


[ Datei : C:\Users\bash\AppData\Roaming\Mozilla\Firefox\Profiles\8kigumov.default\prefs.js ]


*************************

AdwCleaner[R1].txt - [892 octets] - [27/11/2013 08:09:51]
AdwCleaner[S1].txt - [814 octets] - [27/11/2013 08:10:36]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [873 octets] ##########

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows 7 Home Premium x64
Ran by root on 27.11.2013 at  8:29:06,20
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\root\AppData\Roaming\mozilla\firefox\profiles\8ujo5aq9.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.11.2013 at  8:37:08,49
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Aneri · 27.11.2013, 10:23

Hallo

wir brauchen für eine Analyse deines Systems ein Logfile mit FRST.

Schritt 1:
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

hotte90 · 27.11.2013, 10:36

Hallo, ja kommt gleich, meine Verbindung hängt gerade ganz massiv

Ersteinmal Combofix, danach folgt ein frischer FRST Log:

Code:

ATTFilter

ComboFix 13-11-27.01 - root 27.11.2013   9:28.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4991.4020 [GMT 1:00]
ausgeführt von:: c:\users\root\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\SysWow64\FlashPlayerApp.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-10-27 bis 2013-11-27  ))))))))))))))))))))))))))))))
.
.
2013-11-27 08:34 . 2013-11-27 08:34	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-11-27 07:52 . 2013-11-27 07:52	--------	d-----w-	C:\FRST
2013-11-27 07:09 . 2013-11-27 07:10	--------	d-----w-	C:\AdwCleaner
2013-11-25 08:52 . 2013-11-25 08:53	--------	d-----w-	c:\program files\ProduKey
2013-11-25 07:51 . 2013-10-07 19:06	448512	----a-w-	c:\program files\TFC.exe
2013-11-24 19:44 . 2013-11-24 19:44	116440	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2013-11-24 16:43 . 2009-10-21 16:16	243200	----a-w-	c:\windows\system32\drivers\ewusbnet.sys
2013-11-24 16:43 . 2009-10-12 14:23	114304	----a-w-	c:\windows\system32\drivers\ewusbdev.sys
2013-11-24 16:43 . 2009-09-10 14:31	117248	----a-w-	c:\windows\system32\drivers\ewusbmdm.sys
2013-11-24 16:43 . 2007-08-09 03:10	29696	----a-w-	c:\windows\system32\drivers\ewdcsc.sys
2013-11-24 04:31 . 2013-11-24 04:48	--------	d-----w-	c:\windows\system32\catroot2
2013-11-24 04:14 . 2013-11-27 08:22	--------	d-----w-	c:\windows\system32\wbem\repository
2013-11-24 04:14 . 2013-11-24 04:14	--------	d-----w-	c:\windows\SysWow64\wbem\Performance
2013-11-24 03:56 . 2013-11-24 04:25	181064	----a-w-	c:\windows\PSEXESVC.EXE
2013-11-24 03:16 . 2013-11-24 03:16	--------	d-----w-	c:\program files (x86)\Tweaking.com
2013-11-23 02:13 . 2013-11-08 03:12	10285968	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C0387623-AC8C-479D-ACC9-560DD80A9519}\mpengine.dll
2013-11-23 01:40 . 2013-11-23 03:29	--------	d-----w-	c:\users\bash
2013-11-23 01:26 . 2013-11-23 01:26	233056	----a-w-	c:\windows\system32\drivers\66210953.sys
2013-11-23 01:02 . 2013-08-30 08:48	33400	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2013-11-23 01:02 . 2013-08-30 08:48	378944	----a-w-	c:\windows\system32\drivers\aswSP.sys
2013-11-23 01:02 . 2013-08-30 08:48	72016	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2013-11-23 01:02 . 2013-08-30 08:48	64288	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2013-11-23 01:02 . 2013-08-30 08:48	1030952	----a-w-	c:\windows\system32\drivers\aswSnx.sys
2013-11-23 01:02 . 2013-08-30 08:48	204880	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2013-11-23 01:02 . 2013-08-30 08:48	65336	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2013-11-23 01:02 . 2013-08-30 08:48	80816	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2013-11-23 01:00 . 2013-08-30 08:47	41664	----a-w-	c:\windows\avastSS.scr
2013-11-23 00:59 . 2013-11-23 00:59	--------	d-----w-	c:\program files\AVAST Software
2013-11-23 00:58 . 2013-11-23 00:59	--------	d-----w-	c:\programdata\AVAST Software
2013-11-13 16:08 . 2013-10-02 00:15	1057280	----a-w-	c:\windows\system32\rdvidcrl.dll
2013-11-13 16:08 . 2013-10-01 23:08	855552	----a-w-	c:\windows\SysWow64\rdvidcrl.dll
2013-11-13 16:08 . 2013-10-01 20:57	6578176	----a-w-	c:\windows\system32\mstscax.dll
2013-11-13 16:08 . 2013-10-01 20:55	5698048	----a-w-	c:\windows\SysWow64\mstscax.dll
2013-11-13 16:06 . 2013-09-25 02:23	1030144	----a-w-	c:\windows\system32\TSWorkspace.dll
2013-11-13 16:06 . 2013-09-25 01:57	792576	----a-w-	c:\windows\SysWow64\TSWorkspace.dll
2013-11-13 12:25 . 2013-11-13 12:25	--------	d-----w-	c:\program files\Sandboxie
2013-11-12 12:49 . 2013-10-14 17:00	28368	----a-w-	c:\windows\system32\IEUDINIT.EXE
2013-11-11 17:27 . 2013-11-11 17:27	--------	d-----w-	c:\program files\Calibre2
2013-11-09 00:18 . 2013-11-09 04:01	--------	d-----w-	c:\program files (x86)\Common Files\PX Storage Engine
2013-11-09 00:12 . 2013-11-09 00:12	--------	d-----w-	c:\program files (x86)\SoundSpectrum
2013-11-08 21:01 . 2013-11-23 06:23	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2013-11-08 19:41 . 2013-11-08 19:41	--------	d-s---w-	c:\windows\SysWow64\Microsoft
2013-11-08 01:34 . 2010-04-27 02:25	15872	----a-w-	c:\windows\system32\drivers\ss_bwhnt.sys
2013-11-08 01:34 . 2010-04-27 02:25	15872	----a-w-	c:\windows\system32\drivers\ss_bwh.sys
2013-11-08 01:34 . 2010-04-27 02:25	18944	----a-w-	c:\windows\system32\drivers\ss_bmdfl.sys
2013-11-08 01:34 . 2010-04-27 02:25	161280	----a-w-	c:\windows\system32\drivers\ss_bmdm.sys
2013-11-08 01:34 . 2010-04-27 02:25	15360	----a-w-	c:\windows\system32\drivers\ss_bcmnt.sys
2013-11-08 01:34 . 2010-04-27 02:25	15360	----a-w-	c:\windows\system32\drivers\ss_bcm.sys
2013-11-08 01:34 . 2010-04-27 02:25	127488	----a-w-	c:\windows\system32\drivers\ss_bbus.sys
2013-11-08 01:33 . 2013-11-08 01:33	--------	d-----w-	c:\programdata\Samsung
2013-11-08 01:32 . 2010-07-04 18:11	25960	----a-w-	c:\windows\system32\FsExService64.exe
2013-11-08 01:32 . 2010-06-14 08:32	16448	----a-w-	c:\windows\system32\drivers\TFsExDisk.sys
2013-11-08 00:58 . 2013-11-08 00:58	--------	d-----w-	c:\program files (x86)\Common Files\Skype
2013-11-08 00:58 . 2013-11-08 00:58	--------	d-----r-	c:\program files (x86)\Skype
2013-11-08 00:58 . 2013-11-08 00:58	--------	d-----w-	c:\programdata\Skype
2013-11-07 17:48 . 2013-11-07 17:48	--------	d-----w-	c:\program files (x86)\Microsoft.NET
2013-11-07 16:34 . 2013-11-07 16:34	--------	d-----w-	c:\program files (x86)\Common Files\InstallShield
2013-11-06 22:21 . 2013-04-17 06:24	1424384	----a-w-	c:\windows\system32\WindowsCodecs.dll
2013-11-06 22:21 . 2013-04-17 07:02	1230336	----a-w-	c:\windows\SysWow64\WindowsCodecs.dll
2013-11-06 22:13 . 2012-08-23 13:24	15360	----a-w-	c:\windows\system32\RdpGroupPolicyExtension.dll
2013-11-06 22:13 . 2012-08-23 14:10	19456	----a-w-	c:\windows\system32\drivers\rdpvideominiport.sys
2013-11-06 22:13 . 2012-08-23 14:08	30208	----a-w-	c:\windows\system32\drivers\TsUsbGD.sys
2013-11-06 22:13 . 2012-08-23 14:13	243200	----a-w-	c:\windows\system32\rdpudd.dll
2013-11-06 22:13 . 2012-08-23 11:12	192000	----a-w-	c:\windows\SysWow64\rdpendp_winip.dll
2013-11-06 22:13 . 2012-08-23 10:51	228864	----a-w-	c:\windows\system32\rdpendp_winip.dll
2013-11-06 22:13 . 2012-08-23 09:51	3174912	----a-w-	c:\windows\system32\rdpcorets.dll
2013-11-06 17:57 . 2013-11-06 17:57	--------	d-----w-	c:\program files (x86)\MarkAny
2013-11-06 17:57 . 2013-11-06 17:57	--------	d-----w-	c:\program files (x86)\PC Connectivity Solution
2013-11-06 17:56 . 2013-11-08 01:33	--------	d-----w-	c:\program files (x86)\Samsung
2013-11-06 10:42 . 2013-11-06 11:03	--------	d-----w-	c:\windows\ERUNT
2013-11-05 20:30 . 2010-08-12 10:46	758272	----a-w-	c:\windows\system32\cohelper.dll
2013-11-05 20:30 . 2010-08-09 21:33	11164	----a-w-	c:\windows\system32\drivers\nvphy.bin
2013-11-05 20:29 . 2012-05-04 11:00	366592	----a-w-	c:\windows\system32\qdvd.dll
2013-11-05 20:29 . 2012-05-04 09:59	514560	----a-w-	c:\windows\SysWow64\qdvd.dll
2013-11-05 20:19 . 2013-11-06 00:27	--------	d-----w-	c:\program files (x86)\MSXML 4.0
2013-11-05 20:15 . 2013-11-13 10:32	--------	d-----w-	c:\windows\system32\MRT
2013-11-05 20:04 . 2013-11-13 12:08	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-05 20:04 . 2013-11-05 20:04	--------	d-----w-	c:\windows\system32\Macromed
2013-11-05 14:26 . 2013-11-24 04:31	--------	d-----w-	c:\users\UpdatusUser
2013-11-05 14:26 . 2013-11-05 14:26	--------	d-----w-	c:\program files (x86)\NVIDIA Corporation
2013-11-05 14:25 . 2007-06-11 22:01	--------	d-----w-	c:\programdata\NVIDIA
2013-11-05 14:24 . 2013-01-31 09:25	3300640	----a-w-	c:\windows\system32\nvsvc64.dll
2013-11-05 14:24 . 2013-01-31 09:24	878368	----a-w-	c:\windows\system32\nvvsvc.exe
2013-11-05 14:24 . 2013-01-31 09:24	63776	----a-w-	c:\windows\system32\nvshext.dll
2013-11-05 14:24 . 2013-01-31 09:24	2558240	----a-w-	c:\windows\system32\nvsvcr.dll
2013-11-05 14:24 . 2013-01-31 09:25	6207776	----a-w-	c:\windows\system32\nvcpl.dll
2013-11-05 14:24 . 2013-01-31 09:24	118560	----a-w-	c:\windows\system32\nvmctray.dll
2013-11-05 14:20 . 2013-02-19 21:32	53024	----a-w-	c:\windows\SysWow64\OpenCL.dll
2013-11-05 14:20 . 2013-02-19 21:32	61216	----a-w-	c:\windows\system32\OpenCL.dll
2013-11-05 14:18 . 2013-11-05 14:18	--------	d-----w-	c:\programdata\NVIDIA Corporation
2013-11-05 14:17 . 2013-11-05 20:30	--------	d-----w-	c:\program files\NVIDIA Corporation
2013-11-05 13:21 . 2013-11-05 23:14	--------	dc----w-	c:\windows\system32\DRVSTORE
2013-11-05 12:57 . 2013-11-05 13:20	--------	d-----w-	c:\windows\SysWow64\Samsung_USB_Drivers
2013-11-05 12:56 . 2010-07-04 18:11	25960	----a-w-	c:\windows\SysWow64\FsExService64.Exe
2013-11-05 12:56 . 2010-06-14 08:32	16448	----a-w-	c:\windows\SysWow64\drivers\TFsExDisk.Sys
2013-11-05 12:56 . 2013-11-05 12:56	--------	d-----w-	c:\windows\SysWow64\Macromed
2013-11-05 12:54 . 2013-11-12 11:28	--------	d-----w-	c:\program files (x86)\InstallShield Installation Information
2013-11-05 01:40 . 2013-09-04 12:11	99840	----a-w-	c:\windows\system32\drivers\usbccgp.sys
2013-11-05 01:40 . 2013-09-04 12:11	52736	----a-w-	c:\windows\system32\drivers\usbehci.sys
2013-11-05 01:40 . 2013-09-04 12:11	325120	----a-w-	c:\windows\system32\drivers\usbport.sys
2013-11-05 01:40 . 2013-09-04 12:12	343040	----a-w-	c:\windows\system32\drivers\usbhub.sys
2013-11-05 01:40 . 2013-09-04 12:11	30720	----a-w-	c:\windows\system32\drivers\usbuhci.sys
2013-11-05 01:40 . 2013-09-04 12:11	7808	----a-w-	c:\windows\system32\drivers\usbd.sys
2013-11-05 01:40 . 2013-09-04 12:11	25600	----a-w-	c:\windows\system32\drivers\usbohci.sys
2013-11-05 00:53 . 2013-11-05 00:53	--------	d-----w-	c:\program files (x86)\Common Files\Adobe
2013-11-04 21:10 . 2012-10-03 17:44	216576	----a-w-	c:\windows\system32\ncsi.dll
2013-11-04 21:10 . 2012-10-03 17:44	303104	----a-w-	c:\windows\system32\nlasvc.dll
2013-11-04 21:10 . 2012-10-03 17:44	246272	----a-w-	c:\windows\system32\netcorehc.dll
2013-11-04 21:10 . 2012-10-03 17:42	569344	----a-w-	c:\windows\system32\iphlpsvc.dll
2013-11-04 21:10 . 2012-10-03 16:42	156672	----a-w-	c:\windows\SysWow64\ncsi.dll
2013-11-04 21:10 . 2012-10-03 17:44	70656	----a-w-	c:\windows\system32\nlaapi.dll
2013-11-04 21:10 . 2012-10-03 16:42	18944	----a-w-	c:\windows\SysWow64\netevent.dll
2013-11-04 21:10 . 2012-10-03 16:42	175104	----a-w-	c:\windows\SysWow64\netcorehc.dll
2013-11-04 21:10 . 2012-10-03 16:07	45568	----a-w-	c:\windows\system32\drivers\tcpipreg.sys
2013-11-04 21:10 . 2012-01-13 07:12	52224	----a-w-	c:\windows\SysWow64\nlaapi.dll
2013-11-04 21:10 . 2012-10-03 17:44	18944	----a-w-	c:\windows\system32\netevent.dll
2013-11-04 20:56 . 2011-03-11 06:41	27008	----a-w-	c:\windows\system32\drivers\amdxata.sys
2013-11-04 20:56 . 2011-03-11 06:33	2565632	----a-w-	c:\windows\system32\esent.dll
2013-11-04 20:56 . 2011-03-11 06:30	96768	----a-w-	c:\windows\system32\fsutil.exe
2013-11-04 20:56 . 2011-03-11 05:33	1699328	----a-w-	c:\windows\SysWow64\esent.dll
2013-11-04 20:56 . 2011-03-11 06:41	189824	----a-w-	c:\windows\system32\drivers\storport.sys
2013-11-04 20:56 . 2011-03-11 06:41	148352	----a-w-	c:\windows\system32\drivers\nvraid.sys
2013-11-04 20:56 . 2011-03-11 06:41	410496	----a-w-	c:\windows\system32\drivers\iaStorV.sys
2013-11-04 20:56 . 2011-03-11 06:41	107904	----a-w-	c:\windows\system32\drivers\amdsata.sys
2013-11-04 20:56 . 2011-03-11 05:31	74240	----a-w-	c:\windows\SysWow64\fsutil.exe
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-11-11 04:50 . 2010-11-21 03:27	267936	------w-	c:\windows\system32\MpSigStub.exe
2013-11-04 09:04 . 2013-11-04 09:04	2560	----a-w-	c:\windows\SysWow64\drivers\de-DE\qwavedrv.sys.mui
2013-11-04 09:03 . 2013-11-04 09:03	5632	----a-w-	c:\windows\SysWow64\drivers\de-DE\ndiscap.sys.mui
2013-11-04 09:03 . 2013-11-04 09:03	2560	----a-w-	c:\windows\SysWow64\drivers\de-DE\scfilter.sys.mui
2013-11-04 09:03 . 2013-11-04 09:03	51712	----a-w-	c:\windows\SysWow64\drivers\de-DE\tcpip.sys.mui
2013-11-04 09:03 . 2013-11-04 09:03	29696	----a-w-	c:\windows\SysWow64\drivers\de-DE\bfe.dll.mui
2013-11-04 09:03 . 2013-11-04 09:03	16896	----a-w-	c:\windows\SysWow64\drivers\de-DE\pacer.sys.mui
2013-09-27 21:11 . 2013-09-27 21:11	2526056	----a-w-	c:\windows\system32\D3DCompiler_43.dll
2013-09-27 21:11 . 2013-09-27 21:11	2401112	----a-w-	c:\windows\system32\d3dx9_43.dll
2013-09-27 21:11 . 2013-09-27 21:11	2106216	----a-w-	c:\windows\SysWow64\D3DCompiler_43.dll
2013-09-27 21:11 . 2013-09-27 21:11	1998168	----a-w-	c:\windows\SysWow64\d3dx9_43.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-08-30 4858968]
"20131121"="c:\program files\AVAST Software\Avast\setup\emupdate\af3ef095-f2a9-4075-a8cd-a752c97f585c.exe" [2013-11-24 180184]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Secunia PSI Tray.lnk - c:\program files (x86)\Secunia\PSI\psi_tray.exe [2013-7-3 563416]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 cleanhlp;cleanhlp;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys;c:\program files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbdev.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 PSI;PSI;c:\windows\system32\DRIVERS\psi_mf_amd64.sys;c:\windows\SYSNATIVE\DRIVERS\psi_mf_amd64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bbus.sys [x]
R3 ss_bmdfl;SAMSUNG USB Mobile Modem (Filter);c:\windows\system32\DRIVERS\ss_bmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdfl.sys [x]
R3 ss_bmdm;SAMSUNG USB Mobile Modem;c:\windows\system32\DRIVERS\ss_bmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ss_bmdm.sys [x]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys;c:\windows\SYSNATIVE\Drivers\TFsExDisk.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
S0 aswRvrt;aswRvrt; [x]
S0 aswVmm;aswVmm; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 Secunia PSI Agent;Secunia PSI Agent;c:\program files (x86)\Secunia\PSI\PSIA.exe;c:\program files (x86)\Secunia\PSI\PSIA.exe [x]
S2 Secunia Update Agent;Secunia Update Agent;c:\program files (x86)\Secunia\PSI\sua.exe;c:\program files (x86)\Secunia\PSI\sua.exe [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-11-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-05 12:08]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-08-30 08:47	133840	----a-w-	c:\program files\AVAST Software\Avast\ashShA64.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: Interfaces\{768A88D4-DA67-4FCB-9406-F458691E4E25}: NameServer = 193.189.244.206 193.189.244.225
FF - ProfilePath - c:\users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\
FF - prefs.js: browser.search.selectedEngine - Startpage HTTPS - Deutsch
FF - prefs.js: browser.startup.homepage - hxxps://startpage.com/deu/.
FF - ExtSQL: 2013-11-06 12:42; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-11-06 12:50; {73a6fe31-595d-460b-a920-fcc0f8843232}; c:\users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF - ExtSQL: 2013-11-23 02:01; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-CleanHlp
SafeBoot-CleanHlp.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_152_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_152_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2013-11-27  09:38:14
ComboFix-quarantined-files.txt  2013-11-27 08:38
.
Vor Suchlauf: 9.356.472.320 Bytes frei
Nach Suchlauf: 9.282.387.968 Bytes frei
.
- - End Of File - - C69746087F8A50A4A694AE91C223DFCF
A36C5E4F47E84449FF07ED3517B43A31

Aneri · 27.11.2013, 10:41

warum ein Combofix Logfile? Ich habe keine Combofix angefordert. Es erschwert mir die Arbeit massiv! bitte keien selbstständige Ausführung der Tools

Hier nochmal meine Regeln:

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

Bitte arbeite alle Schritte der Reihe nach ab.
Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
Bitte kein Crossposting ( posten in mehreren Foren).
Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

hotte90 · 27.11.2013, 10:54

Ja, schon klar! Ich hatte vorher schon gmer & Combofix laufen lassen, deshalb hatte ich das Log gepostet.

FRST Teil 1:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-11-2013
Ran by root (administrator) on ROOT-PC on 27-11-2013 08:53:23
Running from C:\Users\root\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieCtrl.exe

==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968 2013-08-30] (AVAST Software)
HKLM-x32\...\Run: [20131121] - C:\Program Files\AVAST Software\Avast\Setup\emupdate\af3ef095-f2a9-4075-a8cd-a752c97f585c.exe [180184 2013-11-24] (AVAST Software)
HKU\bash\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{768A88D4-DA67-4FCB-9406-F458691E4E25}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default
FF DefaultSearchEngine: Startpage HTTPS - Deutsch
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Homepage: https://startpage.com/deu/.
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: noscript - C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Adblock Plus - C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
S2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] ()
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-27 08:53 - 2013-11-27 08:54 - 00007894 _____ C:\Users\root\Desktop\FRST.txt
2013-11-27 08:52 - 2013-11-27 08:52 - 00000000 ____D C:\FRST
2013-11-27 08:47 - 2013-11-27 08:47 - 00377856 _____ C:\Users\root\Desktop\r3p6rlf2.exe
2013-11-27 08:47 - 2013-11-27 08:43 - 01958818 _____ (Farbar) C:\Users\root\Desktop\FRST64.exe
2013-11-27 08:37 - 2013-11-27 08:37 - 00000754 _____ C:\Users\root\Desktop\JRT.txt
2013-11-27 08:28 - 2013-10-20 23:47 - 01033335 _____ (Thisisu) C:\Users\root\Desktop\JRT.exe
2013-11-27 08:09 - 2013-11-27 08:10 - 00000000 ____D C:\AdwCleaner
2013-11-25 09:52 - 2013-11-25 09:53 - 00000000 ____D C:\Program Files\ProduKey
2013-11-25 09:51 - 2013-11-25 09:51 - 00071105 _____ C:\Users\bash\Downloads\produkey-x64.zip
2013-11-25 09:48 - 2013-11-25 09:48 - 00001500 _____ C:\Users\bash\Downloads\produkey_german.zip
2013-11-25 08:51 - 2013-10-07 20:06 - 00448512 _____ (OldTimer Tools) C:\Program Files\TFC.exe
2013-11-24 20:44 - 2013-11-24 20:44 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 18:41 - 2013-11-24 21:28 - 00000000 ____D C:\Users\root\Desktop\mbar
2013-11-24 18:38 - 2013-11-24 18:39 - 00000000 ____D C:\Users\root\AppData\Roaming\TrueCrypt
2013-11-24 18:29 - 2013-10-20 23:49 - 12576792 _____ (Malwarebytes Corp.) C:\Users\root\Desktop\mbar-1.07.0.1007.exe
2013-11-24 17:46 - 2013-11-27 08:11 - 00003117 _____ C:\Windows\setupact.log
2013-11-24 17:46 - 2013-11-24 17:46 - 00000000 _____ C:\Windows\setuperr.log
2013-11-24 17:45 - 2013-11-24 17:45 - 00058016 _____ C:\Users\bash\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-24 17:43 - 2009-10-21 17:16 - 00243200 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbnet.sys
2013-11-24 17:43 - 2009-10-12 15:23 - 00114304 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbdev.sys
2013-11-24 17:43 - 2009-09-10 15:31 - 00117248 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbmdm.sys
2013-11-24 17:43 - 2007-08-09 04:10 - 00029696 _____ (Huawei Tech. Co., Ltd.) C:\Windows\system32\Drivers\ewdcsc.sys
2013-11-24 06:57 - 2013-10-20 23:23 - 01056666 _____ C:\Users\root\Desktop\AdwCleaner.exe
2013-11-24 05:23 - 2013-11-24 05:23 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-11-24 04:56 - 2013-11-24 05:25 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-11-24 04:55 - 2013-11-24 04:55 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ROOT-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-11-24 04:16 - 2013-11-24 04:16 - 00002163 _____ C:\Users\root\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2013-11-24 04:16 - 2013-11-24 04:16 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-11-24 04:15 - 2013-11-24 04:13 - 05045639 _____ C:\Users\bash\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 03:59 - 2013-11-24 04:13 - 05045639 _____ C:\Users\root\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 02:59 - 2013-11-24 02:59 - 00034745 _____ C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board.htm
2013-11-24 02:58 - 2013-11-24 02:59 - 00000000 ____D C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board-Dateien
2013-11-23 20:18 - 2013-11-23 20:18 - 00000000 ____D C:\Users\bash\AppData\Roaming\Malwarebytes
2013-11-23 10:14 - 2013-11-24 05:27 - 00275856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-23 06:25 - 2013-11-24 06:38 - 00000000 ____D C:\Users\bash\AppData\Roaming\vlc
2013-11-23 06:11 - 2013-11-23 06:11 - 00000000 ____D C:\Users\bash\Documents\default
2013-11-23 06:03 - 2013-11-23 07:21 - 21978136 _____ (Mozilla) C:\Users\bash\Downloads\Thunderbird_Setup_24.1.1.exe
2013-11-23 05:32 - 2013-11-23 07:05 - 00000000 ____D C:\Users\bash\AppData\Local\Microsoft Games
2013-11-23 04:29 - 2013-11-23 04:29 - 00000000 ____D C:\Users\bash\AppData\Roaming\NVIDIA
2013-11-23 03:59 - 2013-11-23 04:08 - 00000000 ____D C:\Users\bash\AppData\Local\Thunderbird
2013-11-23 03:59 - 2013-11-23 03:59 - 00000000 ____D C:\Users\bash\AppData\Roaming\Thunderbird
2013-11-23 03:42 - 2013-11-24 23:11 - 00000000 ____D C:\Users\bash\AppData\Roaming\Skype
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Roaming\Macromedia
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Local\Macromedia
2013-11-23 02:52 - 2013-11-23 02:52 - 00000000 ____D C:\Users\bash\AppData\Roaming\Ashampoo
2013-11-23 02:46 - 2013-11-23 02:48 - 00000000 ____D C:\Users\bash\AppData\Local\Mozilla
2013-11-23 02:46 - 2013-11-23 02:46 - 00000000 ____D C:\Users\bash\AppData\Roaming\Mozilla
2013-11-23 02:44 - 2013-11-23 07:32 - 00000000 ____D C:\Users\bash\Documents\Calibre-Bibliothek
2013-11-23 02:44 - 2013-11-23 07:15 - 00000000 ____D C:\Users\bash\AppData\Roaming\calibre
2013-11-23 02:44 - 2013-11-23 07:12 - 00000000 ____D C:\Users\bash\AppData\Local\calibre-cache
2013-11-23 02:40 - 2013-11-23 04:29 - 00000000 ____D C:\Users\bash
2013-11-23 02:40 - 2013-11-23 02:41 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 02:40 - 2013-11-23 02:41 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-23 02:40 - 2013-11-23 02:40 - 00001425 _____ C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-23 02:40 - 2013-11-23 02:40 - 00000020 ___SH C:\Users\bash\ntuser.ini
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Vorlagen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Startmenü
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Netzwerkumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Lokale Einstellungen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Eigene Dateien
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Druckumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Musik
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Bilder
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Verlauf
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Roaming\Adobe
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Local\VirtualStore
2013-11-23 02:40 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-23 02:40 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-23 02:26 - 2013-11-23 02:26 - 00233056 _____ (Kaspersky Lab, Yury Parshin) C:\Windows\system32\Drivers\66210953.sys
2013-11-23 02:02 - 2013-11-25 14:02 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-11-23 02:02 - 2013-08-30 09:48 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00204880 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00080816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00072016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00064288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00033400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-11-23 02:00 - 2013-10-07 20:06 - 00448512 _____ (OldTimer Tools) C:\Users\root\Desktop\TFC.exe
2013-11-23 02:00 - 2013-08-30 09:47 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-11-23 01:59 - 2013-11-23 01:59 - 00000000 ____D C:\Program Files\AVAST Software
2013-11-23 01:58 - 2013-11-23 01:59 - 00000000 ____D C:\ProgramData\AVAST Software
2013-11-13 17:09 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-11-13 17:09 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-11-13 17:09 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-11-13 17:09 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-11-13 17:09 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-11-13 17:09 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-11-13 17:09 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-11-13 17:09 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-11-13 17:09 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-11-13 17:09 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-11-13 17:09 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-11-13 17:09 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-11-13 17:09 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-11-13 17:09 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-11-13 17:08 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2013-11-13 17:08 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2013-11-13 17:08 - 2013-10-01 21:57 - 06578176 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-11-13 17:08 - 2013-10-01 21:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-11-13 17:06 - 2013-09-25 03:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2013-11-13 17:06 - 2013-09-25 02:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2013-11-13 13:25 - 2013-11-13 13:25 - 00000000 ____D C:\Program Files\Sandboxie
2013-11-13 13:16 - 2013-11-13 18:17 - 01591948 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-11-13 13:07 - 2013-11-27 08:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-13 13:07 - 2013-11-13 13:08 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-13 11:27 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 11:27 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 11:27 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 11:27 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 11:27 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 11:27 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 11:27 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 11:27 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 11:27 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 11:27 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 11:27 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 11:27 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 11:27 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 11:27 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 11:27 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 11:27 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 11:27 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 11:27 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 11:27 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 11:27 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 11:27 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 11:27 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 11:27 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 11:27 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 11:27 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 11:27 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 11:27 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 11:27 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 11:27 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 11:27 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-12 13:49 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-11-12 13:41 - 2013-11-12 13:41 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-11 18:27 - 2013-11-11 18:27 - 00000000 ____D C:\Program Files\Calibre2
2013-11-09 01:12 - 2013-11-09 01:12 - 00000000 ____D C:\Program Files (x86)\SoundSpectrum
2013-11-08 22:11 - 2013-11-24 18:37 - 00000000 ____D C:\Users\root\AppData\Roaming\Skype
2013-11-08 22:01 - 2013-11-23 07:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-11-08 04:21 - 2013-11-08 04:21 - 00000000 ____D C:\Users\root\AppData\Local\WindowsUpdate
2013-11-08 02:40 - 2013-11-08 03:33 - 00000000 ____D C:\Users\root\Documents\NPS
2013-11-08 02:39 - 2013-11-08 02:39 - 00000000 ____D C:\Users\root\Documents\My Art
2013-11-08 02:34 - 2010-04-27 03:25 - 00161280 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bmdm.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00127488 _____ (MCCI) C:\Windows\system32\Drivers\ss_bbus.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00018944 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bmdfl.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015872 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bwhnt.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015872 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bwh.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015360 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bcmnt.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015360 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bcm.sys
2013-11-08 02:33 - 2013-11-08 02:33 - 00000000 ____D C:\ProgramData\Samsung
2013-11-08 02:32 - 2013-11-08 02:32 - 00000000 ____D C:\Users\root\Documents\My NPS Files
2013-11-08 02:32 - 2010-07-04 19:11 - 00025960 _____ (Teruten Inc) C:\Windows\system32\FsExService64.exe
2013-11-08 02:32 - 2010-06-14 09:32 - 00016448 _____ (Teruten Inc) C:\Windows\system32\Drivers\TFsExDisk.sys
2013-11-08 02:31 - 2013-11-08 02:31 - 00000000 ____D C:\Users\root\Documents\Samsung
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ____D C:\ProgramData\Skype
2013-11-07 18:38 - 2013-11-07 18:38 - 00003140 _____ C:\Windows\System32\Tasks\{6A53125F-7484-4EC3-8E03-BE28CCBFB6DC}
2013-11-07 17:50 - 2013-11-07 17:50 - 00003062 _____ C:\Windows\System32\Tasks\{C23BCD1D-0C2D-434B-B9EE-898DE337123E}
2013-11-07 17:45 - 2013-11-07 17:45 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-07 17:15 - 2013-11-07 17:15 - 00000000 ____D C:\Users\root\AppData\Local\Macromedia
2013-11-07 16:22 - 2013-11-07 16:22 - 00000018 _____ C:\Users\root\Documents\hide.txt
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagwrn.xml
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagerr.xml
2013-11-06 23:21 - 2013-04-17 08:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-11-06 23:21 - 2013-04-17 07:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-11-06 23:13 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-11-06 23:13 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-11-06 23:13 - 2012-08-23 15:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-11-06 23:13 - 2012-08-23 14:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-11-06 23:13 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-11-06 23:13 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-11-06 23:13 - 2012-08-23 10:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 19:08 - 2013-11-06 19:07 - 00105472 _____ C:\1031.MST
2013-11-06 19:08 - 2013-11-06 19:06 - 00015832 _____ C:\0x0407.ini
2013-11-06 19:01 - 2013-11-06 19:01 - 00002528 _____ C:\Users\root\AppData\Roaming\$_hpcst$.hpc
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\PC Connectivity Solution
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\MarkAny
2013-11-06 18:56 - 2013-11-08 02:33 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-11-06 18:45 - 2013-11-08 02:36 - 00000000 ____D C:\Users\root\AppData\Local\Downloaded Installations
2013-11-06 15:07 - 2013-11-06 15:07 - 00003140 _____ C:\Windows\System32\Tasks\{C1B0B6AE-3F6E-4209-B49D-68BDE5693F90}
2013-11-06 13:25 - 2013-11-07 18:13 - 00000000 ____D C:\Users\root\AppData\Local\Adobe
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{AB9543D6-AC8E-41B1-BFEE-823A469AEC02}
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{7DB0268B-BD2B-4233-B755-AF2F8410039D}
2013-11-06 11:51 - 2013-11-08 03:25 - 00000000 ____D C:\Windows\erdnt
2013-11-06 11:42 - 2013-11-06 12:03 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 09:37 - 2013-11-06 09:37 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-11-06 01:22 - 2013-11-06 01:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Malwarebytes
2013-11-05 21:30 - 2010-08-12 11:46 - 00758272 _____ (NVIDIA Corporation) C:\Windows\system32\cohelper.dll
2013-11-05 21:30 - 2010-08-09 22:33 - 00011164 _____ C:\Windows\system32\Drivers\nvphy.bin
2013-11-05 21:29 - 2012-05-04 12:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-11-05 21:29 - 2012-05-04 10:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-11-05 21:19 - 2013-11-06 01:27 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-11-05 21:15 - 2013-11-13 11:32 - 00000000 ____D C:\Windows\system32\MRT
2013-11-05 21:15 - 2013-11-13 11:29 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-05 21:04 - 2013-11-13 13:08 - 00692616 _____ (Adobe Systems Incorporated) C:\Window

hotte90 · 27.11.2013, 10:58

FRST Teil2:

Code:

ATTFilter

\SysWOW64\FlashPlayerApp.exe
2013-11-05 21:04 - 2013-11-13 13:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-05 21:04 - 2013-11-05 21:04 - 00000000 ____D C:\Windows\system32\Macromed
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Anwendungsdaten
2013-11-05 15:26 - 2013-11-05 15:26 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-11-05 15:25 - 2007-06-11 23:01 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-05 15:24 - 2013-01-31 10:25 - 06207776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2013-11-05 15:24 - 2013-01-31 10:25 - 03300640 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2013-11-05 15:24 - 2013-01-31 10:24 - 02558240 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2013-11-05 15:24 - 2013-01-31 10:24 - 00878368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2013-11-05 15:24 - 2013-01-31 10:24 - 00118560 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2013-11-05 15:24 - 2013-01-31 10:24 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2013-11-05 15:20 - 2013-02-19 22:32 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2013-11-05 15:20 - 2013-02-19 22:32 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2013-11-05 15:18 - 2013-11-05 15:18 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-11-05 15:17 - 2013-11-05 21:30 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-11-05 14:24 - 2013-11-05 14:24 - 00000000 ____D C:\Users\root\AppData\Roaming\PC Suite
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Macromedia
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Adobe
2013-11-05 13:56 - 2013-11-08 02:32 - 00000000 ____D C:\Users\root\AppData\Roaming\Samsung
2013-11-05 13:56 - 2013-11-05 13:56 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-11-05 13:56 - 2010-07-04 19:11 - 00025960 _____ (Teruten Inc) C:\Windows\SysWOW64\FsExService64.Exe
2013-11-05 13:56 - 2010-06-14 09:32 - 00016448 _____ (Teruten Inc) C:\Windows\SysWOW64\Drivers\TFsExDisk.Sys
2013-11-05 13:54 - 2013-11-12 12:28 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2013-11-05 02:40 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-11-04 22:19 - 2012-12-07 14:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2013-11-04 22:19 - 2012-12-07 14:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2013-11-04 22:19 - 2012-12-07 13:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2013-11-04 22:19 - 2012-12-07 13:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2013-11-04 22:19 - 2012-12-07 12:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2013-11-04 22:10 - 2012-10-03 18:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2013-11-04 22:10 - 2012-10-03 18:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2013-11-04 22:10 - 2012-10-03 17:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2013-11-04 22:10 - 2012-10-03 17:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2013-11-04 22:10 - 2012-10-03 17:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2013-11-04 22:10 - 2012-10-03 17:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2013-11-04 22:10 - 2012-01-13 08:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2013-11-04 21:56 - 2011-03-11 07:41 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00189824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2013-11-04 21:56 - 2011-03-11 07:33 - 02565632 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2013-11-04 21:56 - 2011-03-11 07:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2013-11-04 21:56 - 2011-03-11 06:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2013-11-04 21:56 - 2011-03-11 06:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
2013-11-04 21:56 - 2011-03-11 05:37 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2013-11-04 21:27 - 2012-03-01 07:46 - 00023408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2013-11-04 21:27 - 2012-03-01 07:33 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-11-04 21:27 - 2012-03-01 07:28 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2013-11-04 21:27 - 2012-03-01 06:33 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-11-04 21:27 - 2012-03-01 06:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
2013-11-04 20:59 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-04 20:59 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-04 20:59 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-04 20:59 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-04 20:58 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-04 20:58 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-04 20:58 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-04 20:58 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-04 20:58 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-04 20:58 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-04 20:58 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-04 20:58 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-04 20:58 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-04 20:58 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-04 20:58 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-04 20:58 - 2012-11-30 06:45 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-11-04 20:58 - 2012-11-30 06:45 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-11-04 20:58 - 2012-11-30 06:43 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-11-04 20:50 - 2012-11-30 00:17 - 00420064 _____ C:\Windows\SysWOW64\locale.nls
2013-11-04 20:50 - 2012-11-30 00:15 - 00420064 _____ C:\Windows\system32\locale.nls
2013-11-04 20:47 - 2013-02-27 07:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2013-11-04 20:47 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2013-11-04 20:40 - 2013-04-26 00:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-04 20:40 - 2013-03-31 23:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-04 20:33 - 2012-01-04 11:44 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2013-11-04 20:33 - 2012-01-04 09:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2013-11-04 20:29 - 2013-05-10 06:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-11-04 20:29 - 2013-05-10 04:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-11-04 20:20 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-11-04 20:20 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-11-04 20:20 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-11-04 20:20 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-11-04 20:20 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-11-04 20:20 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-11-04 20:20 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-11-04 20:20 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-11-04 20:20 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-11-04 20:20 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-11-04 20:17 - 2012-11-02 06:59 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2013-11-04 20:17 - 2012-11-02 06:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2013-11-04 20:17 - 2011-02-25 07:19 - 02871808 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-11-04 20:17 - 2011-02-25 06:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-11-04 20:16 - 2012-05-01 06:40 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2013-11-04 20:15 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-11-04 20:15 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-11-04 20:15 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-11-04 20:15 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-11-04 20:15 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-11-04 20:15 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-11-04 20:15 - 2012-08-22 19:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-11-04 20:15 - 2012-07-04 21:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2013-11-04 20:15 - 2011-07-09 03:46 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2013-11-04 20:15 - 2011-04-27 03:40 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2013-11-04 20:15 - 2011-04-27 03:39 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2013-11-04 20:13 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-11-04 20:13 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-11-04 20:13 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-11-04 20:13 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-11-04 20:13 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-11-04 20:13 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2013-11-04 19:52 - 2010-02-23 09:16 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\browserchoice.exe
2013-11-04 19:49 - 2012-07-26 04:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2013-11-04 19:49 - 2012-07-26 04:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2013-11-04 19:49 - 2012-07-26 04:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2013-11-04 19:49 - 2012-07-26 04:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2013-11-04 19:49 - 2012-07-26 04:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2013-11-04 19:49 - 2012-07-26 03:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2013-11-04 19:49 - 2012-07-26 03:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2013-11-04 19:49 - 2012-06-02 15:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2013-11-04 19:31 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-11-04 19:31 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-11-04 19:31 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-11-04 19:31 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-11-04 19:30 - 2011-05-04 06:25 - 02315776 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 02223616 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2013-11-04 19:30 - 2011-05-04 06:19 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2013-11-04 19:30 - 2011-05-04 06:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2013-11-04 19:30 - 2011-05-04 06:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2013-11-04 19:30 - 2011-05-04 05:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2013-11-04 19:30 - 2011-05-04 05:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2013-11-04 19:30 - 2011-05-04 05:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2013-11-04 19:30 - 2011-05-04 05:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2013-11-04 19:28 - 2012-11-01 06:43 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2013-11-04 19:28 - 2012-11-01 06:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2013-11-04 19:28 - 2012-11-01 05:47 - 01389568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2013-11-04 19:28 - 2012-11-01 05:47 - 01236992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2013-11-04 19:28 - 2010-06-26 04:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2013-11-04 19:28 - 2010-06-26 04:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2013-11-04 19:26 - 2011-04-09 07:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2013-11-04 19:26 - 2011-04-09 06:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2013-11-04 19:25 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-11-04 19:25 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-11-04 19:25 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-11-04 19:25 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-11-04 19:25 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-11-04 19:25 - 2013-08-02 01:43 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 01:43 - 00004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 01:43 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 01:43 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\odbctrac.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccu32.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccr32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00319488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcjt32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbctrac.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccp32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccu32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccr32.dll
2013-11-04 19:20 - 2012-11-22 06:44 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2013-11-04 19:19 - 2012-11-22 05:45 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2013-11-04 19:09 - 2012-06-06 07:02 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2013-11-04 19:09 - 2012-06-06 06:03 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2013-11-04 19:05 - 2011-04-29 04:06 - 00467456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2013-11-04 19:05 - 2011-04-29 04:05 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2013-11-04 19:05 - 2011-04-29 04:05 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2013-11-04 18:38 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-11-04 18:38 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-11-04 18:31 - 2013-11-23 02:35 - 00000000 ____D C:\Windows\Panther
2013-11-04 18:27 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-04 18:27 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-04 18:27 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-04 18:24 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-11-04 18:24 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-11-04 18:24 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-11-04 18:24 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-11-04 18:22 - 2010-12-23 11:42 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\sbe.dll
2013-11-04 18:22 - 2010-12-23 11:42 - 00961024 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2013-11-04 18:22 - 2010-12-23 11:36 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\mpg2splt.ax
2013-11-04 18:22 - 2010-12-23 06:54 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sbe.dll
2013-11-04 18:22 - 2010-12-23 06:54 - 00642048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2013-11-04 18:22 - 2010-12-23 06:50 - 00199680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mpg2splt.ax
2013-11-04 18:18 - 2012-10-09 19:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2013-11-04 18:18 - 2012-10-09 19:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2013-11-04 18:18 - 2012-10-09 18:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2013-11-04 18:18 - 2012-10-09 18:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2013-11-04 18:18 - 2011-11-17 07:35 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2013-11-04 18:18 - 2011-11-17 06:35 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2013-11-04 18:17 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-11-04 18:17 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-11-04 18:17 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-11-04 18:17 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-11-04 18:17 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-11-04 18:17 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-11-04 18:17 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-11-04 18:16 - 2011-03-11 07:34 - 01395712 _____ (Microsoft Corporation) C:\Windows\system32\mfc42.dll
2013-11-04 18:16 - 2011-03-11 07:34 - 01359872 _____ (Microsoft Corporation) C:\Windows\system32\mfc42u.dll
2013-11-04 18:16 - 2011-03-11 06:33 - 01164288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll
2013-11-04 18:16 - 2011-03-11 06:33 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll
2013-11-04 18:15 - 2013-01-03 07:00 - 00288088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2013-11-04 18:15 - 2012-08-22 19:12 - 00376688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2013-11-04 18:15 - 2011-10-26 06:25 - 01572864 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2013-11-04 18:15 - 2011-10-26 05:32 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2013-11-04 18:14 - 2011-10-15 07:31 - 00723456 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2013-11-04 18:14 - 2011-10-15 06:38 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2013-11-04 18:12 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-11-04 18:11 - 2013-01-24 07:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-11-04 18:08 - 2012-08-11 01:56 - 00715776 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2013-11-04 18:08 - 2012-08-11 00:56 - 00542208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2013-11-04 18:08 - 2011-12-16 09:46 - 00634880 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2013-11-04 18:08 - 2011-12-16 08:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2013-11-04 18:08 - 2011-02-05 18:10 - 00642944 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-11-04 18:08 - 2011-02-05 18:10 - 00020352 _____ (Microsoft Corporation) C:\Windows\system32\kdusb.dll
2013-11-04 18:08 - 2011-02-05 18:10 - 00019328 _____ (Microsoft Corporation) C:\Windows\system32\kd1394.dll
2013-11-04 18:08 - 2011-02-05 18:10 - 00017792 _____ (Microsoft Corporation) C:\Windows\system32\kdcom.dll
2013-11-04 18:08 - 2011-02-05 18:06 - 00605552 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-11-04 18:08 - 2011-02-05 18:06 - 00566208 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-11-04 18:08 - 2011-02-05 18:06 - 00518672 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-11-04 18:07 - 2011-05-03 06:29 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2013-11-04 18:07 - 2011-05-03 05:30 - 00741376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2013-11-04 18:07 - 2011-02-12 12:34 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOVER.exe
2013-11-04 18:05 - 2013-04-12 15:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2013-11-04 18:05 - 2012-09-25 23:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2013-11-04 18:05 - 2012-09-25 23:46 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2013-11-04 18:05 - 2012-07-04 23:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2013-11-04 18:05 - 2012-07-04 23:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll
2013-11-04 18:05 - 2012-07-04 23:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll
2013-11-04 18:05 - 2012-07-04 22:16 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2013-11-04 18:05 - 2012-07-04 22:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2013-11-04 18:05 - 2012-05-05 09:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2013-11-04 18:05 - 2012-05-05 08:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2013-11-04 18:05 - 2011-05-24 12:42 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2013-11-04 18:05 - 2011-05-24 11:40 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devobj.dll
2013-11-04 18:05 - 2011-05-24 11:40 - 00044544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devrtl.dll
2013-11-04 18:05 - 2011-05-24 11:39 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cfgmgr32.dll
2013-11-04 18:05 - 2011-05-24 11:37 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvinst.exe
2013-11-04 18:03 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-11-04 18:02 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-11-04 18:02 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-11-04 18:02 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-11-04 18:02 - 2013-02-12 05:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2013-11-04 18:02 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-11-04 18:02 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-11-04 18:02 - 2012-11-28 23:56 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2013-11-04 18:02 - 2012-05-14 06:26 - 00956928 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2013-11-04 18:02 - 2012-04-07 13:31 - 03216384 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2013-11-04 18:02 - 2012-04-07 12:26 - 02342400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2013-11-04 18:02 - 2011-08-27 06:37 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-11-04 18:02 - 2011-08-27 06:37 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2013-11-04 18:02 - 2011-08-27 05:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-11-04 18:02 - 2011-08-27 05:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll
2013-11-04 18:02 - 2011-08-17 06:26 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2013-11-04 18:02 - 2011-08-17 06:25 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2013-11-04 18:02 - 2011-08-17 05:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisdecd.dll
2013-11-04 18:02 - 2011-08-17 05:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisrndr.ax
2013-11-04 18:01 - 2012-04-28 04:55 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2013-11-04 18:00 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-11-04 18:00 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2013-11-04 18:00 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-11-04 17:58 - 2012-08-21 22:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2013-11-04 17:58 - 2011-12-30 07:26 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2013-11-04 17:58 - 2011-12-30 06:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2013-11-04 17:56 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-11-04 17:56 - 2011-02-18 11:51 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe
2013-11-04 17:56 - 2011-02-18 06:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
2013-11-04 17:55 - 2013-07-19 02:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-11-04 17:55 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-11-04 17:55 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-11-04 17:55 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-11-04 17:55 - 2013-03-19 06:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-11-04 17:55 - 2013-03-19 06:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2013-11-04 17:55 - 2012-03-17 08:58 - 00075120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2013-11-04 17:55 - 2011-04-22 23:15 - 00027520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2013-11-04 17:53 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-11-04 17:04 - 2012-02-11 07:36 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2013-11-04 17:04 - 2012-02-11 07:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2013-11-04 17:04 - 2011-06-16 06:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2013-11-04 17:04 - 2011-06-16 05:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xmllite.dll
2013-11-04 17:03 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-11-04 17:03 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-11-04 17:03 - 2011-03-03 07:24 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2013-11-04 17:03 - 2011-03-03 07:24 - 00183296 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2013-11-04 17:03 - 2011-03-03 07:21 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\dnscacheugc.exe
2013-11-04 17:03 - 2011-03-03 06:38 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2013-11-04 17:03 - 2011-03-03 06:36 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscacheugc.exe
2013-11-04 17:03 - 2011-02-23 05:55 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2013-11-04 17:02 - 2012-04-26 06:41 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2013-11-04 17:02 - 2012-04-26 06:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2013-11-04 17:02 - 2012-04-26 06:34 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\rdrmemptylst.exe
2013-11-04 16:53 - 2011-11-19 15:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2013-11-04 16:53 - 2011-11-19 15:01 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2013-11-04 14:22 - 2012-02-17 07:38 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2013-11-04 14:22 - 2012-02-17 06:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2013-11-04 14:22 - 2012-02-17 05:57 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2013-11-04 13:25 - 2012-06-02 23:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-11-04 13:25 - 2012-06-02 23:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-11-04 13:25 - 2012-06-02 23:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-11-04 13:25 - 2012-06-02 23:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-11-04 13:24 - 2012-06-02 23:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-11-04 13:24 - 2012-06-02 23:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-11-04 13:24 - 2012-06-02 23:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-11-04 13:24 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-11-04 13:24 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-11-04 12:08 - 2013-11-24 17:52 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-11-04 11:54 - 2013-11-04 11:54 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-11-04 11:13 - 2013-11-04 11:13 - 00003042 _____ C:\Windows\System32\Tasks\PandaUSBVaccine
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-04 11:11 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-04 11:09 - 2013-11-04 11:09 - 00003144 _____ C:\Windows\System32\Tasks\{57FC9078-E624-4E00-B291-10674066045C}
2013-11-04 11:08 - 2013-11-04 11:08 - 00000000 ____D C:\ProgramData\Sun
2013-11-04 11:07 - 2013-11-04 11:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-04 11:07 - 2013-11-04 11:07 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-04 11:06 - 2013-11-24 20:17 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-04 11:06 - 2013-11-04 11:06 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-11-04 11:05 - 2013-11-23 04:23 - 00000000 ___RD C:\Sandbox
2013-11-04 11:05 - 2013-11-04 11:06 - 00000000 ____D C:\Program Files\TrueCrypt
2013-11-04 11:04 - 2013-11-27 08:36 - 00003180 _____ C:\Windows\Sandboxie.ini
2013-11-04 10:55 - 2013-11-04 10:55 - 00000000 ____D C:\Program Files\Tracker Software
2013-11-04 10:54 - 2013-11-09 18:46 - 00000000 ____D C:\Users\root\AppData\Roaming\vlc
2013-11-04 10:54 - 2013-11-04 10:54 - 00000000 ____D C:\Program Files\VideoLAN
2013-11-04 10:51 - 2013-11-04 10:52 - 00000000 ____D C:\Program Files\GIMP 2
2013-11-04 10:51 - 2013-11-04 10:51 - 00000000 ____D C:\Users\root\AppData\Local\Secunia PSI
2013-11-04 10:50 - 2013-11-04 10:50 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-11-04 10:49 - 2013-11-23 07:23 - 00000000 ____D C:\Users\root\AppData\Local\Thunderbird
2013-11-04 10:49 - 2013-11-04 10:49 - 00000000 ____D C:\Users\root\AppData\Roaming\Thunderbird
2013-11-04 10:46 - 2013-11-04 10:46 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AbiWord Word Processor
2013-11-04 10:45 - 2013-11-04 10:45 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-04 10:45 - 2013-11-04 10:45 - 00000000 ____D C:\Program Files\CCleaner
2013-11-04 10:36 - 2013-11-04 10:39 - 00000000 ____D C:\Users\root\AppData\Local\Mozilla
2013-11-04 10:36 - 2013-11-04 10:37 - 00000000 ____D C:\Users\root\AppData\Roaming\Mozilla
2013-11-04 10:35 - 2013-11-23 10:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-04 10:35 - 2013-11-23 03:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-04 10:35 - 2013-11-04 10:35 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-04 10:31 - 2013-11-04 10:46 - 00000000 ____D C:\Program Files (x86)\AbiWord
2013-11-04 10:30 - 2013-11-04 10:30 - 00000000 ____D C:\Program Files\7-Zip
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Roaming\Ashampoo
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Local\ashampoo
2013-11-04 10:28 - 2013-11-04 10:29 - 00000000 ____D C:\ProgramData\Ashampoo
2013-11-04 10:28 - 2013-11-04 10:28 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2013-11-04 10:21 - 2013-11-23 02:02 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-11-04 10:21 - 2013-08-30 09:47 - 00287840 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-11-04 10:08 - 2013-11-27 08:51 - 00685230 _____ C:\Windows\system32\perfh007.dat
2013-11-04 10:08 - 2013-11-27 08:51 - 00145062 _____ C:\Windows\system32\perfc007.dat
2013-11-04 10:08 - 2013-11-04 10:04 - 00295922 _____ C:\Windows\system32\perfi007.dat
2013-11-04 10:08 - 2013-11-04 10:04 - 00038104 _____ C:\Windows\system32\perfd007.dat
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\de
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\de
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\0407
2013-11-04 09:45 - 2013-11-23 01:46 - 00001425 _____ C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-04 09:45 - 2013-11-07 17:46 - 00000000 ____D C:\Users\root\AppData\Local\VirtualStore
2013-11-04 09:45 - 2013-11-05 02:15 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-04 09:45 - 2013-11-05 02:15 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-04 09:44 - 2013-11-13 19:08 - 00000000 ____D C:\Users\root
2013-11-04 09:44 - 2013-11-04 09:44 - 00000020 ___SH C:\Users\root\ntuser.ini
2013-11-04 09:44 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-04 09:44 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-04 09:37 - 2013-11-04 09:37 - 00000000 _____ C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2013-11-04 09:36 - 2013-11-27 08:25 - 01484189 _____ C:\Windows\WindowsUpdate.log

==================== One Month Modified Files and Folders =======

2013-11-27 08:54 - 2013-11-27 08:53 - 00007894 _____ C:\Users\root\Desktop\FRST.txt
2013-11-27 08:52 - 2013-11-27 08:52 - 00000000 ____D C:\FRST
2013-11-27 08:51 - 2013-11-04 10:08 - 00685230 _____ C:\Windows\system32\perfh007.dat
2013-11-27 08:51 - 2013-11-04 10:08 - 00145062 _____ C:\Windows\system32\perfc007.dat
2013-11-27 08:51 - 2009-07-14 06:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-27 08:47 - 2013-11-27 08:47 - 00377856 _____ C:\Users\root\Desktop\r3p6rlf2.exe
2013-11-27 08:43 - 2013-11-27 08:47 - 01958818 _____ (Farbar) C:\Users\root\Desktop\FRST64.exe
2013-11-27 08:37 - 2013-11-27 08:37 - 00000754 _____ C:\Users\root\Desktop\JRT.txt
2013-11-27 08:36 - 2013-11-04 11:04 - 00003180 _____ C:\Windows\Sandboxie.ini
2013-11-27 08:25 - 2013-11-04 09:36 - 01484189 _____ C:\Windows\WindowsUpdate.log
2013-11-27 08:18 - 2013-11-13 13:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-27 08:17 - 2009-07-14 05:45 - 00028320 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-27 08:17 - 2009-07-14 05:45 - 00028320 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-27 08:12 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-27 08:11 - 2013-11-24 17:46 - 00003117 _____ C:\Windows\setupact.log
2013-11-27 08:10 - 2013-11-27 08:09 - 00000000 ____D C:\AdwCleaner
2013-11-25 14:02 - 2013-11-23 02:02 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-11-25 09:53 - 2013-11-25 09:52 - 00000000 ____D C:\Program Files\ProduKey
2013-11-25 09:51 - 2013-11-25 09:51 - 00071105 _____ C:\Users\bash\Downloads\produkey-x64.zip
2013-11-25 09:48 - 2013-11-25 09:48 - 00001500 _____ C:\Users\bash\Downloads\produkey_german.zip
2013-11-24 23:11 - 2013-11-23 03:42 - 00000000 ____D C:\Users\bash\AppData\Roaming\Skype
2013-11-24 21:28 - 2013-11-24 18:41 - 00000000 ____D C:\Users\root\Desktop\mbar
2013-11-24 20:44 - 2013-11-24 20:44 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 20:17 - 2013-11-04 11:06 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-24 18:39 - 2013-11-24 18:38 - 00000000 ____D C:\Users\root\AppData\Roaming\TrueCrypt
2013-11-24 18:37 - 2013-11-08 22:11 - 00000000 ____D C:\Users\root\AppData\Roaming\Skype
2013-11-24 17:52 - 2013-11-04 12:08 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-11-24 17:46 - 2013-11-24 17:46 - 00000000 _____ C:\Windows\setuperr.log
2013-11-24 17:45 - 2013-11-24 17:45 - 00058016 _____ C:\Users\bash\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-24 06:45 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Public\Libraries
2013-11-24 06:38 - 2013-11-23 06:25 - 00000000 ____D C:\Users\bash\AppData\Roaming\vlc
2013-11-24 05:55 - 2007-06-12 00:03 - 00058016 _____ C:\Users\root\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-24 05:28 - 2010-11-21 08:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-11-24 05:27 - 2013-11-23 10:14 - 00275856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-24 05:25 - 2013-11-24 04:56 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-11-24 05:23 - 2013-11-24 05:23 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-11-24 05:21 - 2009-07-14 03:34 - 00000439 _____ C:\Windows\win.ini
2013-11-24 04:55 - 2013-11-24 04:55 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ROOT-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-11-24 04:16 - 2013-11-24 04:16 - 00002163 _____ C:\Users\root\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2013-11-24 04:16 - 2013-11-24 04:16 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-11-24 04:13 - 2013-11-24 04:15 - 05045639 _____ C:\Users\bash\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 04:13 - 2013-11-24 03:59 - 05045639 _____ C:\Users\root\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 02:59 - 2013-11-24 02:59 - 00034745 _____ C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board.htm
2013-11-24 02:59 - 2013-11-24 02:58 - 00000000 ____D C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board-Dateien
2013-11-23 20:18 - 2013-11-23 20:18 - 00000000 ____D C:\Users\bash\AppData\Roaming\Malwarebytes
2013-11-23 10:14 - 2013-11-04 10:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-23 07:32 - 2013-11-23 02:44 - 00000000 ____D C:\Users\bash\Documents\Calibre-Bibliothek
2013-11-23 07:23 - 2013-11-08 22:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-11-23 07:23 - 2013-11-04 10:49 - 00000000 ____D C:\Users\root\AppData\Local\Thunderbird
2013-11-23 07:21 - 2013-11-23 06:03 - 21978136 _____ (Mozilla) C:\Users\bash\Downloads\Thunderbird_Setup_24.1.1.exe
2013-11-23 07:15 - 2013-11-23 02:44 - 00000000 ____D C:\Users\bash\AppData\Roaming\calibre
2013-11-23 07:12 - 2013-11-23 02:44 - 00000000 ____D C:\Users\bash\AppData\Local\calibre-cache
2013-11-23 07:05 - 2013-11-23 05:32 - 00000000 ____D C:\Users\bash\AppData\Local\Microsoft Games
2013-11-23 06:11 - 2013-11-23 06:11 - 00000000 ____D C:\Users\bash\Documents\default
2013-11-23 04:29 - 2013-11-23 04:29 - 00000000 ____D C:\Users\bash\AppData\Roaming\NVIDIA
2013-11-23 04:29 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash
2013-11-23 04:23 - 2013-11-04 11:05 - 00000000 ___RD C:\Sandbox
2013-11-23 04:08 - 2013-11-23 03:59 - 00000000 ____D C:\Users\bash\AppData\Local\Thunderbird
2013-11-23 03:59 - 2013-11-23 03:59 - 00000000 ____D C:\Users\bash\AppData\Roaming\Thunderbird
2013-11-23 03:27 - 2013-11-04 10:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Roaming\Macromedia
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Local\Macromedia
2013-11-23 02:52 - 2013-11-23 02:52 - 00000000 ____D C:\Users\bash\AppData\Roaming\Ashampoo
2013-11-23 02:48 - 2013-11-23 02:46 - 00000000 ____D C:\Users\bash\AppData\Local\Mozilla
2013-11-23 02:46 - 2013-11-23 02:46 - 00000000 ____D C:\Users\bash\AppData\Roaming\Mozilla
2013-11-23 02:41 - 2013-11-23 02:40 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 02:41 - 2013-11-23 02:40 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-23 02:40 - 2013-11-23 02:40 - 00001425 _____ C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-23 02:40 - 2013-11-23 02:40 - 00000020 ___SH C:\Users\bash\ntuser.ini
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Vorlagen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Startmenü
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Netzwerkumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Lokale Einstellungen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Eigene Dateien
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Druckumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Musik
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Bilder
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Verlauf
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Roaming\Adobe
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Local\VirtualStore
2013-11-23 02:35 - 2013-11-04 18:31 - 00000000 ____D C:\Windows\Panther
2013-11-23 02:26 - 2013-11-23 02:26 - 00233056 _____ (Kaspersky Lab, Yury Parshin) C:\Windows\system32\Drivers\66210953.sys
2013-11-23 02:02 - 2013-11-04 10:21 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-11-23 01:59 - 2013-11-23 01:59 - 00000000 ____D C:\Program Files\AVAST Software
2013-11-23 01:59 - 2013-11-23 01:58 - 00000000 ____D C:\ProgramData\AVAST Software
2013-11-23 01:46 - 2013-11-04 09:45 - 00001425 _____ C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-13 19:08 - 2013-11-04 09:44 - 00000000 ____D C:\Users\root
2013-11-13 18:17 - 2013-11-13 13:16 - 01591948 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-11-13 13:25 - 2013-11-13 13:25 - 00000000 ____D C:\Program Files\Sandboxie
2013-11-13 13:08 - 2013-11-13 13:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-13 13:08 - 2013-11-05 21:04 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-11-13 13:08 - 2013-11-05 21:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-13 11:32 - 2013-11-05 21:15 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 11:29 - 2013-11-05 21:15 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-12 13:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-12 13:41 - 2013-11-12 13:41 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 12:28 - 2013-11-05 13:54 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2013-11-11 18:27 - 2013-11-11 18:27 - 00000000 ____D C:\Program Files\Calibre2
2013-11-11 08:09 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-11 05:50 - 2010-11-21 04:27 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-09 18:46 - 2013-11-04 10:54 - 00000000 ____D C:\Users\root\AppData\Roaming\vlc
2013-11-09 01:12 - 2013-11-09 01:12 - 00000000 ____D C:\Program Files (x86)\SoundSpectrum
2013-11-08 20:36 - 2009-07-14 06:08 - 00026326 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-08 04:21 - 2013-11-08 04:21 - 00000000 ____D C:\Users\root\AppData\Local\WindowsUpdate
2013-11-08 03:33 - 2013-11-08 02:40 - 00000000 ____D C:\Users\root\Documents\NPS
2013-11-08 03:26 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default
2013-11-08 03:25 - 2013-11-06 11:51 - 00000000 ____D C:\Windows\erdnt
2013-11-08 03:24 - 2009-07-14 03:34 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts_bak_154
2013-11-08 02:39 - 2013-11-08 02:39 - 00000000 ____D C:\Users\root\Documents\My Art
2013-11-08 02:36 - 2013-11-06 18:45 - 00000000 ____D C:\Users\root\AppData\Local\Downloaded Installations
2013-11-08 02:33 - 2013-11-08 02:33 - 00000000 ____D C:\ProgramData\Samsung
2013-11-08 02:33 - 2013-11-06 18:56 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-11-08 02:32 - 2013-11-08 02:32 - 00000000 ____D C:\Users\root\Documents\My NPS Files
2013-11-08 02:32 - 2013-11-05 13:56 - 00000000 ____D C:\Users\root\AppData\Roaming\Samsung
2013-11-08 02:31 - 2013-11-08 02:31 - 00000000 ____D C:\Users\root\Documents\Samsung
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ____D C:\ProgramData\Skype
2013-11-07 18:38 - 2013-11-07 18:38 - 00003140 _____ C:\Windows\System32\Tasks\{6A53125F-7484-4EC3-8E03-BE28CCBFB6DC}
2013-11-07 18:13 - 2013-11-06 13:25 - 00000000 ____D C:\Users\root\AppData\Local\Adobe
2013-11-07 17:50 - 2013-11-07 17:50 - 00003062 _____ C:\Windows\System32\Tasks\{C23BCD1D-0C2D-434B-B9EE-898DE337123E}
2013-11-07 17:46 - 2013-11-04 09:45 - 00000000 ____D C:\Users\root\AppData\Local\VirtualStore
2013-11-07 17:45 - 2013-11-07 17:45 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-07 17:15 - 2013-11-07 17:15 - 00000000 ____D C:\Users\root\AppData\Local\Macromedia
2013-11-07 16:22 - 2013-11-07 16:22 - 00000018 _____ C:\Users\root\Documents\hide.txt
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagwrn.xml
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagerr.xml
2013-11-06 22:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-11-06 22:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-11-06 22:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-11-06 22:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\tr-TR
2013-11-06 21:45 - 2013-11-06 21:45 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 19:07 - 2013-11-06 19:08 - 00105472 _____ C:\1031.MST
2013-11-06 19:06 - 2013-11-06 19:08 - 00015832 _____ C:\0x0407.ini
2013-11-06 19:01 - 2013-11-06 19:01 - 00002528 _____ C:\Users\root\AppData\Roaming\$_hpcst$.hpc
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\PC Connectivity Solution
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\MarkAny
2013-11-06 15:07 - 2013-11-06 15:07 - 00003140 _____ C:\Windows\System32\Tasks\{C1B0B6AE-3F6E-4209-B49D-68BDE5693F90}
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{AB9543D6-AC8E-41B1-BFEE-823A469AEC02}
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{7DB0268B-BD2B-4233-B755-AF2F8410039D}
2013-11-06 12:03 - 2013-11-06 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 09:37 - 2013-11-06 09:37 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-11-06 01:27 - 2013-11-05 21:19 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-11-06 01:22 - 2013-11-06 01:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Malwarebytes
2013-11-05 21:30 - 2013-11-05 15:17 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-11-05 21:04 - 2013-11-05 21:04 - 00000000 ____D C:\Windows\system32\Macromed
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Anwendungsdaten
2013-11-05 15:26 - 2013-11-05 15:26 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-11-05 15:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-11-05 15:18 - 2013-11-05 15:18 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-11-05 14:24 - 2013-11-05 14:24 - 00000000 ____D C:\Users\root\AppData\Roaming\PC Suite
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Macromedia
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Adobe
2013-11-05 13:56 - 2013-11-05 13:56 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-11-05 02:15 - 2013-11-04 09:45 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-05 02:15 - 2013-11-04 09:45 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-04 21:37 - 2010-11-21 08:17 - 00000000 ____D C:\Program Files\Windows Journal
2013-11-04 18:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-11-04 18:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-11-04 18:48 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-11-04 18:31 - 2009-07-14 06:38 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG
2013-11-04 18:31 - 2009-07-14 06:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2013-11-04 11:54 - 2013-11-04 11:54 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-11-04 11:13 - 2013-11-04 11:13 - 00003042 _____ C:\Windows\System32\Tasks\PandaUSBVaccine
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-04 11:09 - 2013-11-04 11:09 - 00003144 _____ C:\Windows\System32\Tasks\{57FC9078-E624-4E00-B291-10674066045C}
2013-11-04 11:08 - 2013-11-04 11:08 - 00000000 ____D C:\ProgramData\Sun
2013-11-04 11:07 - 2013-11-04 11:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-04 11:07 - 2013-11-04 11:07 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-04 11:06 - 2013-11-04 11:06 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-11-04 11:06 - 2013-11-04 11:05 - 00000000 ____D C:\Program Files\TrueCrypt
2013-11-04 10:55 - 2013-11-04 10:55 - 00000000 ____D C:\Program Files\Tracker Software
2013-11-04 10:54 - 2013-11-04 10:54 - 00000000 ____D C:\Program Files\VideoLAN
2013-11-04 10:52 - 2013-11-04 10:51 - 00000000 ____D C:\Program Files\GIMP 2
2013-11-04 10:51 - 2013-11-04 10:51 - 00000000 ____D C:\Users\root\AppData\Local\Secunia PSI
2013-11-04 10:50 - 2013-11-04 10:50 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-11-04 10:49 - 2013-11-04 10:49 - 00000000 ____D C:\Users\root\AppData\Roaming\Thunderbird
2013-11-04 10:47 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-04 10:46 - 2013-11-04 10:46 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AbiWord Word Processor
2013-11-04 10:46 - 2013-11-04 10:31 - 00000000 ____D C:\Program Files (x86)\AbiWord
2013-11-04 10:45 - 2013-11-04 10:45 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-04 10:45 - 2013-11-04 10:45 - 00000000 ____D C:\Program Files\CCleaner
2013-11-04 10:39 - 2013-11-04 10:36 - 00000000 ____D C:\Users\root\AppData\Local\Mozilla
2013-11-04 10:37 - 2013-11-04 10:36 - 00000000 ____D C:\Users\root\AppData\Roaming\Mozilla
2013-11-04 10:35 - 2013-11-04 10:35 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-04 10:30 - 2013-11-04 10:30 - 00000000 ____D C:\Program Files\7-Zip
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Roaming\Ashampoo
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Local\ashampoo
2013-11-04 10:29 - 2013-11-04 10:28 - 00000000 ____D C:\ProgramData\Ashampoo
2013-11-04 10:28 - 2013-11-04 10:28 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\de
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\winrm
2013-11-04 10:06 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\DigitalLocker
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\oobe
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\de
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\0407
2013-11-04 10:05 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\WCN
2013-11-04 10:05 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\slmgr
2013-11-04 10:05 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-11-04 10:05 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Setup
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\MUI
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Dism
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\com
2013-11-04 10:04 - 2013-11-04 10:08 - 00295922 _____ C:\Windows\system32\perfi007.dat
2013-11-04 10:04 - 2013-11-04 10:08 - 00038104 _____ C:\Windows\system32\perfd007.dat
2013-11-04 09:50 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-11-04 09:44 - 2013-11-04 09:44 - 00000020 ___SH C:\Users\root\ntuser.ini
2013-11-04 09:44 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-04 09:37 - 2013-11-04 09:37 - 00000000 _____ C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf

Some content of TEMP:
====================
C:\Users\root\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-23 11:05

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-11-2013
Ran by root at 2013-11-27 08:54:40
Running from C:\Users\root\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
AbiWord 2.8.6 (x32 Version: 2.8.6)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.152)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152)
Ashampoo Burning Studio 2013 v.11.0.6 (x32 Version: 11.0.6)
avast! Free Antivirus (x32 Version: 8.0.1497.0)
calibre 64bit (Version: 1.10.0)
CCleaner (Version: 4.06)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
G-Force (x32 Version: 5.1.2)
GIMP 2.8.6 (Version: 2.8.6)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mobile Partner (x32 Version: 11.302.06.07.40)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 24.1.1)
Mozilla Thunderbird 24.1.1 (x86 de) (x32 Version: 24.1.1)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
NVIDIA Drivers (Version: 1.10.62.40)
NVIDIA Grafiktreiber 307.83 (Version: 307.83)
NVIDIA Install Application (Version: 2.1002.109.706)
NVIDIA Systemsteuerung 307.83 (Version: 307.83)
NVIDIA Update 1.10.8 (Version: 1.10.8)
NVIDIA Update Components (Version: 1.10.8)
PDF-Viewer (Version: 2.5.212.0)
Samsung New PC Studio (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Sandboxie 4.04 (64-bit) (Version: 4.04)
Secunia PSI (3.0.0.7011) (x32 Version: 3.0.0.7011)
Skype™ 6.10 (x32 Version: 6.10.104)
TrueCrypt (x32 Version: 7.1a)
Tweaking.com - Windows Repair (All in One) (x32 Version: 2.1.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
VLC media player 2.1.0 (Version: 2.1.0)

==================== Restore Points  =========================

25-11-2013 08:35:41 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-11-24 05:21 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1FA47C49-CF2B-437A-A558-D3520BBCDA58} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
Task: {55934CEB-F418-45AA-8D58-919C351782AD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software)
Task: {5FC7288E-5A1D-4B96-967F-98B3B7E1CAF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-13] (Adobe Systems Incorporated)
Task: {6582D44D-29F9-4BC2-8C20-3558367F13A0} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {7AFAA74D-7291-4875-B242-4D263ACC3C82} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe
Task: {CF395CE8-F47F-44B7-8230-6144F11DF68E} - System32\Tasks\{6A53125F-7484-4EC3-8E03-BE28CCBFB6DC} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {E48D9AD9-87EE-40B1-AF36-77349517C81B} - System32\Tasks\{57FC9078-E624-4E00-B291-10674066045C} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.9.0.106&amp;LastError=12007
Task: {EB02381F-D652-4B1C-894A-712498C62C51} - \Microsoft\Windows\MUI\LPRemove No Task File
Task: {F551883F-422B-44FB-9871-50B417988EBB} - System32\Tasks\{C1B0B6AE-3F6E-4209-B49D-68BDE5693F90} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-11-23 02:01 - 2013-09-02 08:24 - 02098176 _____ () C:\Program Files\AVAST Software\Avast\defs\13090200\algo.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CleanHlp.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CleanHlp.sys => ""="Driver"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-11-08 03:23:43.505
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-11-08 03:23:43.443
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 22%
Total physical RAM: 4991.3 MB
Available physical RAM: 3873.84 MB
Total Pagefile: 9980.79 MB
Available Pagefile: 8845.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:37.01 GB) (Free:8.62 GB) NTFS
Drive d: (Meine Dateien) (CDROM) (Total:4.19 GB) (Free:0 GB) UDF
Drive g: (DATENSAU) (Removable) (Total:14.9 GB) (Free:5.64 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 37 GB) (Disk ID: 7C1DA20E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=37 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00030FF7)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================

hotte90 · 27.11.2013, 11:03

Ohje, mir ist gerade ein Fehler unterlaufen, dass FRST Log, was ich gepostet habe, wurde vor dem Combofix Log erstellt. Hier ein frisches FRST Log!!!

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-11-2013
Ran by root (administrator) on ROOT-PC on 27-11-2013 09:51:23
Running from C:\Users\root\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sandboxie Holdings, LLC) C:\Program Files\Sandboxie\SbieSvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psia.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Secunia) C:\Program Files (x86)\Secunia\PSI\psi_tray.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [4858968 2013-08-30] (AVAST Software)
HKLM-x32\...\Run: [20131121] - C:\Program Files\AVAST Software\Avast\Setup\emupdate\af3ef095-f2a9-4075-a8cd-a752c97f585c.exe [180184 2013-11-24] (AVAST Software)
HKU\bash\...\Run: [SandboxieControl] - C:\Program Files\Sandboxie\SbieCtrl.exe [759384 2013-07-08] (Sandboxie Holdings, LLC)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{768A88D4-DA67-4FCB-9406-F458691E4E25}: [NameServer]193.189.244.206 193.189.244.225

FireFox:
========
FF ProfilePath: C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default
FF DefaultSearchEngine: Startpage HTTPS - Deutsch
FF SelectedSearchEngine: Startpage HTTPS - Deutsch
FF Homepage: https://startpage.com/deu/.
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF Plugin HKCU: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
FF SearchPlugin: C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\searchplugins\startpage-https---deutsch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: noscript - C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Adblock Plus - C:\Users\root\AppData\Roaming\Mozilla\Firefox\Profiles\8ujo5aq9.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [183896 2013-07-08] (Sandboxie Holdings, LLC)
R2 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1228504 2013-07-03] (Secunia)
R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [660184 2013-07-03] (Secunia)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] ()
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [243200 2009-10-21] (Huawei Technologies Co., Ltd.)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [114304 2009-10-12] (Huawei Technologies Co., Ltd.)
S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-07-03] (Secunia)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [199384 2013-07-08] (Sandboxie Holdings, LLC)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 cleanhlp; \??\C:\Program Files (x86)\Emsisoft Anti-Malware\cleanhlp64.sys [x]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-27 09:51 - 2013-11-27 09:51 - 00007815 _____ C:\Users\root\Desktop\FRST.txt
2013-11-27 09:38 - 2013-11-27 09:38 - 00019909 _____ C:\ComboFix.txt
2013-11-27 09:25 - 2013-11-27 09:38 - 00000000 ____D C:\Qoobox
2013-11-27 09:25 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-11-27 09:25 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-11-27 09:25 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-11-27 09:25 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-11-27 09:25 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-11-27 09:25 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-11-27 09:25 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-11-27 09:25 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-11-27 09:09 - 2013-11-27 08:56 - 05150163 ____R (Swearware) C:\Users\root\Desktop\ComboFix.exe
2013-11-27 08:52 - 2013-11-27 08:52 - 00000000 ____D C:\FRST
2013-11-27 08:47 - 2013-11-27 08:47 - 00377856 _____ C:\Users\root\Desktop\r3p6rlf2.exe
2013-11-27 08:47 - 2013-11-27 08:43 - 01958818 _____ (Farbar) C:\Users\root\Desktop\FRST64.exe
2013-11-27 08:28 - 2013-10-20 23:47 - 01033335 _____ (Thisisu) C:\Users\root\Desktop\JRT.exe
2013-11-27 08:09 - 2013-11-27 08:10 - 00000000 ____D C:\AdwCleaner
2013-11-25 09:52 - 2013-11-25 09:53 - 00000000 ____D C:\Program Files\ProduKey
2013-11-25 09:51 - 2013-11-25 09:51 - 00071105 _____ C:\Users\bash\Downloads\produkey-x64.zip
2013-11-25 09:48 - 2013-11-25 09:48 - 00001500 _____ C:\Users\bash\Downloads\produkey_german.zip
2013-11-25 08:51 - 2013-10-07 20:06 - 00448512 _____ (OldTimer Tools) C:\Program Files\TFC.exe
2013-11-24 20:44 - 2013-11-24 20:44 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 18:41 - 2013-11-24 21:28 - 00000000 ____D C:\Users\root\Desktop\mbar
2013-11-24 18:38 - 2013-11-24 18:39 - 00000000 ____D C:\Users\root\AppData\Roaming\TrueCrypt
2013-11-24 18:29 - 2013-10-20 23:49 - 12576792 _____ (Malwarebytes Corp.) C:\Users\root\Desktop\mbar-1.07.0.1007.exe
2013-11-24 17:46 - 2013-11-27 09:22 - 00003173 _____ C:\Windows\setupact.log
2013-11-24 17:46 - 2013-11-24 17:46 - 00000000 _____ C:\Windows\setuperr.log
2013-11-24 17:45 - 2013-11-24 17:45 - 00058016 _____ C:\Users\bash\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-24 17:43 - 2009-10-21 17:16 - 00243200 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbnet.sys
2013-11-24 17:43 - 2009-10-12 15:23 - 00114304 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbdev.sys
2013-11-24 17:43 - 2009-09-10 15:31 - 00117248 _____ (Huawei Technologies Co., Ltd.) C:\Windows\system32\Drivers\ewusbmdm.sys
2013-11-24 17:43 - 2007-08-09 04:10 - 00029696 _____ (Huawei Tech. Co., Ltd.) C:\Windows\system32\Drivers\ewdcsc.sys
2013-11-24 06:57 - 2013-10-20 23:23 - 01056666 _____ C:\Users\root\Desktop\AdwCleaner.exe
2013-11-24 05:23 - 2013-11-24 05:23 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-11-24 04:56 - 2013-11-24 05:25 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-11-24 04:55 - 2013-11-24 04:55 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ROOT-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-11-24 04:16 - 2013-11-24 04:16 - 00002163 _____ C:\Users\root\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2013-11-24 04:16 - 2013-11-24 04:16 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-11-24 04:15 - 2013-11-24 04:13 - 05045639 _____ C:\Users\bash\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 03:59 - 2013-11-24 04:13 - 05045639 _____ C:\Users\root\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 02:59 - 2013-11-24 02:59 - 00034745 _____ C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board.htm
2013-11-24 02:58 - 2013-11-24 02:59 - 00000000 ____D C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board-Dateien
2013-11-23 20:18 - 2013-11-23 20:18 - 00000000 ____D C:\Users\bash\AppData\Roaming\Malwarebytes
2013-11-23 10:14 - 2013-11-24 05:27 - 00275856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-23 06:25 - 2013-11-24 06:38 - 00000000 ____D C:\Users\bash\AppData\Roaming\vlc
2013-11-23 06:11 - 2013-11-23 06:11 - 00000000 ____D C:\Users\bash\Documents\default
2013-11-23 06:03 - 2013-11-23 07:21 - 21978136 _____ (Mozilla) C:\Users\bash\Downloads\Thunderbird_Setup_24.1.1.exe
2013-11-23 05:32 - 2013-11-23 07:05 - 00000000 ____D C:\Users\bash\AppData\Local\Microsoft Games
2013-11-23 04:29 - 2013-11-23 04:29 - 00000000 ____D C:\Users\bash\AppData\Roaming\NVIDIA
2013-11-23 03:59 - 2013-11-23 04:08 - 00000000 ____D C:\Users\bash\AppData\Local\Thunderbird
2013-11-23 03:59 - 2013-11-23 03:59 - 00000000 ____D C:\Users\bash\AppData\Roaming\Thunderbird
2013-11-23 03:42 - 2013-11-24 23:11 - 00000000 ____D C:\Users\bash\AppData\Roaming\Skype
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Roaming\Macromedia
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Local\Macromedia
2013-11-23 02:52 - 2013-11-23 02:52 - 00000000 ____D C:\Users\bash\AppData\Roaming\Ashampoo
2013-11-23 02:46 - 2013-11-23 02:48 - 00000000 ____D C:\Users\bash\AppData\Local\Mozilla
2013-11-23 02:46 - 2013-11-23 02:46 - 00000000 ____D C:\Users\bash\AppData\Roaming\Mozilla
2013-11-23 02:44 - 2013-11-23 07:32 - 00000000 ____D C:\Users\bash\Documents\Calibre-Bibliothek
2013-11-23 02:44 - 2013-11-23 07:15 - 00000000 ____D C:\Users\bash\AppData\Roaming\calibre
2013-11-23 02:44 - 2013-11-23 07:12 - 00000000 ____D C:\Users\bash\AppData\Local\calibre-cache
2013-11-23 02:40 - 2013-11-23 04:29 - 00000000 ____D C:\Users\bash
2013-11-23 02:40 - 2013-11-23 02:41 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 02:40 - 2013-11-23 02:41 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-23 02:40 - 2013-11-23 02:40 - 00001425 _____ C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-23 02:40 - 2013-11-23 02:40 - 00000020 ___SH C:\Users\bash\ntuser.ini
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Vorlagen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Startmenü
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Netzwerkumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Lokale Einstellungen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Eigene Dateien
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Druckumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Musik
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Bilder
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Verlauf
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Roaming\Adobe
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Local\VirtualStore
2013-11-23 02:40 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-23 02:40 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-23 02:26 - 2013-11-23 02:26 - 00233056 _____ (Kaspersky Lab, Yury Parshin) C:\Windows\system32\Drivers\66210953.sys
2013-11-23 02:02 - 2013-11-25 14:02 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-11-23 02:02 - 2013-08-30 09:48 - 01030952 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00378944 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00204880 _____ C:\Windows\system32\Drivers\aswVmm.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00080816 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00072016 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00065336 _____ C:\Windows\system32\Drivers\aswRvrt.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00064288 _____ (AVAST Software) C:\Windows\system32\Drivers\aswTdi.sys
2013-11-23 02:02 - 2013-08-30 09:48 - 00033400 _____ (AVAST Software) C:\Windows\system32\Drivers\aswFsBlk.sys
2013-11-23 02:00 - 2013-10-07 20:06 - 00448512 _____ (OldTimer Tools) C:\Users\root\Desktop\TFC.exe
2013-11-23 02:00 - 2013-08-30 09:47 - 00041664 _____ (AVAST Software) C:\Windows\avastSS.scr
2013-11-23 01:59 - 2013-11-23 01:59 - 00000000 ____D C:\Program Files\AVAST Software
2013-11-23 01:58 - 2013-11-23 01:59 - 00000000 ____D C:\ProgramData\AVAST Software
2013-11-13 17:09 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-11-13 17:09 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-11-13 17:09 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-11-13 17:09 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-11-13 17:09 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-11-13 17:09 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-11-13 17:09 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-11-13 17:09 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-11-13 17:09 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-11-13 17:09 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-11-13 17:09 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-11-13 17:09 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-11-13 17:09 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-11-13 17:09 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-11-13 17:08 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2013-11-13 17:08 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2013-11-13 17:08 - 2013-10-01 21:57 - 06578176 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-11-13 17:08 - 2013-10-01 21:55 - 05698048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-11-13 17:06 - 2013-09-25 03:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2013-11-13 17:06 - 2013-09-25 02:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2013-11-13 13:25 - 2013-11-13 13:25 - 00000000 ____D C:\Program Files\Sandboxie
2013-11-13 13:16 - 2013-11-13 18:17 - 01591948 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-11-13 13:07 - 2013-11-27 09:18 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-13 13:07 - 2013-11-13 13:08 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-13 11:27 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 11:27 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 11:27 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 11:27 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 11:27 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 11:27 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 11:27 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 11:27 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 11:27 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 11:27 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 11:27 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 11:27 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 11:27 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 11:27 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 11:27 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 11:27 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 11:27 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 11:27 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 11:27 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 11:27 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 11:27 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 11:27 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 11:27 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 11:27 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 11:27 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 11:27 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 11:27 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 11:27 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 11:27 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 11:27 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-12 13:49 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-11-12 13:41 - 2013-11-12 13:41 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-11 18:27 - 2013-11-11 18:27 - 00000000 ____D C:\Program Files\Calibre2
2013-11-09 01:12 - 2013-11-09 01:12 - 00000000 ____D C:\Program Files (x86)\SoundSpectrum
2013-11-08 22:11 - 2013-11-24 18:37 - 00000000 ____D C:\Users\root\AppData\Roaming\Skype
2013-11-08 22:01 - 2013-11-23 07:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-11-08 04:21 - 2013-11-08 04:21 - 00000000 ____D C:\Users\root\AppData\Local\WindowsUpdate
2013-11-08 02:40 - 2013-11-08 03:33 - 00000000 ____D C:\Users\root\Documents\NPS
2013-11-08 02:39 - 2013-11-08 02:39 - 00000000 ____D C:\Users\root\Documents\My Art
2013-11-08 02:34 - 2010-04-27 03:25 - 00161280 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bmdm.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00127488 _____ (MCCI) C:\Windows\system32\Drivers\ss_bbus.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00018944 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bmdfl.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015872 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bwhnt.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015872 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bwh.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015360 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bcmnt.sys
2013-11-08 02:34 - 2010-04-27 03:25 - 00015360 _____ (MCCI Corporation) C:\Windows\system32\Drivers\ss_bcm.sys
2013-11-08 02:33 - 2013-11-08 02:33 - 00000000 ____D C:\ProgramData\Samsung
2013-11-08 02:32 - 2013-11-08 02:32 - 00000000 ____D C:\Users\root\Documents\My NPS Files
2013-11-08 02:32 - 2010-07-04 19:11 - 00025960 _____ (Teruten Inc) C:\Windows\system32\FsExService64.exe
2013-11-08 02:32 - 2010-06-14 09:32 - 00016448 _____ (Teruten Inc) C:\Windows\system32\Drivers\TFsExDisk.sys
2013-11-08 02:31 - 2013-11-08 02:31 - 00000000 ____D C:\Users\root\Documents\Samsung
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ____D C:\ProgramData\Skype
2013-11-07 18:38 - 2013-11-07 18:38 - 00003140 _____ C:\Windows\System32\Tasks\{6A53125F-7484-4EC3-8E03-BE28CCBFB6DC}
2013-11-07 17:50 - 2013-11-07 17:50 - 00003062 _____ C:\Windows\System32\Tasks\{C23BCD1D-0C2D-434B-B9EE-898DE337123E}
2013-11-07 17:45 - 2013-11-07 17:45 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-07 17:15 - 2013-11-07 17:15 - 00000000 ____D C:\Users\root\AppData\Local\Macromedia
2013-11-07 16:22 - 2013-11-07 16:22 - 00000018 _____ C:\Users\root\Documents\hide.txt
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagwrn.xml
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagerr.xml
2013-11-06 23:21 - 2013-04-17 08:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-11-06 23:21 - 2013-04-17 07:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-11-06 23:13 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-11-06 23:13 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-11-06 23:13 - 2012-08-23 15:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2013-11-06 23:13 - 2012-08-23 14:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-11-06 23:13 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-11-06 23:13 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-11-06 23:13 - 2012-08-23 10:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 19:08 - 2013-11-06 19:07 - 00105472 _____ C:\1031.MST
2013-11-06 19:08 - 2013-11-06 19:06 - 00015832 _____ C:\0x0407.ini
2013-11-06 19:01 - 2013-11-06 19:01 - 00002528 _____ C:\Users\root\AppData\Roaming\$_hpcst$.hpc
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\PC Connectivity Solution
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\MarkAny
2013-11-06 18:56 - 2013-11-08 02:33 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-11-06 18:45 - 2013-11-08 02:36 - 00000000 ____D C:\Users\root\AppData\Local\Downloaded Installations
2013-11-06 15:07 - 2013-11-06 15:07 - 00003140 _____ C:\Windows\System32\Tasks\{C1B0B6AE-3F6E-4209-B49D-68BDE5693F90}
2013-11-06 13:25 - 2013-11-07 18:13 - 00000000 ____D C:\Users\root\AppData\Local\Adobe
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{AB9543D6-AC8E-41B1-BFEE-823A469AEC02}
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{7DB0268B-BD2B-4233-B755-AF2F8410039D}
2013-11-06 11:51 - 2013-11-08 03:25 - 00000000 ____D C:\Windows\erdnt
2013-11-06 11:42 - 2013-11-06 12:03 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 09:37 - 2013-11-06 09:37 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-11-06 01:22 - 2013-11-06 01:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Malwarebytes
2013-11-05 21:30 - 2010-08-12 11:46 - 00758272 _____ (NVIDIA Corporation) C:\Windows\system32\cohelper.dll
2013-11-05 21:30 - 2010-08-09 22:33 - 00011164 _____ C:\Windows\system32\Drivers\nvphy.bin
2013-11-05 21:29 - 2012-05-04 12:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-11-05 21:29 - 2012-05-04 10:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-11-05 21:19 - 2013-11-06 01:27 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-11-05 21:15 - 2013-11-13 11:32 - 00000000 ____D C:\Windows\system32\MRT
2013-11-05 21:15 - 2013-11-13 11:29 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-05 21:04 - 2013-11-13 13:08 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-05 21:04 - 2013-11-05 21:04 - 00000000 ____D C:\Windows\system32\Macromed
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Anwendungsdaten
2013-11-05 15:26 - 2013-11-05 15:26 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-11-05 15:25 - 2007-06-11 23:01 - 00000000 ____D C:\ProgramData\NVIDIA
2013-11-05 15:24 - 2013-01-31 10:25 - 06207776 _____ (NVIDIA Corporation) C:\Windows\system32\nvcpl.dll
2013-11-05 15:24 - 2013-01-31 10:25 - 03300640 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvc64.dll
2013-11-05 15:24 - 2013-01-31 10:24 - 02558240 _____ (NVIDIA Corporation) C:\Windows\system32\nvsvcr.dll
2013-11-05 15:24 - 2013-01-31 10:24 - 00878368 _____ (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
2013-11-05 15:24 - 2013-01-31 10:24 - 00118560 _____ (NVIDIA Corporation) C:\Windows\system32\nvmctray.dll
2013-11-05 15:24 - 2013-01-31 10:24 - 00063776 _____ (NVIDIA Corporation) C:\Windows\system32\nvshext.dll
2013-11-05 15:20 - 2013-02-19 22:32 - 00061216 _____ (Khronos Group) C:\Windows\system32\OpenCL.dll
2013-11-05 15:20 - 2013-02-19 22:32 - 00053024 _____ (Khronos Group) C:\Windows\SysWOW64\OpenCL.dll
2013-11-05 15:18 - 2013-11-05 15:18 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-11-05 15:17 - 2013-11-05 21:30 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-11-05 14:24 - 2013-11-05 14:24 - 00000000 ____D C:\Users\root\AppData\Roaming\PC Suite
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Macromedia
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Adobe
2013-11-05 13:56 - 2013-11-08 02:32 - 00000000 ____D C:\Users\root\AppData\Roaming\Samsung
2013-11-05 13:56 - 2013-11-05 13:56 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-11-05 13:56 - 2010-07-04 19:11 - 00025960 _____ (Teruten Inc) C:\Windows\SysWOW64\FsExService64.Exe
2013-11-05 13:56 - 2010-06-14 09:32 - 00016448 _____ (Teruten Inc) C:\Windows\SysWOW64\Drivers\TFsExDisk.Sys
2013-11-05 13:54 - 2013-11-12 12:28 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2013-11-05 02:40 - 2013-09-04 13:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-11-05 02:40 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

hotte90 · 27.11.2013, 11:23

FRST Teil2:

[CODE]FRST Teil2:

Code:

ATTFilter

2013-11-05 02:40 - 2013-09-04 13:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-11-04 22:19 - 2012-12-07 14:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll
2013-11-04 22:19 - 2012-12-07 14:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll
2013-11-04 22:19 - 2012-12-07 13:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll
2013-11-04 22:19 - 2012-12-07 13:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll
2013-11-04 22:19 - 2012-12-07 12:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs
2013-11-04 22:19 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs
2013-11-04 22:19 - 2012-12-07 12:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs
2013-11-04 22:19 - 2012-12-07 11:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs
2013-11-04 22:10 - 2012-10-03 18:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll
2013-11-04 22:10 - 2012-10-03 18:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll
2013-11-04 22:10 - 2012-10-03 18:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2013-11-04 22:10 - 2012-10-03 17:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll
2013-11-04 22:10 - 2012-10-03 17:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll
2013-11-04 22:10 - 2012-10-03 17:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll
2013-11-04 22:10 - 2012-10-03 17:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2013-11-04 22:10 - 2012-01-13 08:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll
2013-11-04 21:56 - 2011-03-11 07:41 - 00410496 _____ (Intel Corporation) C:\Windows\system32\Drivers\iaStorV.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00189824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00166272 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvstor.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00148352 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvraid.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00107904 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdsata.sys
2013-11-04 21:56 - 2011-03-11 07:41 - 00027008 _____ (Advanced Micro Devices) C:\Windows\system32\Drivers\amdxata.sys
2013-11-04 21:56 - 2011-03-11 07:33 - 02565632 _____ (Microsoft Corporation) C:\Windows\system32\esent.dll
2013-11-04 21:56 - 2011-03-11 07:30 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\fsutil.exe
2013-11-04 21:56 - 2011-03-11 06:33 - 01699328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\esent.dll
2013-11-04 21:56 - 2011-03-11 06:31 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fsutil.exe
2013-11-04 21:56 - 2011-03-11 05:37 - 00091648 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBSTOR.SYS
2013-11-04 21:27 - 2012-03-01 07:46 - 00023408 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2013-11-04 21:27 - 2012-03-01 07:33 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-11-04 21:27 - 2012-03-01 07:28 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2013-11-04 21:27 - 2012-03-01 06:33 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-11-04 21:27 - 2012-03-01 06:29 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmi.dll
2013-11-04 20:59 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-11-04 20:59 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-11-04 20:59 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-11-04 20:59 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-11-04 20:58 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-11-04 20:58 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-11-04 20:58 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-11-04 20:58 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-11-04 20:58 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2013-11-04 20:58 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-11-04 20:58 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2013-11-04 20:58 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-11-04 20:58 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-11-04 20:58 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-11-04 20:58 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-11-04 20:58 - 2012-11-30 06:45 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-11-04 20:58 - 2012-11-30 06:45 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-11-04 20:58 - 2012-11-30 06:43 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-11-04 20:50 - 2012-11-30 00:17 - 00420064 _____ C:\Windows\SysWOW64\locale.nls
2013-11-04 20:50 - 2012-11-30 00:15 - 00420064 _____ C:\Windows\system32\locale.nls
2013-11-04 20:47 - 2013-02-27 07:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2013-11-04 20:47 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2013-11-04 20:40 - 2013-04-26 00:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-11-04 20:40 - 2013-03-31 23:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-11-04 20:33 - 2012-01-04 11:44 - 00509952 _____ (Microsoft Corporation) C:\Windows\system32\ntshrui.dll
2013-11-04 20:33 - 2012-01-04 09:58 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntshrui.dll
2013-11-04 20:29 - 2013-05-10 06:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-11-04 20:29 - 2013-05-10 04:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-11-04 20:20 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-11-04 20:20 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-11-04 20:20 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-11-04 20:20 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-11-04 20:20 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2013-11-04 20:20 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2013-11-04 20:20 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2013-11-04 20:20 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-11-04 20:20 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2013-11-04 20:20 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2013-11-04 20:17 - 2012-11-02 06:59 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2013-11-04 20:17 - 2012-11-02 06:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2013-11-04 20:17 - 2011-02-25 07:19 - 02871808 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2013-11-04 20:17 - 2011-02-25 06:30 - 02616320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2013-11-04 20:16 - 2012-05-01 06:40 - 00209920 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll
2013-11-04 20:15 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-11-04 20:15 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-11-04 20:15 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-11-04 20:15 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-11-04 20:15 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-11-04 20:15 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-11-04 20:15 - 2012-08-22 19:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys
2013-11-04 20:15 - 2012-07-04 21:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys
2013-11-04 20:15 - 2011-07-09 03:46 - 00288768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb10.sys
2013-11-04 20:15 - 2011-04-27 03:40 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb.sys
2013-11-04 20:15 - 2011-04-27 03:39 - 00128000 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxsmb20.sys
2013-11-04 20:13 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-11-04 20:13 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2013-11-04 20:13 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-11-04 20:13 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-11-04 20:13 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-11-04 20:13 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe
2013-11-04 19:52 - 2010-02-23 09:16 - 00294912 _____ (Microsoft Corporation) C:\Windows\system32\browserchoice.exe
2013-11-04 19:49 - 2012-07-26 04:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2013-11-04 19:49 - 2012-07-26 04:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2013-11-04 19:49 - 2012-07-26 04:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2013-11-04 19:49 - 2012-07-26 04:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2013-11-04 19:49 - 2012-07-26 04:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2013-11-04 19:49 - 2012-07-26 03:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2013-11-04 19:49 - 2012-07-26 03:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2013-11-04 19:49 - 2012-06-02 15:57 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2013-11-04 19:31 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-11-04 19:31 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-11-04 19:31 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-11-04 19:31 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-11-04 19:30 - 2011-05-04 06:25 - 02315776 _____ (Microsoft Corporation) C:\Windows\system32\tquery.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 02223616 _____ (Microsoft Corporation) C:\Windows\system32\mssrch.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00778752 _____ (Microsoft Corporation) C:\Windows\system32\mssvp.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00491520 _____ (Microsoft Corporation) C:\Windows\system32\mssph.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00288256 _____ (Microsoft Corporation) C:\Windows\system32\mssphtb.dll
2013-11-04 19:30 - 2011-05-04 06:22 - 00075264 _____ (Microsoft Corporation) C:\Windows\system32\msscntrs.dll
2013-11-04 19:30 - 2011-05-04 06:19 - 00591872 _____ (Microsoft Corporation) C:\Windows\system32\SearchIndexer.exe
2013-11-04 19:30 - 2011-05-04 06:19 - 00249856 _____ (Microsoft Corporation) C:\Windows\system32\SearchProtocolHost.exe
2013-11-04 19:30 - 2011-05-04 06:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\SearchFilterHost.exe
2013-11-04 19:30 - 2011-05-04 05:34 - 01549312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tquery.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 01401344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssrch.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00666624 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssvp.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssph.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00197120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mssphtb.dll
2013-11-04 19:30 - 2011-05-04 05:32 - 00059392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscntrs.dll
2013-11-04 19:30 - 2011-05-04 05:28 - 00427520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchIndexer.exe
2013-11-04 19:30 - 2011-05-04 05:28 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe
2013-11-04 19:30 - 2011-05-04 05:28 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFilterHost.exe
2013-11-04 19:28 - 2012-11-01 06:43 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2013-11-04 19:28 - 2012-11-01 06:43 - 01882624 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2013-11-04 19:28 - 2012-11-01 05:47 - 01389568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2013-11-04 19:28 - 2012-11-01 05:47 - 01236992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2013-11-04 19:28 - 2010-06-26 04:55 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2013-11-04 19:28 - 2010-06-26 04:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2013-11-04 19:26 - 2011-04-09 07:58 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2013-11-04 19:26 - 2011-04-09 06:56 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2013-11-04 19:25 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-11-04 19:25 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-11-04 19:25 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00006144 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004608 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 03:12 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-11-04 19:25 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:48 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-11-04 19:25 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-11-04 19:25 - 2013-08-02 01:43 - 00006144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 01:43 - 00004608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 01:43 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-11-04 19:25 - 2013-08-02 01:43 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00212992 _____ (Microsoft Corporation) C:\Windows\system32\odbctrac.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\odbccp32.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccu32.dll
2013-11-04 19:25 - 2011-06-15 11:02 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\odbccr32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00319488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbcjt32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbctrac.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00122880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccp32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccu32.dll
2013-11-04 19:25 - 2011-06-15 09:55 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\odbccr32.dll
2013-11-04 19:20 - 2012-11-22 06:44 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2013-11-04 19:19 - 2012-11-22 05:45 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2013-11-04 19:09 - 2012-06-06 07:02 - 01133568 _____ (Microsoft Corporation) C:\Windows\system32\cdosys.dll
2013-11-04 19:09 - 2012-06-06 06:03 - 00805376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cdosys.dll
2013-11-04 19:05 - 2011-04-29 04:06 - 00467456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv.sys
2013-11-04 19:05 - 2011-04-29 04:05 - 00410112 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2013-11-04 19:05 - 2011-04-29 04:05 - 00168448 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srvnet.sys
2013-11-04 18:38 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-11-04 18:38 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-11-04 18:31 - 2013-11-23 02:35 - 00000000 ____D C:\Windows\Panther
2013-11-04 18:27 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-11-04 18:27 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-11-04 18:27 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
2013-11-04 18:24 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-11-04 18:24 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-11-04 18:24 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-11-04 18:24 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-11-04 18:22 - 2010-12-23 11:42 - 01118720 _____ (Microsoft Corporation) C:\Windows\system32\sbe.dll
2013-11-04 18:22 - 2010-12-23 11:42 - 00961024 _____ (Microsoft Corporation) C:\Windows\system32\CPFilters.dll
2013-11-04 18:22 - 2010-12-23 11:36 - 00259072 _____ (Microsoft Corporation) C:\Windows\system32\mpg2splt.ax
2013-11-04 18:22 - 2010-12-23 06:54 - 00850944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sbe.dll
2013-11-04 18:22 - 2010-12-23 06:54 - 00642048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\CPFilters.dll
2013-11-04 18:22 - 2010-12-23 06:50 - 00199680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mpg2splt.ax
2013-11-04 18:18 - 2012-10-09 19:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll
2013-11-04 18:18 - 2012-10-09 19:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll
2013-11-04 18:18 - 2012-10-09 18:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll
2013-11-04 18:18 - 2012-10-09 18:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll
2013-11-04 18:18 - 2011-11-17 07:35 - 00395776 _____ (Microsoft Corporation) C:\Windows\system32\webio.dll
2013-11-04 18:18 - 2011-11-17 06:35 - 00314880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webio.dll
2013-11-04 18:17 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-11-04 18:17 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-11-04 18:17 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-11-04 18:17 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-11-04 18:17 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
2013-11-04 18:17 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
2013-11-04 18:17 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-11-04 18:16 - 2011-03-11 07:34 - 01395712 _____ (Microsoft Corporation) C:\Windows\system32\mfc42.dll
2013-11-04 18:16 - 2011-03-11 07:34 - 01359872 _____ (Microsoft Corporation) C:\Windows\system32\mfc42u.dll
2013-11-04 18:16 - 2011-03-11 06:33 - 01164288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42u.dll
2013-11-04 18:16 - 2011-03-11 06:33 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfc42.dll
2013-11-04 18:15 - 2013-01-03 07:00 - 00288088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2013-11-04 18:15 - 2012-08-22 19:12 - 00376688 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2013-11-04 18:15 - 2011-10-26 06:25 - 01572864 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2013-11-04 18:15 - 2011-10-26 05:32 - 01328128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2013-11-04 18:14 - 2011-10-15 07:31 - 00723456 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2013-11-04 18:14 - 2011-10-15 06:38 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\EncDec.dll
2013-11-04 18:12 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-11-04 18:11 - 2013-01-24 07:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys
2013-11-04 18:08 - 2012-08-11 01:56 - 00715776 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2013-11-04 18:08 - 2012-08-11 00:56 - 00542208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2013-11-04 18:08 - 2011-12-16 09:46 - 00634880 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2013-11-04 18:08 - 2011-12-16 08:52 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcrt.dll
2013-11-04 18:08 - 2011-02-05 18:10 - 00642944 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2013-11-04 18:08 - 2011-02-05 18:10 - 00020352 _____ (Microsoft Corporation) C:\Windows\system32\kdusb.dll
2013-11-04 18:08 - 2011-02-05 18:10 - 00019328 _____ (Microsoft Corporation) C:\Windows\system32\kd1394.dll
2013-11-04 18:08 - 2011-02-05 18:10 - 00017792 _____ (Microsoft Corporation) C:\Windows\system32\kdcom.dll
2013-11-04 18:08 - 2011-02-05 18:06 - 00605552 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2013-11-04 18:08 - 2011-02-05 18:06 - 00566208 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2013-11-04 18:08 - 2011-02-05 18:06 - 00518672 _____ (Microsoft Corporation) C:\Windows\system32\winresume.exe
2013-11-04 18:07 - 2011-05-03 06:29 - 00976896 _____ (Microsoft Corporation) C:\Windows\system32\inetcomm.dll
2013-11-04 18:07 - 2011-05-03 05:30 - 00741376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcomm.dll
2013-11-04 18:07 - 2011-02-12 12:34 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\FXSCOVER.exe
2013-11-04 18:05 - 2013-04-12 15:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2013-11-04 18:05 - 2012-09-25 23:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll
2013-11-04 18:05 - 2012-09-25 23:46 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2013-11-04 18:05 - 2012-07-04 23:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2013-11-04 18:05 - 2012-07-04 23:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll
2013-11-04 18:05 - 2012-07-04 23:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll
2013-11-04 18:05 - 2012-07-04 22:16 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll
2013-11-04 18:05 - 2012-07-04 22:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll
2013-11-04 18:05 - 2012-05-05 09:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2013-11-04 18:05 - 2012-05-05 08:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2013-11-04 18:05 - 2011-05-24 12:42 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\umpnpmgr.dll
2013-11-04 18:05 - 2011-05-24 11:40 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devobj.dll
2013-11-04 18:05 - 2011-05-24 11:40 - 00044544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\devrtl.dll
2013-11-04 18:05 - 2011-05-24 11:39 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cfgmgr32.dll
2013-11-04 18:05 - 2011-05-24 11:37 - 00252928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drvinst.exe
2013-11-04 18:03 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-11-04 18:02 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-11-04 18:02 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-11-04 18:02 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-11-04 18:02 - 2013-02-12 05:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2013-11-04 18:02 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2013-11-04 18:02 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2013-11-04 18:02 - 2012-11-28 23:56 - 00000003 _____ C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2013-11-04 18:02 - 2012-05-14 06:26 - 00956928 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2013-11-04 18:02 - 2012-04-07 13:31 - 03216384 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2013-11-04 18:02 - 2012-04-07 12:26 - 02342400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2013-11-04 18:02 - 2011-08-27 06:37 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2013-11-04 18:02 - 2011-08-27 06:37 - 00331776 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2013-11-04 18:02 - 2011-08-27 05:26 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2013-11-04 18:02 - 2011-08-27 05:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleacc.dll
2013-11-04 18:02 - 2011-08-17 06:26 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2013-11-04 18:02 - 2011-08-17 06:25 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2013-11-04 18:02 - 2011-08-17 05:24 - 00465408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisdecd.dll
2013-11-04 18:02 - 2011-08-17 05:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\psisrndr.ax
2013-11-04 18:01 - 2012-04-28 04:55 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2013-11-04 18:00 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-11-04 18:00 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys
2013-11-04 18:00 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2013-11-04 17:58 - 2012-08-21 22:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe
2013-11-04 17:58 - 2011-12-30 07:26 - 00515584 _____ (Microsoft Corporation) C:\Windows\system32\timedate.cpl
2013-11-04 17:58 - 2011-12-30 06:27 - 00478720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\timedate.cpl
2013-11-04 17:56 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-11-04 17:56 - 2011-02-18 11:51 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\prevhost.exe
2013-11-04 17:56 - 2011-02-18 06:39 - 00031232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\prevhost.exe
2013-11-04 17:55 - 2013-07-19 02:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-11-04 17:55 - 2013-07-19 02:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-11-04 17:55 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-11-04 17:55 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-11-04 17:55 - 2013-03-19 06:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll
2013-11-04 17:55 - 2013-03-19 06:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll
2013-11-04 17:55 - 2012-03-17 08:58 - 00075120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2013-11-04 17:55 - 2011-04-22 23:15 - 00027520 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2013-11-04 17:53 - 2013-08-28 02:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-11-04 17:04 - 2012-02-11 07:36 - 00559104 _____ (Microsoft Corporation) C:\Windows\system32\spoolsv.exe
2013-11-04 17:04 - 2012-02-11 07:36 - 00067072 _____ (Microsoft Corporation) C:\Windows\splwow64.exe
2013-11-04 17:04 - 2011-06-16 06:49 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\xmllite.dll
2013-11-04 17:04 - 2011-06-16 05:33 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xmllite.dll
2013-11-04 17:03 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-11-04 17:03 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2013-11-04 17:03 - 2011-03-03 07:24 - 00357888 _____ (Microsoft Corporation) C:\Windows\system32\dnsapi.dll
2013-11-04 17:03 - 2011-03-03 07:24 - 00183296 _____ (Microsoft Corporation) C:\Windows\system32\dnsrslvr.dll
2013-11-04 17:03 - 2011-03-03 07:21 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\dnscacheugc.exe
2013-11-04 17:03 - 2011-03-03 06:38 - 00270336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnsapi.dll
2013-11-04 17:03 - 2011-03-03 06:36 - 00028672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dnscacheugc.exe
2013-11-04 17:03 - 2011-02-23 05:55 - 00090624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\bowser.sys
2013-11-04 17:02 - 2012-04-26 06:41 - 00149504 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2013-11-04 17:02 - 2012-04-26 06:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\rdpwsx.dll
2013-11-04 17:02 - 2012-04-26 06:34 - 00009216 _____ (Microsoft Corporation) C:\Windows\system32\rdrmemptylst.exe
2013-11-04 16:53 - 2011-11-19 15:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2013-11-04 16:53 - 2011-11-19 15:01 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2013-11-04 14:22 - 2012-02-17 07:38 - 01031680 _____ (Microsoft Corporation) C:\Windows\system32\rdpcore.dll
2013-11-04 14:22 - 2012-02-17 06:34 - 00826880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpcore.dll
2013-11-04 14:22 - 2012-02-17 05:57 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdtcp.sys
2013-11-04 13:25 - 2012-06-02 23:19 - 02428952 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2013-11-04 13:25 - 2012-06-02 23:19 - 00057880 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2013-11-04 13:25 - 2012-06-02 23:19 - 00044056 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2013-11-04 13:25 - 2012-06-02 23:15 - 02622464 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2013-11-04 13:24 - 2012-06-02 23:19 - 00701976 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2013-11-04 13:24 - 2012-06-02 23:19 - 00038424 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2013-11-04 13:24 - 2012-06-02 23:15 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2013-11-04 13:24 - 2012-06-02 15:19 - 00186752 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2013-11-04 13:24 - 2012-06-02 15:15 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2013-11-04 12:08 - 2013-11-24 17:52 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-11-04 11:54 - 2013-11-04 11:54 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-11-04 11:13 - 2013-11-04 11:13 - 00003042 _____ C:\Windows\System32\Tasks\PandaUSBVaccine
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-04 11:11 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-04 11:09 - 2013-11-04 11:09 - 00003144 _____ C:\Windows\System32\Tasks\{57FC9078-E624-4E00-B291-10674066045C}
2013-11-04 11:08 - 2013-11-04 11:08 - 00000000 ____D C:\ProgramData\Sun
2013-11-04 11:07 - 2013-11-04 11:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-04 11:07 - 2013-11-04 11:07 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-04 11:06 - 2013-11-24 20:17 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-04 11:06 - 2013-11-04 11:06 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-11-04 11:05 - 2013-11-23 04:23 - 00000000 ___RD C:\Sandbox
2013-11-04 11:05 - 2013-11-04 11:06 - 00000000 ____D C:\Program Files\TrueCrypt
2013-11-04 11:04 - 2013-11-27 09:16 - 00003180 _____ C:\Windows\Sandboxie.ini
2013-11-04 10:55 - 2013-11-04 10:55 - 00000000 ____D C:\Program Files\Tracker Software
2013-11-04 10:54 - 2013-11-09 18:46 - 00000000 ____D C:\Users\root\AppData\Roaming\vlc
2013-11-04 10:54 - 2013-11-04 10:54 - 00000000 ____D C:\Program Files\VideoLAN
2013-11-04 10:51 - 2013-11-04 10:52 - 00000000 ____D C:\Program Files\GIMP 2
2013-11-04 10:51 - 2013-11-04 10:51 - 00000000 ____D C:\Users\root\AppData\Local\Secunia PSI
2013-11-04 10:50 - 2013-11-04 10:50 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-11-04 10:49 - 2013-11-23 07:23 - 00000000 ____D C:\Users\root\AppData\Local\Thunderbird
2013-11-04 10:49 - 2013-11-04 10:49 - 00000000 ____D C:\Users\root\AppData\Roaming\Thunderbird
2013-11-04 10:46 - 2013-11-04 10:46 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AbiWord Word Processor
2013-11-04 10:45 - 2013-11-04 10:45 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-04 10:45 - 2013-11-04 10:45 - 00000000 ____D C:\Program Files\CCleaner
2013-11-04 10:36 - 2013-11-04 10:39 - 00000000 ____D C:\Users\root\AppData\Local\Mozilla
2013-11-04 10:36 - 2013-11-04 10:37 - 00000000 ____D C:\Users\root\AppData\Roaming\Mozilla
2013-11-04 10:35 - 2013-11-23 10:14 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-04 10:35 - 2013-11-23 03:27 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-04 10:35 - 2013-11-04 10:35 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-04 10:31 - 2013-11-04 10:46 - 00000000 ____D C:\Program Files (x86)\AbiWord
2013-11-04 10:30 - 2013-11-04 10:30 - 00000000 ____D C:\Program Files\7-Zip
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Roaming\Ashampoo
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Local\ashampoo
2013-11-04 10:28 - 2013-11-04 10:29 - 00000000 ____D C:\ProgramData\Ashampoo
2013-11-04 10:28 - 2013-11-04 10:28 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2013-11-04 10:21 - 2013-11-23 02:02 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-11-04 10:21 - 2013-08-30 09:47 - 00287840 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2013-11-04 10:08 - 2013-11-27 09:27 - 00685230 _____ C:\Windows\system32\perfh007.dat
2013-11-04 10:08 - 2013-11-27 09:27 - 00145062 _____ C:\Windows\system32\perfc007.dat
2013-11-04 10:08 - 2013-11-04 10:04 - 00295922 _____ C:\Windows\system32\perfi007.dat
2013-11-04 10:08 - 2013-11-04 10:04 - 00038104 _____ C:\Windows\system32\perfd007.dat
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\de
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\de
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\0407
2013-11-04 09:45 - 2013-11-23 01:46 - 00001425 _____ C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-04 09:45 - 2013-11-07 17:46 - 00000000 ____D C:\Users\root\AppData\Local\VirtualStore
2013-11-04 09:45 - 2013-11-05 02:15 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-04 09:45 - 2013-11-05 02:15 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-04 09:44 - 2013-11-13 19:08 - 00000000 ____D C:\Users\root
2013-11-04 09:44 - 2013-11-04 09:44 - 00000020 ___SH C:\Users\root\ntuser.ini
2013-11-04 09:44 - 2009-07-14 05:54 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-04 09:44 - 2009-07-14 05:49 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-04 09:37 - 2013-11-04 09:37 - 00000000 _____ C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf
2013-11-04 09:36 - 2013-11-27 09:27 - 01490669 _____ C:\Windows\WindowsUpdate.log

==================== One Month Modified Files and Folders =======

2013-11-27 09:51 - 2013-11-27 09:51 - 00007815 _____ C:\Users\root\Desktop\FRST.txt
2013-11-27 09:38 - 2013-11-27 09:38 - 00019909 _____ C:\ComboFix.txt
2013-11-27 09:38 - 2013-11-27 09:25 - 00000000 ____D C:\Qoobox
2013-11-27 09:35 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-11-27 09:27 - 2013-11-04 10:08 - 00685230 _____ C:\Windows\system32\perfh007.dat
2013-11-27 09:27 - 2013-11-04 10:08 - 00145062 _____ C:\Windows\system32\perfc007.dat
2013-11-27 09:27 - 2013-11-04 09:36 - 01490669 _____ C:\Windows\WindowsUpdate.log
2013-11-27 09:27 - 2009-07-14 06:13 - 01619284 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-27 09:27 - 2009-07-14 05:45 - 00028320 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-27 09:27 - 2009-07-14 05:45 - 00028320 _____ C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-27 09:22 - 2013-11-24 17:46 - 00003173 _____ C:\Windows\setupact.log
2013-11-27 09:22 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-27 09:18 - 2013-11-13 13:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-27 09:16 - 2013-11-04 11:04 - 00003180 _____ C:\Windows\Sandboxie.ini
2013-11-27 08:56 - 2013-11-27 09:09 - 05150163 ____R (Swearware) C:\Users\root\Desktop\ComboFix.exe
2013-11-27 08:52 - 2013-11-27 08:52 - 00000000 ____D C:\FRST
2013-11-27 08:47 - 2013-11-27 08:47 - 00377856 _____ C:\Users\root\Desktop\r3p6rlf2.exe
2013-11-27 08:43 - 2013-11-27 08:47 - 01958818 _____ (Farbar) C:\Users\root\Desktop\FRST64.exe
2013-11-27 08:10 - 2013-11-27 08:09 - 00000000 ____D C:\AdwCleaner
2013-11-25 14:02 - 2013-11-23 02:02 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2013-11-25 09:53 - 2013-11-25 09:52 - 00000000 ____D C:\Program Files\ProduKey
2013-11-25 09:51 - 2013-11-25 09:51 - 00071105 _____ C:\Users\bash\Downloads\produkey-x64.zip
2013-11-25 09:48 - 2013-11-25 09:48 - 00001500 _____ C:\Users\bash\Downloads\produkey_german.zip
2013-11-24 23:11 - 2013-11-23 03:42 - 00000000 ____D C:\Users\bash\AppData\Roaming\Skype
2013-11-24 21:28 - 2013-11-24 18:41 - 00000000 ____D C:\Users\root\Desktop\mbar
2013-11-24 20:44 - 2013-11-24 20:44 - 00116440 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2013-11-24 20:17 - 2013-11-04 11:06 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2013-11-24 18:39 - 2013-11-24 18:38 - 00000000 ____D C:\Users\root\AppData\Roaming\TrueCrypt
2013-11-24 18:37 - 2013-11-08 22:11 - 00000000 ____D C:\Users\root\AppData\Roaming\Skype
2013-11-24 17:52 - 2013-11-04 12:08 - 00000000 ____D C:\Program Files (x86)\Mobile Partner
2013-11-24 17:46 - 2013-11-24 17:46 - 00000000 _____ C:\Windows\setuperr.log
2013-11-24 17:45 - 2013-11-24 17:45 - 00058016 _____ C:\Users\bash\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-24 06:45 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Public\Libraries
2013-11-24 06:38 - 2013-11-23 06:25 - 00000000 ____D C:\Users\bash\AppData\Roaming\vlc
2013-11-24 05:55 - 2007-06-12 00:03 - 00058016 _____ C:\Users\root\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-24 05:28 - 2010-11-21 08:16 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-11-24 05:27 - 2013-11-23 10:14 - 00275856 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-24 05:25 - 2013-11-24 04:56 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-11-24 05:23 - 2013-11-24 05:23 - 00003160 _____ C:\Windows\System32\Tasks\SidebarExecute
2013-11-24 05:21 - 2009-07-14 03:34 - 00000439 _____ C:\Windows\win.ini
2013-11-24 04:55 - 2013-11-24 04:55 - 00000207 _____ C:\Windows\tweaking.com-regbackup-ROOT-PC-Microsoft-Windows-7-Home-Premium-(64-bit).dat
2013-11-24 04:16 - 2013-11-24 04:16 - 00002163 _____ C:\Users\root\Desktop\Tweaking.com - Windows Repair (All in One).lnk
2013-11-24 04:16 - 2013-11-24 04:16 - 00000000 ____D C:\Program Files (x86)\Tweaking.com
2013-11-24 04:13 - 2013-11-24 04:15 - 05045639 _____ C:\Users\bash\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 04:13 - 2013-11-24 03:59 - 05045639 _____ C:\Users\root\Downloads\tweaking.com_windows_repair_aio_setup.exe
2013-11-24 02:59 - 2013-11-24 02:59 - 00034745 _____ C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board.htm
2013-11-24 02:59 - 2013-11-24 02:58 - 00000000 ____D C:\Users\bash\Downloads\Anleitung  Windows Repair (AIO) - Trojaner-Board-Dateien
2013-11-23 20:18 - 2013-11-23 20:18 - 00000000 ____D C:\Users\bash\AppData\Roaming\Malwarebytes
2013-11-23 10:14 - 2013-11-04 10:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-23 07:32 - 2013-11-23 02:44 - 00000000 ____D C:\Users\bash\Documents\Calibre-Bibliothek
2013-11-23 07:23 - 2013-11-08 22:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-11-23 07:23 - 2013-11-04 10:49 - 00000000 ____D C:\Users\root\AppData\Local\Thunderbird
2013-11-23 07:21 - 2013-11-23 06:03 - 21978136 _____ (Mozilla) C:\Users\bash\Downloads\Thunderbird_Setup_24.1.1.exe
2013-11-23 07:15 - 2013-11-23 02:44 - 00000000 ____D C:\Users\bash\AppData\Roaming\calibre
2013-11-23 07:12 - 2013-11-23 02:44 - 00000000 ____D C:\Users\bash\AppData\Local\calibre-cache
2013-11-23 07:05 - 2013-11-23 05:32 - 00000000 ____D C:\Users\bash\AppData\Local\Microsoft Games
2013-11-23 06:11 - 2013-11-23 06:11 - 00000000 ____D C:\Users\bash\Documents\default
2013-11-23 04:29 - 2013-11-23 04:29 - 00000000 ____D C:\Users\bash\AppData\Roaming\NVIDIA
2013-11-23 04:29 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash
2013-11-23 04:23 - 2013-11-04 11:05 - 00000000 ___RD C:\Sandbox
2013-11-23 04:08 - 2013-11-23 03:59 - 00000000 ____D C:\Users\bash\AppData\Local\Thunderbird
2013-11-23 03:59 - 2013-11-23 03:59 - 00000000 ____D C:\Users\bash\AppData\Roaming\Thunderbird
2013-11-23 03:27 - 2013-11-04 10:35 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Roaming\Macromedia
2013-11-23 03:21 - 2013-11-23 03:21 - 00000000 ____D C:\Users\bash\AppData\Local\Macromedia
2013-11-23 02:52 - 2013-11-23 02:52 - 00000000 ____D C:\Users\bash\AppData\Roaming\Ashampoo
2013-11-23 02:48 - 2013-11-23 02:46 - 00000000 ____D C:\Users\bash\AppData\Local\Mozilla
2013-11-23 02:46 - 2013-11-23 02:46 - 00000000 ____D C:\Users\bash\AppData\Roaming\Mozilla
2013-11-23 02:41 - 2013-11-23 02:40 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-23 02:41 - 2013-11-23 02:40 - 00000000 ___RD C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-23 02:40 - 2013-11-23 02:40 - 00001425 _____ C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-23 02:40 - 2013-11-23 02:40 - 00000020 ___SH C:\Users\bash\ntuser.ini
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Vorlagen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Startmenü
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Netzwerkumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Lokale Einstellungen
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Eigene Dateien
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Druckumgebung
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Musik
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Documents\Eigene Bilder
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Verlauf
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\AppData\Local\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 _SHDL C:\Users\bash\Anwendungsdaten
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Roaming\Adobe
2013-11-23 02:40 - 2013-11-23 02:40 - 00000000 ____D C:\Users\bash\AppData\Local\VirtualStore
2013-11-23 02:35 - 2013-11-04 18:31 - 00000000 ____D C:\Windows\Panther
2013-11-23 02:26 - 2013-11-23 02:26 - 00233056 _____ (Kaspersky Lab, Yury Parshin) C:\Windows\system32\Drivers\66210953.sys
2013-11-23 02:02 - 2013-11-04 10:21 - 00000000 _____ C:\Windows\SysWOW64\config.nt
2013-11-23 01:59 - 2013-11-23 01:59 - 00000000 ____D C:\Program Files\AVAST Software
2013-11-23 01:59 - 2013-11-23 01:58 - 00000000 ____D C:\ProgramData\AVAST Software
2013-11-23 01:46 - 2013-11-04 09:45 - 00001425 _____ C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-13 19:08 - 2013-11-04 09:44 - 00000000 ____D C:\Users\root
2013-11-13 18:17 - 2013-11-13 13:16 - 01591948 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-11-13 13:25 - 2013-11-13 13:25 - 00000000 ____D C:\Program Files\Sandboxie
2013-11-13 13:08 - 2013-11-13 13:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-11-13 13:08 - 2013-11-05 21:04 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-11-13 11:32 - 2013-11-05 21:15 - 00000000 ____D C:\Windows\system32\MRT
2013-11-13 11:29 - 2013-11-05 21:15 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-12 13:50 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-11-12 13:41 - 2013-11-12 13:41 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-12 13:41 - 2013-11-12 13:41 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-11-12 13:41 - 2013-11-12 13:41 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-11-12 13:41 - 2013-11-12 13:41 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-11-12 13:41 - 2013-11-12 13:41 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-11-12 13:41 - 2013-11-12 13:41 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-11-12 13:41 - 2013-11-12 13:41 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-11-12 13:41 - 2013-11-12 13:41 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-11-12 12:28 - 2013-11-05 13:54 - 00000000 ____D C:\Program Files (x86)\InstallShield Installation Information
2013-11-11 18:27 - 2013-11-11 18:27 - 00000000 ____D C:\Program Files\Calibre2
2013-11-11 05:50 - 2010-11-21 04:27 - 00267936 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-11-09 18:46 - 2013-11-04 10:54 - 00000000 ____D C:\Users\root\AppData\Roaming\vlc
2013-11-09 01:12 - 2013-11-09 01:12 - 00000000 ____D C:\Program Files (x86)\SoundSpectrum
2013-11-08 20:36 - 2009-07-14 06:08 - 00026578 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-11-08 04:21 - 2013-11-08 04:21 - 00000000 ____D C:\Users\root\AppData\Local\WindowsUpdate
2013-11-08 03:33 - 2013-11-08 02:40 - 00000000 ____D C:\Users\root\Documents\NPS
2013-11-08 03:26 - 2009-07-14 04:20 - 00000000 ___RD C:\Users\Default
2013-11-08 03:25 - 2013-11-06 11:51 - 00000000 ____D C:\Windows\erdnt
2013-11-08 03:24 - 2009-07-14 03:34 - 00000027 _____ C:\Windows\system32\Drivers\etc\hosts_bak_154
2013-11-08 02:39 - 2013-11-08 02:39 - 00000000 ____D C:\Users\root\Documents\My Art
2013-11-08 02:36 - 2013-11-06 18:45 - 00000000 ____D C:\Users\root\AppData\Local\Downloaded Installations
2013-11-08 02:33 - 2013-11-08 02:33 - 00000000 ____D C:\ProgramData\Samsung
2013-11-08 02:33 - 2013-11-06 18:56 - 00000000 ____D C:\Program Files (x86)\Samsung
2013-11-08 02:32 - 2013-11-08 02:32 - 00000000 ____D C:\Users\root\Documents\My NPS Files
2013-11-08 02:32 - 2013-11-05 13:56 - 00000000 ____D C:\Users\root\AppData\Roaming\Samsung
2013-11-08 02:31 - 2013-11-08 02:31 - 00000000 ____D C:\Users\root\Documents\Samsung
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-11-08 01:58 - 2013-11-08 01:58 - 00000000 ____D C:\ProgramData\Skype
2013-11-07 18:38 - 2013-11-07 18:38 - 00003140 _____ C:\Windows\System32\Tasks\{6A53125F-7484-4EC3-8E03-BE28CCBFB6DC}
2013-11-07 18:13 - 2013-11-06 13:25 - 00000000 ____D C:\Users\root\AppData\Local\Adobe
2013-11-07 17:50 - 2013-11-07 17:50 - 00003062 _____ C:\Windows\System32\Tasks\{C23BCD1D-0C2D-434B-B9EE-898DE337123E}
2013-11-07 17:46 - 2013-11-04 09:45 - 00000000 ____D C:\Users\root\AppData\Local\VirtualStore
2013-11-07 17:45 - 2013-11-07 17:45 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-11-07 17:15 - 2013-11-07 17:15 - 00000000 ____D C:\Users\root\AppData\Local\Macromedia
2013-11-07 16:22 - 2013-11-07 16:22 - 00000018 _____ C:\Users\root\Documents\hide.txt
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagwrn.xml
2013-11-07 15:18 - 2013-11-07 15:18 - 00001908 _____ C:\Windows\diagerr.xml
2013-11-06 22:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-11-06 22:18 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-11-06 22:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\zh-HK
2013-11-06 22:17 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\tr-TR
2013-11-06 21:45 - 2013-11-06 21:45 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00005632 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003584 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00003072 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 21:45 - 2013-11-06 21:45 - 00002560 _____ (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-11-06 19:07 - 2013-11-06 19:08 - 00105472 _____ C:\1031.MST
2013-11-06 19:06 - 2013-11-06 19:08 - 00015832 _____ C:\0x0407.ini
2013-11-06 19:01 - 2013-11-06 19:01 - 00002528 _____ C:\Users\root\AppData\Roaming\$_hpcst$.hpc
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\PC Connectivity Solution
2013-11-06 18:57 - 2013-11-06 18:57 - 00000000 ____D C:\Program Files (x86)\MarkAny
2013-11-06 15:07 - 2013-11-06 15:07 - 00003140 _____ C:\Windows\System32\Tasks\{C1B0B6AE-3F6E-4209-B49D-68BDE5693F90}
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{AB9543D6-AC8E-41B1-BFEE-823A469AEC02}
2013-11-06 12:28 - 2013-11-06 12:28 - 00003108 _____ C:\Windows\System32\Tasks\{7DB0268B-BD2B-4233-B755-AF2F8410039D}
2013-11-06 12:03 - 2013-11-06 11:42 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 09:37 - 2013-11-06 09:37 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2013-11-06 01:27 - 2013-11-05 21:19 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0
2013-11-06 01:22 - 2013-11-06 01:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Malwarebytes
2013-11-05 21:30 - 2013-11-05 15:17 - 00000000 ____D C:\Program Files\NVIDIA Corporation
2013-11-05 21:04 - 2013-11-05 21:04 - 00000000 ____D C:\Windows\system32\Macromed
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Verlauf
2013-11-05 15:27 - 2013-11-05 15:27 - 00000000 _SHDL C:\Users\UpdatusUser\AppData\Local\Anwendungsdaten
2013-11-05 15:26 - 2013-11-05 15:26 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-11-05 15:24 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Help
2013-11-05 15:18 - 2013-11-05 15:18 - 00000000 ____D C:\ProgramData\NVIDIA Corporation
2013-11-05 14:24 - 2013-11-05 14:24 - 00000000 ____D C:\Users\root\AppData\Roaming\PC Suite
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Macromedia
2013-11-05 14:22 - 2013-11-05 14:22 - 00000000 ____D C:\Users\root\AppData\Roaming\Adobe
2013-11-05 13:56 - 2013-11-05 13:56 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-11-05 02:15 - 2013-11-04 09:45 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-11-05 02:15 - 2013-11-04 09:45 - 00000000 ___RD C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-11-04 21:37 - 2010-11-21 08:17 - 00000000 ____D C:\Program Files\Windows Journal
2013-11-04 18:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-11-04 18:48 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-11-04 18:48 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\System
2013-11-04 18:31 - 2009-07-14 06:38 - 00025600 ___SH C:\Windows\system32\config\BCD-Template.LOG
2013-11-04 18:31 - 2009-07-14 06:32 - 00028672 _____ C:\Windows\system32\config\BCD-Template
2013-11-04 11:54 - 2013-11-04 11:54 - 00000000 ____D C:\Program Files (x86)\Lavalys
2013-11-04 11:13 - 2013-11-04 11:13 - 00003042 _____ C:\Windows\System32\Tasks\PandaUSBVaccine
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-04 11:11 - 2013-11-04 11:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-04 11:09 - 2013-11-04 11:09 - 00003144 _____ C:\Windows\System32\Tasks\{57FC9078-E624-4E00-B291-10674066045C}
2013-11-04 11:08 - 2013-11-04 11:08 - 00000000 ____D C:\ProgramData\Sun
2013-11-04 11:07 - 2013-11-04 11:07 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-11-04 11:07 - 2013-11-04 11:07 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-11-04 11:07 - 2013-11-04 11:07 - 00000000 ____D C:\Program Files (x86)\Java
2013-11-04 11:06 - 2013-11-04 11:06 - 00231376 _____ (TrueCrypt Foundation) C:\Windows\system32\Drivers\truecrypt.sys
2013-11-04 11:06 - 2013-11-04 11:05 - 00000000 ____D C:\Program Files\TrueCrypt
2013-11-04 10:55 - 2013-11-04 10:55 - 00000000 ____D C:\Program Files\Tracker Software
2013-11-04 10:54 - 2013-11-04 10:54 - 00000000 ____D C:\Program Files\VideoLAN
2013-11-04 10:52 - 2013-11-04 10:51 - 00000000 ____D C:\Program Files\GIMP 2
2013-11-04 10:51 - 2013-11-04 10:51 - 00000000 ____D C:\Users\root\AppData\Local\Secunia PSI
2013-11-04 10:50 - 2013-11-04 10:50 - 00000000 ____D C:\Program Files (x86)\Secunia
2013-11-04 10:49 - 2013-11-04 10:49 - 00000000 ____D C:\Users\root\AppData\Roaming\Thunderbird
2013-11-04 10:47 - 2009-07-14 04:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-04 10:46 - 2013-11-04 10:46 - 00000000 ____D C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AbiWord Word Processor
2013-11-04 10:46 - 2013-11-04 10:31 - 00000000 ____D C:\Program Files (x86)\AbiWord
2013-11-04 10:45 - 2013-11-04 10:45 - 00002770 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-11-04 10:45 - 2013-11-04 10:45 - 00000000 ____D C:\Program Files\CCleaner
2013-11-04 10:39 - 2013-11-04 10:36 - 00000000 ____D C:\Users\root\AppData\Local\Mozilla
2013-11-04 10:37 - 2013-11-04 10:36 - 00000000 ____D C:\Users\root\AppData\Roaming\Mozilla
2013-11-04 10:35 - 2013-11-04 10:35 - 00000000 ____D C:\ProgramData\Mozilla
2013-11-04 10:30 - 2013-11-04 10:30 - 00000000 ____D C:\Program Files\7-Zip
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Roaming\Ashampoo
2013-11-04 10:29 - 2013-11-04 10:29 - 00000000 ____D C:\Users\root\AppData\Local\ashampoo
2013-11-04 10:29 - 2013-11-04 10:28 - 00000000 ____D C:\ProgramData\Ashampoo
2013-11-04 10:28 - 2013-11-04 10:28 - 00000000 ____D C:\Program Files (x86)\Ashampoo
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\XPSViewer
2013-11-04 10:06 - 2013-11-04 10:06 - 00000000 ____D C:\Windows\SysWOW64\de
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-11-04 10:06 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\winrm
2013-11-04 10:06 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\DigitalLocker
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-11-04 10:06 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\Setup
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\SysWOW64\com
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\oobe
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\migwiz
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\servicing
2013-11-04 10:06 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\IME
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\de
2013-11-04 10:05 - 2013-11-04 10:05 - 00000000 ____D C:\Windows\system32\0407
2013-11-04 10:05 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\WCN
2013-11-04 10:05 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\slmgr
2013-11-04 10:05 - 2010-11-21 08:06 - 00000000 ____D C:\Windows\system32\Printing_Admin_Scripts
2013-11-04 10:05 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\sysprep
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Setup
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\MUI
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\Dism
2013-11-04 10:05 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\system32\com
2013-11-04 10:04 - 2013-11-04 10:08 - 00295922 _____ C:\Windows\system32\perfi007.dat
2013-11-04 10:04 - 2013-11-04 10:08 - 00038104 _____ C:\Windows\system32\perfd007.dat
2013-11-04 09:50 - 2009-07-14 06:32 - 00000000 ____D C:\Windows\system32\restore
2013-11-04 09:44 - 2013-11-04 09:44 - 00000020 ___SH C:\Users\root\ntuser.ini
2013-11-04 09:44 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-11-04 09:37 - 2013-11-04 09:37 - 00000000 _____ C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-23 11:05

==================== End Of Log ============================

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-11-2013
Ran by root at 2013-11-27 09:52:28
Running from C:\Users\root\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AS: avast! Antivirus (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
AbiWord 2.8.6 (x32 Version: 2.8.6)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.152)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152)
Ashampoo Burning Studio 2013 v.11.0.6 (x32 Version: 11.0.6)
avast! Free Antivirus (x32 Version: 8.0.1497.0)
calibre 64bit (Version: 1.10.0)
CCleaner (Version: 4.06)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
G-Force (x32 Version: 5.1.2)
GIMP 2.8.6 (Version: 2.8.6)
Java 7 Update 45 (x32 Version: 7.0.450)
Java Auto Updater (x32 Version: 2.1.9.8)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 DEU Language Pack (Version: 4.5.50709)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mobile Partner (x32 Version: 11.302.06.07.40)
Mozilla Firefox 25.0 (x86 de) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 24.1.1)
Mozilla Thunderbird 24.1.1 (x86 de) (x32 Version: 24.1.1)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
NVIDIA Drivers (Version: 1.10.62.40)
NVIDIA Grafiktreiber 307.83 (Version: 307.83)
NVIDIA Install Application (Version: 2.1002.109.706)
NVIDIA Systemsteuerung 307.83 (Version: 307.83)
NVIDIA Update 1.10.8 (Version: 1.10.8)
NVIDIA Update Components (Version: 1.10.8)
PDF-Viewer (Version: 2.5.212.0)
Samsung New PC Studio (x32 Version: 1.00.0000)
SAMSUNG USB Driver for Mobile Phones (Version: 1.3.650.0)
Sandboxie 4.04 (64-bit) (Version: 4.04)
Secunia PSI (3.0.0.7011) (x32 Version: 3.0.0.7011)
Skype™ 6.10 (x32 Version: 6.10.104)
TrueCrypt (x32 Version: 7.1a)
Tweaking.com - Windows Repair (All in One) (x32 Version: 2.1.0)
Update for Microsoft .NET Framework 4.5 (KB2750147) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805221) (x32 Version: 1)
Update for Microsoft .NET Framework 4.5 (KB2805226) (x32 Version: 1)
VLC media player 2.1.0 (Version: 2.1.0)

==================== Restore Points  =========================

27-11-2013 08:25:47 ComboFix created restore point

==================== Hosts content: ==========================

2009-07-14 03:34 - 2013-11-27 09:34 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {1FA47C49-CF2B-437A-A558-D3520BBCDA58} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd)
Task: {55934CEB-F418-45AA-8D58-919C351782AD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software)
Task: {5FC7288E-5A1D-4B96-967F-98B3B7E1CAF5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-13] (Adobe Systems Incorporated)
Task: {6582D44D-29F9-4BC2-8C20-3558367F13A0} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2010-11-21] (Microsoft Corporation)
Task: {7AFAA74D-7291-4875-B242-4D263ACC3C82} - System32\Tasks\PandaUSBVaccine => C:\Program Files (x86)\Panda USB Vaccine\RunInteractiveWin.exe
Task: {CF395CE8-F47F-44B7-8230-6144F11DF68E} - System32\Tasks\{6A53125F-7484-4EC3-8E03-BE28CCBFB6DC} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: {E48D9AD9-87EE-40B1-AF36-77349517C81B} - System32\Tasks\{57FC9078-E624-4E00-B291-10674066045C} => Firefox.exe hxxp://www.skype.com/go/downloading?source=lightinstaller&amp;ver=6.9.0.106&amp;LastError=12007
Task: {EB02381F-D652-4B1C-894A-712498C62C51} - \Microsoft\Windows\MUI\LPRemove No Task File
Task: {F551883F-422B-44FB-9871-50B417988EBB} - System32\Tasks\{C1B0B6AE-3F6E-4209-B49D-68BDE5693F90} => Firefox.exe hxxp://ui.skype.com/ui/0/6.9.0.106/de/abandoninstall?source=lightinstaller&amp;page=tsInstall
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2013-11-23 02:01 - 2013-09-02 08:24 - 02098176 _____ () C:\Program Files\AVAST Software\Avast\defs\13090200\algo.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (11/27/2013 09:35:01 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/27/2013 09:34:16 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (11/27/2013 09:34:16 AM) (Source: Application Popup) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\ComboFix\catchme.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (11/27/2013 09:31:58 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (11/27/2013 09:23:09 AM) (Source: WMPNetworkSvc) (User: )
Description: Dienst "WMPNetworkSvc" konnte nicht ordnungsgemäß gestartet werden, da ein Fehler "0x80004005" in "CoCreateInstance(CLSID_UPnPDeviceFinder)" aufgetreten ist. Überprüfen Sie, ob der Dienst "UPnPHost" ausgeführt wird und ob die Windows-Komponente "UPnPHost" richtig installiert ist.

Error: (11/27/2013 09:22:05 AM) (Source: Microsoft-Windows-Kernel-Processor-Power) (User: NT-AUTORITÄT)
Description: Einige Funktionen zur Energieverwaltung im Leistungsstatus wurden im Prozessor aufgrund eines bekannten Firmwareproblems deaktiviert. Wenden Sie sich an den Computerhersteller, um aktualisierte Firmware zu erhalten.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-11-27 09:34:16.512
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-11-27 09:34:16.450
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-11-27 09:34:16.387
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-11-27 09:34:16.309
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-11-08 03:23:43.505
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-11-08 03:23:43.443
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 24%
Total physical RAM: 4991.3 MB
Available physical RAM: 3787.57 MB
Total Pagefile: 9980.79 MB
Available Pagefile: 8828.36 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:37.01 GB) (Free:8.73 GB) NTFS
Drive d: (Meine Dateien) (CDROM) (Total:4.19 GB) (Free:0 GB) UDF
Drive g: (DATENSAU) (Removable) (Total:14.9 GB) (Free:5.64 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 37 GB) (Disk ID: 7C1DA20E)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=37 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 15 GB) (Disk ID: 00030FF7)
Partition 1: (Not Active) - (Size=15 GB) - (Type=0C)

==================== End Of Log ============================

Aneri · 27.11.2013, 11:29

gas GMER Logfile hätte ich gerne noch. wenn möglich ein frisches

Bitte lade dir

GMER herunter: (Dateiname zufällig)

Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?

Unbedingt auf "No" klicken.
Entferne rechts den Haken bei: IAT/EAT und Show All
Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
Starte den Scan mit "Scan".
Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Tauchen Probleme auf?

Probiere alternativ den abgesicherten Modus.
Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.

zusätzlich:

das Systemdatum kann an der Batterie liegen, wie alt ist das System?

hotte90 · 27.11.2013, 12:12

gmer Teil 1

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-27 11:56:21
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST340823A rev.3.39 37,27GB
Running: r3p6rlf2.exe; Driver: C:\Users\root\AppData\Local\Temp\kxldrpow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  0000000077bd1360 5 bytes JMP 00000001498d0460
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           0000000077bd13b0 5 bytes JMP 00000001498d0450
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000077bd1510 5 bytes JMP 00000001498d0370
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000077bd1560 5 bytes JMP 00000001498d0470
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000077bd1570 5 bytes JMP 00000001498d03e0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000077bd1620 5 bytes JMP 00000001498d0320
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000077bd1650 5 bytes JMP 00000001498d03b0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000077bd1670 5 bytes JMP 00000001498d0390
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             0000000077bd16b0 5 bytes JMP 00000001498d02e0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000077bd1730 5 bytes JMP 00000001498d02d0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000077bd1750 5 bytes JMP 00000001498d0310
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000077bd1790 5 bytes JMP 00000001498d03c0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       0000000077bd17e0 5 bytes JMP 00000001498d03f0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000077bd1940 5 bytes JMP 00000001498d0230
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000077bd1b00 5 bytes JMP 00000001498d0480
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000077bd1b30 5 bytes JMP 00000001498d03a0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000077bd1c10 5 bytes JMP 00000001498d02f0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000077bd1c20 5 bytes JMP 00000001498d0350
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000077bd1c80 5 bytes JMP 00000001498d0290
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000077bd1d10 5 bytes JMP 00000001498d02b0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000077bd1d30 5 bytes JMP 00000001498d03d0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000077bd1d40 5 bytes JMP 00000001498d0330
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    0000000077bd1db0 5 bytes JMP 00000001498d0410
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       0000000077bd1de0 5 bytes JMP 00000001498d0240
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000077bd20a0 5 bytes JMP 00000001498d01e0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000077bd2160 5 bytes JMP 00000001498d0250
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000077bd2190 5 bytes JMP 00000001498d0490
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000077bd21a0 5 bytes JMP 00000001498d04a0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000077bd21d0 5 bytes JMP 00000001498d0300
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000077bd21e0 5 bytes JMP 00000001498d0360
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000077bd2240 5 bytes JMP 00000001498d02a0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000077bd2290 5 bytes JMP 00000001498d02c0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000077bd22c0 5 bytes JMP 00000001498d0380
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000077bd22d0 5 bytes JMP 00000001498d0340
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      0000000077bd25c0 5 bytes JMP 00000001498d0440
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     0000000077bd27c0 5 bytes JMP 00000001498d0260
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        0000000077bd27d0 5 bytes JMP 00000001498d0270
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      0000000077bd27e0 5 bytes JMP 00000001498d0400
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  0000000077bd29a0 5 bytes JMP 00000001498d01f0
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   0000000077bd29b0 5 bytes JMP 00000001498d0210
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000077bd2a20 5 bytes JMP 00000001498d0200
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000077bd2a80 5 bytes JMP 00000001498d0420
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000077bd2a90 5 bytes JMP 00000001498d0430
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    0000000077bd2aa0 5 bytes JMP 00000001498d0220
.text  C:\Windows\system32\csrss.exe[408] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000077bd2b80 5 bytes JMP 00000001498d0280
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\wininit.exe[448] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  0000000077bd1360 5 bytes JMP 00000001498d0460
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           0000000077bd13b0 5 bytes JMP 00000001498d0450
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000077bd1510 5 bytes JMP 00000001498d0370
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000077bd1560 5 bytes JMP 00000001498d0470
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000077bd1570 5 bytes JMP 00000001498d03e0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000077bd1620 5 bytes JMP 00000001498d0320
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000077bd1650 5 bytes JMP 00000001498d03b0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000077bd1670 5 bytes JMP 00000001498d0390
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             0000000077bd16b0 5 bytes JMP 00000001498d02e0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000077bd1730 5 bytes JMP 00000001498d02d0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000077bd1750 5 bytes JMP 00000001498d0310
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000077bd1790 5 bytes JMP 00000001498d03c0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       0000000077bd17e0 5 bytes JMP 00000001498d03f0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000077bd1940 5 bytes JMP 00000001498d0230
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000077bd1b00 5 bytes JMP 00000001498d0480
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000077bd1b30 5 bytes JMP 00000001498d03a0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000077bd1c10 5 bytes JMP 00000001498d02f0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000077bd1c20 5 bytes JMP 00000001498d0350
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000077bd1c80 5 bytes JMP 00000001498d0290
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000077bd1d10 5 bytes JMP 00000001498d02b0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000077bd1d30 5 bytes JMP 00000001498d03d0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000077bd1d40 5 bytes JMP 00000001498d0330
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    0000000077bd1db0 5 bytes JMP 00000001498d0410
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       0000000077bd1de0 5 bytes JMP 00000001498d0240
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000077bd20a0 5 bytes JMP 00000001498d01e0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000077bd2160 5 bytes JMP 00000001498d0250
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000077bd2190 5 bytes JMP 00000001498d0490
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000077bd21a0 5 bytes JMP 00000001498d04a0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000077bd21d0 5 bytes JMP 00000001498d0300
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000077bd21e0 5 bytes JMP 00000001498d0360
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000077bd2240 5 bytes JMP 00000001498d02a0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000077bd2290 5 bytes JMP 00000001498d02c0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000077bd22c0 5 bytes JMP 00000001498d0380
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000077bd22d0 5 bytes JMP 00000001498d0340
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      0000000077bd25c0 5 bytes JMP 00000001498d0440
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     0000000077bd27c0 5 bytes JMP 00000001498d0260
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        0000000077bd27d0 5 bytes JMP 00000001498d0270
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      0000000077bd27e0 5 bytes JMP 00000001498d0400
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  0000000077bd29a0 5 bytes JMP 00000001498d01f0
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   0000000077bd29b0 5 bytes JMP 00000001498d0210
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000077bd2a20 5 bytes JMP 00000001498d0200
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000077bd2a80 5 bytes JMP 00000001498d0420
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000077bd2a90 5 bytes JMP 00000001498d0430
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    0000000077bd2aa0 5 bytes JMP 00000001498d0220
.text  C:\Windows\system32\csrss.exe[468] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000077bd2b80 5 bytes JMP 00000001498d0280
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\winlogon.exe[520] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                              0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\services.exe[560] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\services.exe[560] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                              0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                  0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                           0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                           0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                      0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                           0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                    0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                       0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                             0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                           0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                         0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                          0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                       0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                          0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                               0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                              0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                       0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                    0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                          0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                       0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                        0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                           0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                    0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                       0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                            0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                       0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                       0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                              0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                         0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                      0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                            0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                         0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                            0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                             0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                      0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                     0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                        0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                      0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                  0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                   0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                        0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                        0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                         0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                    0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\lsass.exe[568] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                            0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                    0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                             0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                             0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                  0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                        0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                             0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                      0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                         0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                               0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                             0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                           0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                            0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                         0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                            0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                 0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                         0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                      0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                            0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                         0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                          0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                             0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                      0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                         0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                              0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                         0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                         0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                           0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                        0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                              0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                           0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                              0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                               0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                        0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                       0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                          0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                        0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                    0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                     0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                          0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                          0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                           0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                      0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\lsm.exe[584] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                              0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000100070250

hotte90 · 27.11.2013, 12:14

gmer Teil 2

Code:

ATTFilter

NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000100070400
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\system32\svchost.exe[672] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                 0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                          0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                          0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                               0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                     0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                          0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                   0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                      0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                            0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                          0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                        0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                         0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                      0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                         0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                              0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                             0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                      0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                   0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                         0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                      0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                       0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                          0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                   0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                      0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                           0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                      0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                      0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                             0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                        0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                     0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                           0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                        0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                           0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                            0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                     0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                    0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                       0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                     0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                 0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                  0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                       0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                       0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                        0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                   0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                           0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\nvvsvc.exe[752] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\System32\svchost.exe[888] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\System32\svchost.exe[920] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\svchost.exe[952] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\svchost.exe[984] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\AUDIODG.EXE[356] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                        0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                 0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                 0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                      0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                            0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                 0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                          0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                             0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                   0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                 0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                               0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                             0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                     0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                    0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                             0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                          0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                             0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                              0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                 0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                          0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                             0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                  0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                             0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                             0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                    0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                               0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                            0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                  0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                               0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                  0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                   0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                            0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                           0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                              0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                            0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                        0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                         0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                              0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                              0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                               0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                          0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Program Files\Sandboxie\SbieSvc.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                  0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll

hotte90 · 27.11.2013, 12:21

gmer Teil 3:

Code:

ATTFilter

NtAddBootEntry                                       0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\svchost.exe[1184] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                              0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\svchost.exe[1280] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                              0000000077abeecd 1 byte [62]
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort      0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject               0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess               0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx    0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess          0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection               0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory        0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject           0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                 0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent               0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection             0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread              0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread           0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry              0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort   0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject  0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair           0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion        0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant              0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore           0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx            0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer               0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess        0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry           0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry           0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey           0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys  0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair             0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion          0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore             0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                 0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx          0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder         0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions            0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread          0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation      0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState       0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem            0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess            0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread             0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl        0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[1368] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189     0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                         0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                         0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                              0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                    0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                         0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                  0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                     0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                           0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                         0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                       0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                        0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                     0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                        0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                             0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                            0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                     0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                  0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                        0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                     0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                      0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                         0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                  0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                     0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                          0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                     0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                     0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                            0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                       0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                    0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                          0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                       0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                          0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                           0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                    0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                   0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                      0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                    0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                 0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                      0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                      0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                       0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                  0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                          0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\nvvsvc.exe[1376] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                               0000000077abeecd 1 byte [62]
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\System32\spoolsv.exe[1652] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                              0000000077abeecd 1 byte [62]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1916] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                  000000007581a2ba 1 byte [62]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                0000000076941465 2 bytes [94, 76]
.text  C:\Program Files (x86)\Secunia\PSI\PSIA.exe[1916] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155               00000000769414bb 2 bytes [94, 76]
.text  ...                                                                                                                      * 2
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                              0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                       0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                       0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                            0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                  0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                       0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                   0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                         0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                       0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                     0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                      0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                   0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                      0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                           0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                          0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                   0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                      0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                   0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                    0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                       0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                   0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                        0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                   0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                   0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                          0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                     0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                  0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                        0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                     0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                        0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                         0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                  0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                 0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                    0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                  0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                              0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                               0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                    0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                    0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                     0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\taskhost.exe[2020] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                        0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\taskeng.exe[1344] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                   0000000077bd1360 5 bytes JMP 0000000100070460
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                            0000000077bd13b0 5 bytes JMP 0000000100070450
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                            0000000077bd1510 5 bytes JMP 0000000100070370
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                 0000000077bd1560 5 bytes JMP 0000000100070470
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                       0000000077bd1570 5 bytes JMP 00000001000703e0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                            0000000077bd1620 5 bytes JMP 0000000100070320
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                     0000000077bd1650 5 bytes JMP 00000001000703b0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                        0000000077bd1670 5 bytes JMP 0000000100070390
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                              0000000077bd16b0 5 bytes JMP 00000001000702e0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                            0000000077bd1730 5 bytes JMP 00000001000702d0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                          0000000077bd1750 5 bytes JMP 0000000100070310
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                           0000000077bd1790 5 bytes JMP 00000001000703c0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                        0000000077bd17e0 5 bytes JMP 00000001000703f0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                           0000000077bd1940 5 bytes JMP 0000000100070230
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                0000000077bd1b00 5 bytes JMP 0000000100070480
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                               0000000077bd1b30 5 bytes JMP 00000001000703a0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                        0000000077bd1c10 5 bytes JMP 00000001000702f0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                     0000000077bd1c20 5 bytes JMP 0000000100070350
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                           0000000077bd1c80 5 bytes JMP 0000000100070290
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                        0000000077bd1d10 5 bytes JMP 00000001000702b0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                         0000000077bd1d30 5 bytes JMP 00000001000703d0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                            0000000077bd1d40 5 bytes JMP 0000000100070330
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                     0000000077bd1db0 5 bytes JMP 0000000100070410
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                        0000000077bd1de0 5 bytes JMP 0000000100070240
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                             0000000077bd20a0 5 bytes JMP 00000001000701e0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                        0000000077bd2160 5 bytes JMP 0000000100070250
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                        0000000077bd2190 5 bytes JMP 0000000100070490
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                               0000000077bd21a0 5 bytes JMP 00000001000704a0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                          0000000077bd21d0 5 bytes JMP 0000000100070300
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                       0000000077bd21e0 5 bytes JMP 0000000100070360
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                             0000000077bd2240 5 bytes JMP 00000001000702a0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                          0000000077bd2290 5 bytes JMP 00000001000702c0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                             0000000077bd22c0 5 bytes JMP 0000000100070380
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                              0000000077bd22d0 5 bytes JMP 0000000100070340
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                       0000000077bd25c0 5 bytes JMP 0000000100070440
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                      0000000077bd27c0 5 bytes JMP 0000000100070260
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                         0000000077bd27d0 5 bytes JMP 0000000100070270
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                       0000000077bd27e0 5 bytes JMP 0000000100070400

hotte90 · 27.11.2013, 12:23

gmer Teil 4:

Code:

ATTFilter

.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                   0000000077bd29a0 5 bytes JMP 00000001000701f0
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                    0000000077bd29b0 5 bytes JMP 0000000100070210
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                         0000000077bd2a20 5 bytes JMP 0000000100070200
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                         0000000077bd2a80 5 bytes JMP 0000000100070420
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                          0000000077bd2a90 5 bytes JMP 0000000100070430
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                     0000000077bd2aa0 5 bytes JMP 0000000100070220
.text  C:\Windows\system32\Dwm.exe[1424] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                             0000000077bd2b80 5 bytes JMP 0000000100070280
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                                       0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                                0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                                0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                                     0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                           0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                                0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                         0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                            0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                                  0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                                0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                              0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                               0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                            0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                               0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                                    0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                                   0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                            0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                         0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                               0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                            0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                             0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                                0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                         0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                            0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                                 0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                            0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                            0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                                   0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                              0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                           0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                                 0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                              0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                                 0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                                  0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                           0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                          0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                             0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                           0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                                       0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                        0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                             0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                             0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                              0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                         0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                                 0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\Explorer.EXE[1684] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                      0000000077abeecd 1 byte [62]
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1728] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                   000000007581a2ba 1 byte [62]
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                 0000000076941465 2 bytes [94, 76]
.text  C:\Program Files (x86)\Secunia\PSI\sua.exe[1728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                00000000769414bb 2 bytes [94, 76]
.text  ...                                                                                                                      * 2
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                               0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                        0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                        0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                             0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                                   0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                        0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                                 0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                                    0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                          0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                        0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                      0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                       0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                                    0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                       0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                            0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                           0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                                    0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                                 0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                       0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                                    0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                                     0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                        0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                                 0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                                    0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                         0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                                    0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                                    0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                           0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                      0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                                   0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                         0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                      0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                         0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                          0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                                   0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                                  0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                                     0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                                   0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                               0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                                0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                                     0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                                     0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                      0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                                 0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                         0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\System32\svchost.exe[2100] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                              0000000077abeecd 1 byte [62]
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort                         0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                                  0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                  0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx                       0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess                             0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                                  0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory                           0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject                              0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                                    0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                                  0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection                                0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                                 0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread                              0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                                 0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort                      0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject                     0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair                              0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion                           0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                                 0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore                              0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx                               0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                                  0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess                           0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry                              0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                                   0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry                              0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey                              0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys                     0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair                                0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion                             0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                                   0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore                                0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                   0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                                    0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx                             0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder                            0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions                               0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread                             0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation                         0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState                          0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem                               0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess                               0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread                                0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl                           0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                                   0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Windows\system32\SearchIndexer.exe[2244] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                        0000000077abeecd 1 byte [62]
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort        0000000077bd1360 5 bytes JMP 0000000077d30460
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject                 0000000077bd13b0 5 bytes JMP 0000000077d30450
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                 0000000077bd1510 5 bytes JMP 0000000077d30370
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx      0000000077bd1560 5 bytes JMP 0000000077d30470
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess            0000000077bd1570 5 bytes JMP 0000000077d303e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection                 0000000077bd1620 5 bytes JMP 0000000077d30320
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory          0000000077bd1650 5 bytes JMP 0000000077d303b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject             0000000077bd1670 5 bytes JMP 0000000077d30390
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent                   0000000077bd16b0 5 bytes JMP 0000000077d302e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent                 0000000077bd1730 5 bytes JMP 0000000077d302d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection               0000000077bd1750 5 bytes JMP 0000000077d30310
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread                0000000077bd1790 5 bytes JMP 0000000077d303c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread             0000000077bd17e0 5 bytes JMP 0000000077d303f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry                0000000077bd1940 5 bytes JMP 0000000077d30230
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort     0000000077bd1b00 5 bytes JMP 0000000077d30480
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject    0000000077bd1b30 5 bytes JMP 0000000077d303a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair             0000000077bd1c10 5 bytes JMP 0000000077d302f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion          0000000077bd1c20 5 bytes JMP 0000000077d30350
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant                0000000077bd1c80 5 bytes JMP 0000000077d30290
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore             0000000077bd1d10 5 bytes JMP 0000000077d302b0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx              0000000077bd1d30 5 bytes JMP 0000000077d303d0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer                 0000000077bd1d40 5 bytes JMP 0000000077d30330
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess          0000000077bd1db0 5 bytes JMP 0000000077d30410
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry             0000000077bd1de0 5 bytes JMP 0000000077d30240
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver                  0000000077bd20a0 5 bytes JMP 0000000077d301e0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry             0000000077bd2160 5 bytes JMP 0000000077d30250
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey             0000000077bd2190 5 bytes JMP 0000000077d30490
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys    0000000077bd21a0 5 bytes JMP 0000000077d304a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair               0000000077bd21d0 5 bytes JMP 0000000077d30300
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion            0000000077bd21e0 5 bytes JMP 0000000077d30360
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant                  0000000077bd2240 5 bytes JMP 0000000077d302a0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore               0000000077bd2290 5 bytes JMP 0000000077d302c0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                  0000000077bd22c0 5 bytes JMP 0000000077d30380
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer                   0000000077bd22d0 5 bytes JMP 0000000077d30340
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx            0000000077bd25c0 5 bytes JMP 0000000077d30440
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder           0000000077bd27c0 5 bytes JMP 0000000077d30260
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions              0000000077bd27d0 5 bytes JMP 0000000077d30270
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread            0000000077bd27e0 5 bytes JMP 0000000077d30400
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation        0000000077bd29a0 5 bytes JMP 0000000077d301f0
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState         0000000077bd29b0 5 bytes JMP 0000000077d30210
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem              0000000077bd2a20 5 bytes JMP 0000000077d30200
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess              0000000077bd2a80 5 bytes JMP 0000000077d30420
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread               0000000077bd2a90 5 bytes JMP 0000000077d30430
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl          0000000077bd2aa0 5 bytes JMP 0000000077d30220
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl                  0000000077bd2b80 5 bytes JMP 0000000077d30280
.text  C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[2776] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189       0000000077abeecd 1 byte [62]
.text  C:\Program Files\AVAST Software\Avast\AvastUI.exe[2892] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112            000000007581a2ba 1 byte [62]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2968] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112              000000007581a2ba 1 byte [62]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            0000000076941465 2 bytes [94, 76]
.text  C:\Program Files (x86)\Secunia\PSI\psi_tray.exe[2968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155           00000000769414bb 2 bytes [94, 76]
.text  ...                                                                                                                      * 2
.text  C:\Users\root\Desktop\r3p6rlf2.exe[3800] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                           000000007581a2ba 1 byte [62]

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@clbcatq                                                  clbcatq.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@ole32                                                    ole32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@advapi32                                                 advapi32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@COMDLG32                                                 COMDLG32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@DllDirectory                                             %SystemRoot%\system32
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@DllDirectory32                                           %SystemRoot%\syswow64
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@gdi32                                                    gdi32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@IERTUTIL                                                 IERTUTIL.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@IMAGEHLP                                                 IMAGEHLP.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@IMM32                                                    IMM32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@kernel32                                                 kernel32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@LPK                                                      LPK.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@MSCTF                                                    MSCTF.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@MSVCRT                                                   MSVCRT.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@NORMALIZ                                                 NORMALIZ.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@NSI                                                      NSI.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@OLEAUT32                                                 OLEAUT32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@PSAPI                                                    PSAPI.DLL
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@rpcrt4                                                   rpcrt4.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@sechost                                                  sechost.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@Setupapi                                                 Setupapi.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@SHELL32                                                  SHELL32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@SHLWAPI                                                  SHLWAPI.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@URLMON                                                   URLMON.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@user32                                                   user32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@USP10                                                    USP10.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@WININET                                                  WININET.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@WLDAP32                                                  WLDAP32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@WS2_32                                                   WS2_32.dll
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs@DifxApi                                                  difxapi.dll
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type                                                                     2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start                                                                    2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl                                                             1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName                                                              aswFsBlk
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group                                                                    FSFilter Activity Monitor
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService                                                          FltMgr?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description                                                              avast! mini-filter driver (aswFsBlk)
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag                                                                      2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances                                                                
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance                                                aswFsBlk Instance
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance                                              
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                     388400
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                        0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk                                                                          
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type                                                                    2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start                                                                   2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl                                                            1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath                                                               \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName                                                             aswMonFlt
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group                                                                   FSFilter Anti-Virus
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService                                                         FltMgr?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description                                                             avast! mini-filter driver (aswMonFlt)
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances                                                               
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance                                               aswMonFlt Instance
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance                                            
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                   320700
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                      0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt                                                                         
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath                                                                  \SystemRoot\System32\Drivers\aswrdr2.sys
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type                                                                       1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start                                                                      1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl                                                               1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName                                                                aswRdr
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group                                                                      PNP_TDI
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService                                                            tcpip?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description                                                                avast! WFP Redirect driver
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters                                                                 
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault                                              
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault                                              nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRdr                                                                            
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type                                                                      1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start                                                                     0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl                                                              1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName                                                               aswRvrt
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description                                                               avast! Revert
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters                                                                
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter                                                    27
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter                                                    97068
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot                                                     \Device\Harddisk0\Partition2\Windows
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown                                               1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt                                                                           
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type                                                                       2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start                                                                      1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl                                                               1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName                                                                aswSnx
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group                                                                      FSFilter Virtualization
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService                                                            FltMgr?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description                                                                avast! virtualization driver (aswSnx)
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag                                                                        2
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance                                                  aswSnx Instance
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude                                         137600
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags                                            0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters                                                                 
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder                                                   \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder                                                      \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSnx                                                                            
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type                                                                        1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start                                                                       1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl                                                                1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName                                                                 aswSP
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description                                                                 avast! Self Protection
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield                                                      1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder                                                    \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder                                                       \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder                                               \DosDevices\C:\Program Files
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder                                                     \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen                                                  1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswSP                                                                             
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type                                                                       1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start                                                                      1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl                                                               1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName                                                                avast! Network Shield Support
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group                                                                      PNP_TDI
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService                                                            tcpip?
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description                                                                avast! Network Shield TDI driver
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag                                                                        9
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswTdi                                                                            
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type                                                                       1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start                                                                      0
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl                                                               1
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName                                                                aswVmm
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description                                                                avast! VM Monitor
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters                                                                 
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswVmm                                                                            
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type                                                             32
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start                                                            2
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl                                                     1
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath                                                        "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName                                                      avast! Antivirus
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group                                                            ShellSvcGroup
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService                                                  aswMonFlt?RpcSS?
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64                                                            1
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName                                                       LocalSystem
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType                                                   1
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description                                                      Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.
Reg    HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus                                                                  
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@clbcatq                                                      clbcatq.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@ole32                                                        ole32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@advapi32                                                     advapi32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@COMDLG32                                                     COMDLG32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@DllDirectory                                                 %SystemRoot%\system32
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@DllDirectory32                                               %SystemRoot%\syswow64
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@gdi32                                                        gdi32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@IERTUTIL                                                     IERTUTIL.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@IMAGEHLP                                                     IMAGEHLP.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@IMM32                                                        IMM32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@kernel32                                                     kernel32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@LPK                                                          LPK.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@MSCTF                                                        MSCTF.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@MSVCRT                                                       MSVCRT.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@NORMALIZ                                                     NORMALIZ.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@NSI                                                          NSI.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@OLEAUT32                                                     OLEAUT32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@PSAPI                                                        PSAPI.DLL
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@rpcrt4                                                       rpcrt4.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@sechost                                                      sechost.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@Setupapi                                                     Setupapi.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@SHELL32                                                      SHELL32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@SHLWAPI                                                      SHLWAPI.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@URLMON                                                       URLMON.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@user32                                                       user32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@USP10                                                        USP10.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@WININET                                                      WININET.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@WLDAP32                                                      WLDAP32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@WS2_32                                                       WS2_32.dll
Reg    HKLM\SYSTEM\ControlSet002\Control\Session Manager\KnownDLLs@DifxApi                                                      difxapi.dll
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type                                                                         2
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start                                                                        2
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl                                                                 1
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName                                                                  aswFsBlk
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group                                                                        FSFilter Activity Monitor
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService                                                              FltMgr?
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description                                                                  avast! mini-filter driver (aswFsBlk)
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag                                                                          2
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)                                            
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance                                                    aswFsBlk Instance
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)                          
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                         388400
Reg    HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                            0
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type                                                                        2
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start                                                                       2
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl                                                                1
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath                                                                   \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName                                                                 aswMonFlt
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group                                                                       FSFilter Anti-Virus
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService                                                             FltMgr?
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description                                                                 avast! mini-filter driver (aswMonFlt)
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)                                           
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance                                                   aswMonFlt Instance
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)                        
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                       320700
Reg    HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                          0
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath                                                                      \SystemRoot\System32\Drivers\aswrdr2.sys
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Type                                                                           1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Start                                                                          1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl                                                                   1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName                                                                    aswRdr
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Group                                                                          PNP_TDI
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService                                                                tcpip?
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr@Description                                                                    avast! WFP Redirect driver
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)                                             
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                  
Reg    HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                  nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type                                                                          1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start                                                                         0
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl                                                                  1
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName                                                                   aswRvrt
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description                                                                   avast! Revert
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)                                            
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter                                                        27
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter                                                        97068
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot                                                         \Device\Harddisk0\Partition2\Windows
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown                                                   1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Type                                                                           2
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Start                                                                          1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl                                                                   1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName                                                                    aswSnx
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Group                                                                          FSFilter Virtualization
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService                                                                FltMgr?
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Description                                                                    avast! virtualization driver (aswSnx)
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag                                                                            2
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)                                              
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance                                                      aswSnx Instance
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)                              
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude                                             137600
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags                                                0
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)                                             
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder                                                       \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder                                                          \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@Type                                                                            1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@Start                                                                           1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl                                                                    1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName                                                                     aswSP
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP@Description                                                                     avast! Self Protection
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)                                              
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield                                                          1
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder                                                        \DosDevices\C:\Program Files\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder                                                           \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder                                                   \DosDevices\C:\Program Files
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder                                                         \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg    HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@NoWelcomeScreen                                                      1
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Type                                                                           1
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Start                                                                          1
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl                                                                   1
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName                                                                    avast! Network Shield Support
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Group                                                                          PNP_TDI
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService                                                                tcpip?
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Description                                                                    avast! Network Shield TDI driver
Reg    HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag                                                                            9
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@Type                                                                           1
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@Start                                                                          0
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl                                                                   1
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName                                                                    aswVmm
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm@Description                                                                    avast! VM Monitor
Reg    HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)                                             
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type                                                                 32
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start                                                                2
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl                                                         1
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath                                                            "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName                                                          avast! Antivirus
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group                                                                ShellSvcGroup
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService                                                      aswMonFlt?RpcSS?
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64                                                                1
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName                                                           LocalSystem
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType                                                       1
Reg    HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description                                                          Verwaltet und implementiert avast! Antivirus-Dienste f?r diesen Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus-Container und den Planer.

---- EOF - GMER 2.1 ----

Das System wurde vor ca 2 Monaten aufgesetzt. Werde morgen vorsichtshalber mal ne neue Batterie besorgen![/CODE]

Aneri · 28.11.2013, 13:58

Hi

hast du schon eine neue Batterie im Motherboard?

Rein Malwaretechnisch sehe ich nichts in den Logfiles.

hotte90 · 28.11.2013, 18:44

Zitat:

Zitat von Aneri

Hi

hast du schon eine neue Batterie im Motherboard?

Rein Malwaretechnisch sehe ich nichts in den Logfiles.

Batterie wird nachher ersetzt. Das hört sich doch bestens an.

Sind wir denn durch?

Ach, da fällt mir gerade noch was ein: Kann man evtl. nachverfolgen, wann die von Combofix gelöschte Datei, installiert wurden ist?

Edit:

Irgendwie spinnen jetzt bei FF die Add-Ons rum:
Adblock wird im FF nicht mehr angezeigt, die Noscript -Einstellungen wurden zurückgesetzt (aber nur im Standartkonto). Das Problem hatte ich schonmal, hier: http://www.trojaner-board.de/141399-...-gefunden.html

Und nun?

28.11.2013, 13:58	#14
Aneri /// Malwareteam	Systemzeit setzt sich ständig zurück, Anwendungen hängen etc. Hi hast du schon eine neue Batterie im Motherboard? Rein Malwaretechnisch sehe ich nichts in den Logfiles. __________________ Gruß Aneri Mitglied von UNITE Lob oder Kritik? hier wirst du es los

Systemzeit setzt sich ständig zurück, Anwendungen hängen etc.

Plagegeister aller Art und deren Bekämpfung: Systemzeit setzt sich ständig zurück, Anwendungen hängen etc.