| |
| |||||||
Log-Analyse und Auswertung: Bei Installation Adobe Flash Player Virus eingefangen...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
24.03.2015, 10:31
| #1 |
 |  Bei Installation Adobe Flash Player Virus eingefangen... Liebes Trojaner Board Team, leider hat sich meine Frau gestern beim updaten/neuinstallieren des Adobe Flash Players einen Virus eingefangen. Neben dem Flash Player waren plötzlich eine Reihe anderer Programme installiert wie Virus Total Scanner, Air Globe, Opera (und weitere an die ich mich nicht mehr erinnern kann). Ich habe die Programme deinstalliert und Malwarebytes laufen lassen. Das Protokoll haenge ich am Ende nach den anderen Protokollen an. Des weiteren hat mich Avast aufgefordert aufgrund eines Root kits eine Startzeit Überprüfung durchzuführen. Diese habe ich durchgeführt, es wurde aber nichts gefunden. Aber im Avast sind alle alten Protokolle verschwunden bis auf eben diese neue Startzeit Überprüfung. Ausserdem popt seit dem Vorfall immer wieder eine Warnmeldung von Acer?? auf "Please download latest version of flash player" (Meldung siehe attachment). Es wundert mich ein bischen das diese Meldung ausgerechnet jetzt kommt, obwohl der Computer 5 Jahre alt ist und ich diese Meldung zuvor trotz manchmal alten flash player nie gesehen habe. Könnt ihr mir weiterhelfen? Es folgen die Logfiles: FRST Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015 Ran by Heiko (administrator) on HEIKO-NOTEBOOK on 24-03-2015 21:41:28 Running from C:\Users\Heiko\Desktop Loaded Profiles: Heiko (Available profiles: Heiko & Gast) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe (Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe (Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe (Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe (Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcServiceHost.exe (eFolder) C:\Program Files (x86)\Filecloud\bin\agent_service.exe (Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe () C:\Windows\PLFSetI.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Alcatel-Lucent) C:\Program Files\tcnz\pcTrayApp.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe (Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe (Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe (Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (eFolder) C:\Program Files (x86)\Filecloud\bin\agent_gui.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe (NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe (CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe (Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe (Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated) HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-14] () HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-10-01] (Acer Incorporated) HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-02] (Microsoft Corporation) HKLM\...\Run: [tcnz_McciTrayApp] => C:\Program Files\tcnz\pcTrayApp.exe [2782720 2013-07-26] (Alcatel-Lucent) HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.) HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-05-24] (NewTech Infosystems, Inc.) HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.) HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-07] (CyberLink Corp.) HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-06] (Acer Corp.) HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-27] (Microsoft Corporation) HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-28] (Apple Inc.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-06] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] () HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5511352 2015-03-21] (Avast Software s.r.o.) HKLM-x32\...\Run: [RegKillElbyCheck] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG) HKLM-x32\...\Run: [RegKillTray] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\RegKillTray.exe [49152 2002-11-28] (Elaborate Bytes) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\ Malwarebytes Anti-Malware \mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation) HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [Remote Control Editor] => C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1844296 2011-11-10] (Elgato Systems) HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.) HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> c:\windows\system32\ACER.SCR [438272 2009-07-08] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Filecloud.lnk ShortcutTarget: Filecloud.lnk -> C:\Program Files (x86)\Filecloud\bin\agent_gui.exe (eFolder) Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileModified] -> {23939489-8B41-45ec-90F3-BD36A9644006} => No File ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileSuccess] -> {23939488-8B41-45ec-90F3-BD36A9644006} => No File ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (Avast Software s.r.o.) ShellIconOverlayIdentifiers: [AnchorOverlayAttention] -> {40D1DAA7-9CB5-4DB7-8610-A814EDB003A5} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder) ShellIconOverlayIdentifiers: [AnchorOverlayLockedSynced] -> {5B05543A-73D8-4D80-97F9-13F471224DD8} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder) ShellIconOverlayIdentifiers: [AnchorOverlayLockedSyncing] -> {1C514AC9-A6B4-4692-A18E-9A2EE0B4E277} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder) ShellIconOverlayIdentifiers: [AnchorOverlaySynced] -> {56E89524-684C-4352-B350-F97A7377DD64} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder) ShellIconOverlayIdentifiers: [AnchorOverlaySyncing] -> {C6B3FD8D-C629-4A7F-AF73-9ABB59AF029D} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder) ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.) BootExecute: autocheck autochk * sdnclean64.exe CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/ SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms} BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-03-21] (Avast Software s.r.o.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation) BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-27] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-03-21] (Avast Software s.r.o.) BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.) BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll [2011-06-25] (TerraTec Electronic GmbH) DPF: HKLM-x32 {2D36AF92-04D3-11D8-B719-0000865F231B} https://my.sabre.com/jars/TMinReqX.dll DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-04-09] (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 0.0.0.0 FireFox: ======== FF ProfilePath: C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\532md588.default-1422251137045 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] () FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation) FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN) FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] () FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation) FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll [2013-07-26] (Alcatel-Lucent) FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll [2013-07-26] (Alcatel-Lucent) FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Windows\system32\TVUAx\npTVUAx.dll No File FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-11] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-10-26] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-10-26] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-10-26] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-10-26] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-10-26] (Apple Inc.) FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-03-22] FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\mcciwbch@motive.com.xpi [2015-03-22] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-14] Chrome: ======= CHR Profile: C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Docs) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-08] CHR Extension: (Google Drive) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-08] CHR Extension: (YouTube) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-08] CHR Extension: (Google Search) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-08] CHR Extension: (Motive Extension) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec [2014-03-12] CHR Extension: (Avast Online Security) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-10] CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17] CHR Extension: (Google Wallet) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-08] CHR Extension: (Gmail) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-08] CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2014-03-12] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-03-18] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.) R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-03-21] (Avast Software s.r.o.) R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company) S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed] R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation) R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed] R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation) S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe [37176 2014-04-15] (The OpenVPN Project) R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2013-07-26] (Alcatel-Lucent) [File not signed] R2 pcServiceHost; C:\Program Files\Common Files\Motive\pcServiceHost.exe [342528 2013-07-26] (Alcatel-Lucent) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed] R2 SyncedTool; C:\Program Files (x86)\Filecloud\bin\agent_service.exe [8190648 2015-02-27] (eFolder) S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation) S2 HsspConfig; C:\Windows\system32\CfgSrvc.exe [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31968 2012-10-08] (Wondershare) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-21] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-21] (Avast Software s.r.o.) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-21] (Avast Software s.r.o.) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-21] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-21] (Avast Software s.r.o.) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [441728 2015-03-21] (Avast Software s.r.o.) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-21] (Avast Software s.r.o.) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [268640 2015-03-21] () S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2010-12-30] () S2 ElbyCDIO; C:\Windows\SysWOW64\Drivers\ElbyCDIO.sys [16320 2002-11-30] (Elaborate Bytes AG) [File not signed] S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-30] (Huawei Technologies Co., Ltd.) R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-12-30] () S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [631360 2009-11-17] (DiBcom SA) S3 MODRC; C:\Windows\System32\DRIVERS\modrc.sys [23744 2009-11-17] (DiBcom S.A.) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation) S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed] S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed] R3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) U0 nesnrd; C:\Windows\System32\drivers\aihh.sys [79064 2015-03-24] (Malwarebytes Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation) S3 RegKill; C:\Windows\SysWOW64\Drivers\RegKill.sys [6400 2002-11-28] (Elaborate Bytes) [File not signed] S3 StarOpen; No ImagePath R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [146928 2009-10-06] (CyberLink Corp.) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 massfilter; system32\drivers\massfilter.sys [X] S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X] S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X] S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X] S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X] S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X] S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X] S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-24 21:41 - 2015-03-24 21:42 - 00027509 _____ () C:\Users\Heiko\Desktop\FRST.txt 2015-03-24 21:41 - 2015-03-24 21:41 - 00000000 ____D () C:\FRST 2015-03-24 21:40 - 2015-03-24 21:40 - 00000472 _____ () C:\Users\Heiko\Desktop\defogger_disable.log 2015-03-24 21:40 - 2015-03-24 21:40 - 00000000 _____ () C:\Users\Heiko\defogger_reenable 2015-03-24 21:38 - 2015-03-24 21:39 - 00380416 _____ () C:\Users\Heiko\Desktop\Gmer-19357.exe 2015-03-24 21:38 - 2015-03-24 21:38 - 02095616 _____ (Farbar) C:\Users\Heiko\Desktop\FRST64.exe 2015-03-24 21:38 - 2015-03-24 21:38 - 01135104 _____ (Farbar) C:\Users\Heiko\Desktop\FRST.exe 2015-03-24 21:37 - 2015-03-24 21:37 - 00050477 _____ () C:\Users\Heiko\Desktop\Defogger.exe 2015-03-24 21:27 - 2015-03-24 21:27 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\aihh.sys 2015-03-24 09:18 - 2015-03-24 09:20 - 00014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log 2015-03-24 00:02 - 2015-03-24 00:02 - 00276016 _____ () C:\Windows\Minidump\032415-22682-01.dmp 2015-03-23 20:56 - 2015-03-23 20:56 - 02168320 _____ () C:\Users\Heiko\Desktop\adwcleaner_4.113.exe 2015-03-23 20:52 - 2015-03-23 20:52 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-03-23 20:52 - 2015-03-23 20:52 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Opera Software 2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Opera Software 2015-03-23 20:23 - 2015-03-23 20:27 - 00000000 ____D () C:\Program Files (x86)\Opera 2015-03-22 10:41 - 2015-03-22 10:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2015-03-21 10:43 - 2015-03-21 10:43 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe 2015-03-21 10:43 - 2015-03-21 10:43 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr 2015-03-21 10:33 - 2015-03-21 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software 2015-03-17 15:46 - 2015-03-23 23:47 - 00000000 ____D () C:\AdwCleaner 2015-03-17 09:48 - 2004-03-09 00:00 - 00440352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSHFLXGD.OCX 2015-03-17 09:35 - 2015-01-17 15:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll 2015-03-17 09:35 - 2015-01-17 15:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll 2015-03-17 09:34 - 2015-02-24 16:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2015-03-17 09:34 - 2015-02-24 15:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2015-03-17 09:34 - 2015-02-21 14:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2015-03-17 09:34 - 2015-02-21 13:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2015-03-17 09:34 - 2015-02-21 13:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2015-03-17 09:34 - 2015-02-21 13:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2015-03-17 09:34 - 2015-02-21 13:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2015-03-17 09:34 - 2015-02-21 12:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2015-03-17 09:34 - 2015-02-21 12:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2015-03-17 09:34 - 2015-02-20 16:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2015-03-17 09:34 - 2015-02-20 16:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2015-03-17 09:34 - 2015-02-20 15:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2015-03-17 09:34 - 2015-02-20 15:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2015-03-17 09:34 - 2015-02-20 15:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2015-03-17 09:34 - 2015-02-20 15:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2015-03-17 09:34 - 2015-02-20 15:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2015-03-17 09:34 - 2015-02-20 15:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2015-03-17 09:34 - 2015-02-20 15:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2015-03-17 09:34 - 2015-02-20 15:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2015-03-17 09:34 - 2015-02-20 15:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2015-03-17 09:34 - 2015-02-20 15:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2015-03-17 09:34 - 2015-02-20 15:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2015-03-17 09:34 - 2015-02-20 15:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2015-03-17 09:34 - 2015-02-20 15:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2015-03-17 09:34 - 2015-02-20 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2015-03-17 09:34 - 2015-02-20 15:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2015-03-17 09:34 - 2015-02-20 15:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2015-03-17 09:34 - 2015-02-20 15:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2015-03-17 09:34 - 2015-02-20 15:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2015-03-17 09:34 - 2015-02-20 15:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2015-03-17 09:34 - 2015-02-20 15:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2015-03-17 09:34 - 2015-02-20 15:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2015-03-17 09:34 - 2015-02-20 15:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2015-03-17 09:34 - 2015-02-20 15:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2015-03-17 09:34 - 2015-02-20 15:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2015-03-17 09:34 - 2015-02-20 15:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2015-03-17 09:34 - 2015-02-20 14:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2015-03-17 09:34 - 2015-02-20 14:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2015-03-17 09:34 - 2015-02-20 14:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2015-03-17 09:34 - 2015-02-20 14:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2015-03-17 09:34 - 2015-02-20 14:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2015-03-17 09:34 - 2015-02-20 14:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2015-03-17 09:34 - 2015-02-20 14:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2015-03-17 09:34 - 2015-02-20 14:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2015-03-17 09:34 - 2015-02-20 14:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2015-03-17 09:34 - 2015-02-20 14:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2015-03-17 09:34 - 2015-02-20 14:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2015-03-17 09:34 - 2015-02-20 14:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2015-03-17 09:34 - 2015-02-20 14:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2015-03-17 09:34 - 2015-02-20 14:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2015-03-17 09:34 - 2015-02-20 14:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2015-03-17 09:34 - 2015-02-20 14:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2015-03-17 09:34 - 2015-02-20 14:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2015-03-17 09:34 - 2015-02-20 14:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2015-03-17 09:34 - 2015-02-20 13:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2015-03-17 09:34 - 2015-02-20 13:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2015-03-17 09:33 - 2015-02-03 16:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2015-03-17 09:33 - 2015-02-03 16:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys 2015-03-17 09:33 - 2015-02-03 16:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi 2015-03-17 09:33 - 2015-02-03 16:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2015-03-17 09:33 - 2015-02-03 16:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2015-03-17 09:33 - 2015-02-03 16:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll 2015-03-17 09:33 - 2015-02-03 16:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2015-03-17 09:33 - 2015-02-03 16:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll 2015-03-17 09:33 - 2015-02-03 16:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2015-03-17 09:33 - 2015-02-03 16:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2015-03-17 09:33 - 2015-02-03 16:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2015-03-17 09:33 - 2015-02-03 16:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2015-03-17 09:33 - 2015-02-03 16:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll 2015-03-17 09:33 - 2015-02-03 16:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2015-03-17 09:32 - 2015-02-03 16:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi 2015-03-17 09:32 - 2015-02-03 16:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll 2015-03-17 09:32 - 2015-02-03 16:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe 2015-03-17 09:32 - 2015-02-03 16:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2015-03-17 09:32 - 2015-02-03 16:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe 2015-03-17 09:32 - 2015-02-03 16:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2015-03-17 09:32 - 2015-02-03 16:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2015-03-17 09:32 - 2014-11-01 11:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe 2015-03-17 09:31 - 2015-02-03 16:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2015-03-17 09:31 - 2015-02-03 16:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll 2015-03-17 09:31 - 2015-02-03 16:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll 2015-03-17 09:31 - 2015-02-03 16:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll 2015-03-17 09:31 - 2015-02-03 16:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll 2015-03-17 09:31 - 2015-02-03 16:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe 2015-03-17 09:31 - 2015-02-03 16:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2015-03-17 09:31 - 2015-02-03 16:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll 2015-03-17 09:31 - 2015-02-03 16:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll 2015-03-17 09:31 - 2015-02-03 16:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2015-03-17 09:31 - 2015-02-03 16:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2015-03-17 09:31 - 2015-02-03 16:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll 2015-03-17 09:31 - 2015-02-03 16:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2015-03-17 09:31 - 2015-02-03 16:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe 2015-03-17 09:31 - 2015-02-03 16:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe 2015-03-17 09:31 - 2015-02-03 16:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys 2015-03-17 09:31 - 2015-02-03 16:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll 2015-03-17 09:31 - 2015-02-03 16:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll 2015-03-17 09:31 - 2015-02-03 16:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll 2015-03-17 09:31 - 2015-02-03 16:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2015-03-17 09:31 - 2015-02-03 16:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll 2015-03-17 09:31 - 2015-02-03 16:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll 2015-03-17 09:31 - 2015-02-03 16:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2015-03-17 09:31 - 2015-02-03 16:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2015-03-17 09:31 - 2015-02-03 16:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2015-03-17 09:30 - 2015-02-03 16:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll 2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx 2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll 2015-03-17 09:30 - 2015-02-03 16:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2015-03-17 09:30 - 2015-02-03 16:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe 2015-03-17 09:30 - 2015-02-03 16:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll 2015-03-17 09:30 - 2015-02-03 16:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2015-03-17 09:30 - 2015-02-03 16:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2015-03-17 09:30 - 2015-02-03 16:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll 2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx 2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll 2015-03-17 09:30 - 2015-02-03 16:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2015-03-17 09:30 - 2015-02-03 16:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2015-03-17 09:30 - 2015-02-03 16:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2015-03-17 09:30 - 2015-02-03 15:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys 2015-03-17 09:22 - 2015-03-06 18:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2015-03-17 09:22 - 2015-03-06 18:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2015-03-17 09:22 - 2015-03-06 18:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2015-03-17 09:22 - 2015-03-06 18:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll 2015-03-17 09:22 - 2015-03-06 18:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe 2015-03-17 09:22 - 2015-03-06 18:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2015-03-17 09:22 - 2015-03-06 18:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2015-03-17 09:22 - 2015-03-06 18:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll 2015-03-17 09:22 - 2015-03-06 18:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2015-03-17 09:22 - 2015-03-06 18:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2015-03-17 09:22 - 2015-03-06 18:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll 2015-03-17 09:22 - 2015-03-06 18:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll 2015-03-17 09:22 - 2015-03-06 18:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe 2015-03-17 09:22 - 2015-01-31 12:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2015-03-17 09:21 - 2015-03-06 18:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2015-03-17 09:21 - 2015-03-06 18:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll 2015-03-17 09:21 - 2015-03-06 18:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll 2015-03-17 09:21 - 2015-03-06 18:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll 2015-03-17 09:21 - 2015-03-06 18:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2015-03-17 09:21 - 2015-03-06 18:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll 2015-03-17 09:21 - 2015-03-06 18:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2015-03-17 09:21 - 2015-03-06 18:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll 2015-03-17 09:21 - 2015-03-06 18:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll 2015-03-17 09:21 - 2015-03-06 18:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll 2015-03-17 09:17 - 2015-02-20 16:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2015-03-17 09:17 - 2015-02-03 16:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2015-03-17 09:17 - 2015-02-03 16:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2015-03-17 09:16 - 2015-02-20 17:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2015-03-17 09:16 - 2015-02-20 17:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2015-03-17 09:16 - 2015-02-20 17:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2015-03-17 09:16 - 2015-02-20 17:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2015-03-17 09:16 - 2015-02-20 17:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2015-03-17 09:16 - 2015-02-20 17:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2015-03-17 09:16 - 2015-02-20 17:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2015-03-17 09:16 - 2015-02-20 17:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2015-03-17 09:16 - 2015-02-20 16:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2015-03-17 09:16 - 2015-02-13 18:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2015-03-17 09:16 - 2015-02-13 18:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2015-03-17 09:13 - 2015-02-03 16:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll 2015-03-17 09:13 - 2015-02-03 16:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll 2015-03-17 09:13 - 2015-01-31 16:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2015-03-17 09:13 - 2015-01-31 16:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2015-03-17 09:13 - 2015-01-31 12:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2015-03-17 09:12 - 2015-02-26 16:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2015-03-17 08:52 - 2015-02-04 16:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2015-03-17 08:52 - 2015-02-04 15:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2015-03-13 09:54 - 2015-03-13 09:54 - 00010484 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel 2015-03-08 20:53 - 2015-03-08 20:53 - 00001717 _____ () C:\Users\Public\Desktop\iTunes.lnk 2015-03-08 20:53 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes 2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\Program Files\iTunes 2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files\iPod 2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files (x86)\iTunes 2015-03-06 08:17 - 2015-03-06 08:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype 2015-02-25 21:53 - 2015-01-09 12:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls 2015-02-25 21:53 - 2015-01-09 12:43 - 00419936 _____ () C:\Windows\system32\locale.nls ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-03-24 21:40 - 2009-12-30 01:44 - 00000000 ____D () C:\Users\Heiko 2015-03-24 21:29 - 2014-02-07 14:05 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\BitTorrent 2015-03-24 21:28 - 2009-11-14 21:24 - 01323309 _____ () C:\Windows\WindowsUpdate.log 2015-03-24 21:27 - 2009-10-29 06:36 - 00000000 ____D () C:\Windows\oem 2015-03-24 21:07 - 2014-01-08 10:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2015-03-24 15:15 - 2014-06-07 10:26 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-03-24 15:07 - 2014-01-08 10:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-03-24 12:16 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-03-24 12:16 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-03-24 12:15 - 2009-11-15 06:13 - 00703476 _____ () C:\Windows\system32\perfh007.dat 2015-03-24 12:15 - 2009-11-15 06:13 - 00151084 _____ () C:\Windows\system32\perfc007.dat 2015-03-24 12:15 - 2009-07-14 18:13 - 01630508 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-03-24 12:07 - 2009-07-14 18:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-03-24 12:06 - 2011-02-25 21:54 - 00256032 _____ () C:\Windows\PFRO.log 2015-03-24 12:06 - 2011-02-25 21:54 - 00125727 _____ () C:\Windows\setupact.log 2015-03-24 09:21 - 2014-11-19 15:35 - 00000000 ____D () C:\Users\Heiko\Documents\Outlook Files 2015-03-24 09:21 - 2009-07-14 18:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games 2015-03-24 09:18 - 2009-12-31 04:56 - 00000000 ____D () C:\Program Files\Zubehör 2015-03-24 09:17 - 2010-04-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Zattoo4 2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer 2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\Program Files (x86)\Acer 2015-03-24 08:57 - 2015-02-12 18:24 - 00000050 _____ () C:\Windows\astplus.ini 2015-03-24 00:02 - 2011-11-29 23:20 - 00000000 ____D () C:\Windows\Minidump 2015-03-24 00:01 - 2015-01-29 18:08 - 641507154 _____ () C:\Windows\MEMORY.DMP 2015-03-23 23:34 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\Web 2015-03-23 20:53 - 2014-08-18 10:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Adobe 2015-03-23 20:27 - 2009-12-30 01:45 - 00001429 _____ () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2015-03-23 20:10 - 2014-02-06 09:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-03-23 20:07 - 2009-07-14 18:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2015-03-23 20:06 - 2012-05-09 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-03-22 22:25 - 2009-12-30 06:37 - 00002358 ____H () C:\Users\Heiko\Documents\Default.rdp 2015-03-22 20:18 - 2014-02-01 18:03 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2015-03-22 07:24 - 2013-10-07 10:39 - 00000000 ____D () C:\Users\Gast 2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\NDF 2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\registration 2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\AppCompat 2015-03-21 10:43 - 2014-04-27 16:11 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys 2015-03-21 10:43 - 2013-12-29 21:47 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys 2015-03-21 10:43 - 2013-03-14 11:09 - 00268640 _____ () C:\Windows\system32\Drivers\aswVmm.sys 2015-03-21 10:43 - 2013-03-14 11:09 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys 2015-03-21 10:43 - 2012-02-25 21:27 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys 2015-03-21 10:43 - 2009-12-30 09:01 - 00441728 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys 2015-03-21 10:43 - 2009-12-30 09:01 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys 2015-03-21 10:42 - 2011-03-14 07:00 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys 2015-03-21 10:40 - 2009-07-14 18:32 - 00000000 ____D () C:\Windows\system32\FxsTmp 2015-03-21 10:33 - 2014-11-22 08:27 - 00001897 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk 2015-03-17 18:55 - 2014-04-24 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Computer Troubleshooters Calling Card 2015-03-17 12:29 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\rescache 2015-03-17 10:54 - 2009-07-14 17:45 - 00450496 _____ () C:\Windows\system32\FNTCACHE.DAT 2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism 2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\Dism 2015-03-17 10:45 - 2009-10-29 18:45 - 00000000 ____D () C:\ProgramData\Microsoft Help 2015-03-17 10:28 - 2014-04-24 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2015-03-17 10:28 - 2009-07-14 15:34 - 00000510 _____ () C:\Windows\win.ini 2015-03-17 10:26 - 2013-07-11 18:58 - 00000000 ____D () C:\Windows\system32\MRT 2015-03-17 10:11 - 2009-12-30 01:59 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2015-03-17 09:48 - 2015-02-12 18:24 - 00001751 _____ () C:\Users\Public\Desktop\Astroplus.lnk 2015-03-17 09:48 - 2015-02-12 18:24 - 00001741 _____ () C:\Users\Public\Desktop\Astroplus (classic Design).lnk 2015-03-17 09:48 - 2015-02-12 18:24 - 00000872 _____ () C:\Users\Public\Desktop\Planetary Hours.lnk 2015-03-17 09:48 - 2015-02-12 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astrocontact Astroplus 2015-03-13 11:37 - 2014-11-05 20:06 - 00000000 ____D () C:\Users\Heiko\.gimp-2.8 2015-03-13 09:54 - 2014-11-05 20:21 - 00000000 ____D () C:\Users\Heiko\AppData\Local\gtk-2.0 2015-03-08 20:52 - 2010-09-23 09:08 - 00000000 ____D () C:\Program Files\Common Files\Apple 2015-03-06 21:40 - 2010-01-04 19:57 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype 2015-03-06 08:17 - 2014-03-01 21:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk 2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ___RD () C:\Program Files (x86)\Skype 2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ____D () C:\ProgramData\Skype 2015-03-05 12:53 - 2009-07-14 18:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2015-03-04 02:17 - 2009-12-30 01:58 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2015-02-28 16:20 - 2014-06-26 19:33 - 00000000 ____D () C:\Program Files (x86)\Filecloud ==================== Files in the root of some directories ======= 2010-01-27 08:43 - 2010-01-27 08:43 - 0000034 _____ () C:\Users\Heiko\AppData\Roaming\pcouffin.log 2010-01-27 08:42 - 2010-01-27 08:42 - 0082816 _____ (VSO Software) C:\Users\Heiko\AppData\Roaming\pcouffin.sys 2010-01-17 01:40 - 2010-01-17 01:40 - 0003584 _____ () C:\Users\Heiko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-10-27 03:38 - 2013-10-27 03:38 - 0004096 ____H () C:\Users\Heiko\AppData\Local\keyfile3.drm 2015-03-24 09:18 - 2015-03-24 09:20 - 0014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log 2015-03-13 09:54 - 2015-03-13 09:54 - 0010484 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel 2010-06-11 23:01 - 2013-12-30 08:25 - 0017408 _____ () C:\Users\Heiko\AppData\Local\WebpageIcons.db 2014-01-08 21:39 - 2014-01-08 21:39 - 0000057 _____ () C:\ProgramData\Ament.ini 2009-11-14 21:25 - 2009-11-14 21:28 - 0008308 _____ () C:\ProgramData\ArcadeDeluxe3.log 2010-01-04 19:59 - 2010-01-04 19:59 - 0000056 ____H () C:\ProgramData\ezsidmv.dat 2009-10-29 18:58 - 2009-07-18 14:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe Some content of TEMP: ==================== C:\Users\Heiko\AppData\Local\Temp\Quarantine.exe C:\Users\Heiko\AppData\Local\Temp\sqlite3.dll ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-03-17 12:05 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by Heiko at 2015-03-24 21:42:48
Running from C:\Users\Heiko\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
64 Bit HP CIO Components Installer (Version: 7.2.8 - Hewlett-Packard) Hidden
Acer Arcade Deluxe (HKLM-x32\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 3.0.7006 - CyberLink Corp.)
Acer Arcade Deluxe (x32 Version: 3.0.7006 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.63 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.74.216 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.74.216 - Chicony Electronics Co.,Ltd.)
Acer ePower Management (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.05.3004 - Acer Incorporated)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.5.0715 - Acer Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 16.0.0.245 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.134 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{82C9101B-36EC-5821-DD8B-05480074A0B8}) (Version: 8.0.873.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{447CDCE5-F555-429B-BFA6-642C3C6D684F}) (Version: 3.1.2 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DF7096B-715A-4233-8633-C7A16ED6D616}) (Version: 3.1.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C4123106-B685-48E6-B9BD-E4F911841EB4}) (Version: 8.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Astrocontact Astroplus (HKLM-x32\...\Astrocontact Astroplus_is1) (Version: - Astrocontact Software)
ATI AVIVO64 Codecs (Version: 10.7.0.40702 - ATI Technologies Inc.) Hidden
Avast Free Antivirus (HKLM-x32\...\avast) (Version: 10.2.2214 - AVAST Software)
Backup Manager Basic (x32 Version: 2.0.0.63 - NewTech Infosystems) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Broadcom Gigabit NetLink Controller (HKLM\...\{96F70DF8-160F-4F9C-9B9E-2A9B439B4EB9}) (Version: 12.26.02 - Broadcom Corporation)
Bullzip PDF Printer 7.1.0.1082 (HKLM\...\Bullzip PDF Printer_is1) (Version: - Bullzip)
CCS64 V3.8 (HKLM-x32\...\{B7B5A370-3DFF-4F0E-AE11-FD267C4938AA}) (Version: 1.0.0 - Computerbrains C.C.S.)
Cinergy DT USB XS Diversity V3.12.00.00a (HKLM-x32\...\Cinergy DT USB XS Diversity) (Version: 3.12.00.00a - )
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Computer Troubleshooters Calling Card (HKLM-x32\...\{C2835850-FCEB-4A1A-A213-57E7A9A8EC62}) (Version: 7.0.454 - LogMeIn, Inc.)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dropbox (HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)
DVD Region Killer (HKLM-x32\...\DVD Region Killer) (Version: - Elaborate Bytes)
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Filecloud (HKLM\...\Filecloud 2.0.0.562) (Version: 2.2.4.705 - Anchor)
Fotogalerie (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Foxit PDF Editor (HKLM-x32\...\Foxit PDF Editor) (Version: - )
Foxit PDF Preview Handler (HKLM-x32\...\{6FE22909-D0D6-4111-ABCE-7F8D986C4A2A}) (Version: 1.0.0 - Tim Heuer)
FUSSBALL MANAGER 09 (HKLM-x32\...\FUSSBALL MANAGER 09) (Version: - Electronic Arts)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 41.0.2272.101 - Google Inc.)
Google Update Helper (x32 Version: 1.3.26.9 - Google Inc.) Hidden
Gothic (HKLM-x32\...\{BBF10B37-4ED3-11D5-A818-00500435FC18}) (Version: - )
Gothic III (HKLM-x32\...\{02B244A2-7F6A-42E8-A36F-8C385D7A1625}) (Version: 1.0.0 - JoWooD Productions Software AG)
Gothic_Patch (HKLM-x32\...\{302AC480-43D2-11D5-A818-00500435FC18}) (Version: - )
GoToMeeting 4.8.0.723 (HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\GoToMeeting) (Version: 4.8.0.723 - CitrixOnline)
Governor of Poker 2 Premium Edition v1.0 Multi (HKLM-x32\...\{8BF806C4-2D77-4F67-8435-D4BDCEB665A8}_is1) (Version: - My Company, Inc.)
GPL Ghostscript Lite 8.70 (HKLM-x32\...\GPL Ghostscript Lite_is1) (Version: - )
HiJackThis (HKLM-x32\...\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}) (Version: 1.0.0 - Trend Micro)
HMA! Pro VPN 2.8.6.0 (HKLM-x32\...\HMA! Pro VPN) (Version: 2.8.6.0 - Privax Ltd)
HP FWUpdateEDO2 (HKLM-x32\...\{415FA9AD-DA10-4ABE-97B6-5051D4795C90}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Officejet 6700 - Grundlegende Software für das Gerät (HKLM\...\{9086D601-50B7-491D-A143-28193DADE36B}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6700 Hilfe (HKLM-x32\...\{E1AE0CB7-1333-4728-8520-CB3F88A252B4}) (Version: 140.0.2.2 - Hewlett Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.9572 - HP)
HP Support Solutions Framework (HKLM-x32\...\{96D12EC9-720B-45FB-904C-36D6307A1C76}) (Version: 11.51.0048 - Hewlett-Packard Company)
HP Update (HKLM-x32\...\{912D30CF-F39E-4B31-AD9A-123C6B794EE2}) (Version: 5.005.002.002 - Hewlett-Packard)
HPDiagnosticAlert (x32 Version: 1.00.0001 - Microsoft) Hidden
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
IBP 12.0.4 (HKLM-x32\...\IBP12_is1) (Version: 12.0.4 - Axandra GmbH)
iCloud (HKLM\...\{309768A4-A2BB-4930-A5A2-8169678C9B4C}) (Version: 4.0.6.28 - Apple Inc.)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3002 - Acer Incorporated)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
iTunes (HKLM\...\{D227565A-0033-40AD-89BA-653A205CDC11}) (Version: 12.1.1.4 - Apple Inc.)
Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.510 - Oracle)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218031F0}) (Version: 8.0.310 - Oracle Corporation)
K-Lite Mega Codec Pack 10.3.5 (HKLM-x32\...\KLiteCodecPack_is1) (Version: 10.3.5 - )
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.05 - Acer Inc.)
LSI HDA Modem (HKLM\...\LSI Soft Modem) (Version: 2.1.94 - LSI Corporation)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
MicroMachines V4 (HKLM-x32\...\{E4511CEC-2E60-4076-95B6-0E193269EB86}) (Version: 2.00.0000 - Codemasters)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version: - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Outlook 2013 (HKLM-x32\...\Office15.OUTLOOK) (Version: 15.0.4569.1506 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MobileMe Control Panel (HKLM\...\{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}) (Version: 3.1.8.0 - Apple Inc.)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Mozilla Firefox 36.0.4 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.4 (x86 de)) (Version: 36.0.4 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVC80_x64 (Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86 (x32 Version: 1.0.1.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
Open Systems Client (HKLM-x32\...\Open Systems Client) (Version: - )
Origin (HKLM-x32\...\Origin) (Version: 9.2.1.4399 - Electronic Arts, Inc.)
Outils de vérification linguistique 2013 de Microsoft Office*- Français (x32 Version: 15.0.4569.1506 - Microsoft Corporation) Hidden
Questpaket 4 Update 1 Deinstallation (HKLM-x32\...\G3QP231012008_is1) (Version: 4.1.0.0 - Humanforce)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5911 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)
Service Pack 1 for Microsoft Office 2013 (KB2850036) 32-Bit Edition (HKLM-x32\...\{90150000-001A-0000-0000-0000000FF1CE}_Office15.OUTLOOK_{7F6C4883-A18C-459A-82C1-A2F9403F2DA6}) (Version: - Microsoft)
Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.11.9874 - Skype Technologies S.A.)
Skype™ 7.1 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.1.105 - Skype Technologies S.A.)
SpywareBlaster 5.0 (HKLM-x32\...\SpywareBlaster_is1) (Version: 5.0.0 - BrightFort LLC)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
Telecom Broadband Assist (HKLM-x32\...\tcnz) (Version: BCM 7.1 - Telecom New Zealand)
TerraTec Home Cinema (HKLM-x32\...\{63B9BAB5-F36A-4A3B-9E5C-68A7F212BFB9}) (Version: 6.25.6 - )
The Secret of Monkey Island: Special Edition (HKLM-x32\...\Steam App 32360) (Version: - LucasArts)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
WinRAR (HKLM\...\WinRAR archiver) (Version: - )
WinZip 16.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240CD}) (Version: 16.0.9715 - WinZip Computing, S.L. )
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
CustomCLSID: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Heiko\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Program Files (x86)\Citrix\GoToMeeting\723\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)
CustomCLSID: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
==================== Restore Points =========================
21-03-2015 10:40:37 avast! antivirus system restore point
21-03-2015 18:49:06 Windows Update
24-03-2015 09:19:03 Removed MyWinLocker.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-12-31 00:56 - 2014-11-12 23:35 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {0B0EFB60-E81C-4E52-9C52-81C67BF4F2BA} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-02] (Microsoft Corporation)
Task: {18FAB775-E45B-4AEB-B34E-55387F13BA0C} - System32\Tasks\{BB2DC1C3-8A57-456C-B7B7-F732E78670C3} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-01-23] (Skype Technologies S.A.)
Task: {37E4A83E-E6AB-4B7A-8972-68732ED21A7B} - System32\Tasks\HP AR Program Upload - 5726df83c48f49c582e89fe67edac45b49619e1230d046318938b356248442e8 => C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {38A400C5-2A73-47C5-B548-6200957378E4} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2015-03-21] (Avast Software s.r.o.)
Task: {3E4723B3-345A-4EEF-8241-DFF1B7ED18AC} - System32\Tasks\{8A97E6BB-AD56-407E-96B5-BCD32950B222} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2015-01-23] (Skype Technologies S.A.)
Task: {6112B9EE-63AF-48FF-8314-3985C3243D3A} - System32\Tasks\HP AR Program Upload - cf63165788e4407b8be8b23f288555044dfc0f37ab5947dd8b95350f5f7bf491 => C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {A2A69AF1-9240-46AE-8D0A-CD81D03F34CC} - System32\Tasks\HP AR Program Upload - cb1820fb8826424ebd96188620bcaffef3a19629a4ee44698a585c8e48dcce56 => C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {A583B008-7874-43FD-8102-F12905086FA8} - System32\Tasks\HP AR Program Upload - 8d5f0ca48f554248aa188d8e55c7bff935d294a91eb64ffe90c8498c2684203f => C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {A62F568E-D337-4057-9454-CE5EADF72A81} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-08] (Google Inc.)
Task: {A7450F14-BDB8-4643-BB1E-7C3CD9F92FB9} - System32\Tasks\HP AR Program Upload - 731408cb48a7498897219a734c7d22b3e8bdb04305dd4c9b9d750decff0e0102 => C:\Program Files\HP\HP Officejet 6700\bin\HPRewards.exe [2012-10-17] (TODO: <Company name>)
Task: {BDD788AA-51BD-45C4-A742-2C8884E96AF6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-08] (Google Inc.)
Task: {D761B838-6B9D-4B39-9DB3-A3AA141D7099} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {DE6E116E-38FD-493F-9B7C-61C11A85146C} - System32\Tasks\{36C2BEF2-3ECB-485D-A883-9BEBE6DC51C6} => pcalua.exe -a "C:\Users\Heiko\Downloads\Datenbank\Zubehör\Brenner und Player\Divx Player\DivXInstaller.exe" -d "C:\Users\Heiko\Downloads\Datenbank\Zubehör\Brenner und Player\Divx Player"
Task: {E1EFEE42-2106-4354-9D06-FDF71A40DA7D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2014-01-22] (Microsoft Corporation)
Task: {E48D6CDB-88B5-4ADD-AF4E-B2EFB55F4986} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {E71D95D6-CB6B-4847-968E-50E936ECBB44} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe
Task: {FBCDF857-C4B6-476D-9DC7-8FD207BA0273} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-02] (Apple Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) ==============
2015-01-20 22:35 - 2015-01-20 22:35 - 00085832 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01346344 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2015-01-21 14:59 - 2015-01-21 14:59 - 08898728 _____ () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2009-12-31 04:56 - 2009-12-13 03:12 - 00166400 _____ () C:\Program Files\Zubehör\Winrar\rarext.dll
2009-11-14 21:25 - 2009-11-14 21:24 - 00200704 _____ () C:\Windows\PLFSetI.exe
2015-03-21 10:43 - 2015-03-21 10:43 - 00104400 _____ () C:\Program Files\Alwil Software\Avast5\log.dll
2015-03-21 10:43 - 2015-03-21 10:43 - 00081728 _____ () C:\Program Files\Alwil Software\Avast5\JsonRpcServer.dll
2015-03-24 08:03 - 2015-03-24 08:03 - 02922496 _____ () C:\Program Files\Alwil Software\Avast5\defs\15032301\algo.dll
2010-05-24 18:16 - 2010-05-24 18:16 - 00465576 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2010-05-24 18:09 - 2010-05-24 18:09 - 01081600 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2014-06-26 19:33 - 2012-06-15 01:36 - 00107520 _____ () C:\Program Files (x86)\Filecloud\bin\zlib1.dll
2015-01-20 22:35 - 2015-01-20 22:35 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-06-26 19:33 - 2014-10-30 11:55 - 00033280 _____ () C:\Program Files (x86)\Filecloud\bin\QtSolutions_SingleApplication-head.dll
2014-12-28 14:40 - 2014-09-12 00:46 - 00877056 _____ () C:\Program Files (x86)\Filecloud\bin\platforms\qwindows.dll
2014-12-28 14:40 - 2014-09-12 00:45 - 00024064 _____ () C:\Program Files (x86)\Filecloud\bin\imageformats\qico.dll
2015-03-21 10:43 - 2015-03-21 10:43 - 40540672 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2015-03-21 10:43 - 2015-03-21 10:43 - 01359872 _____ () C:\Program Files\Alwil Software\Avast5\libglesv2.dll
2015-03-21 10:43 - 2015-03-21 10:43 - 00212992 _____ () C:\Program Files\Alwil Software\Avast5\libegl.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\ProgramData\Temp:0B9176C0
AlternateDataStreams: C:\ProgramData\Temp:5C321E34
AlternateDataStreams: C:\ProgramData\Temp:5D7E5A8F
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
==================== EXE Association (whitelisted) ===============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== Other Areas ============================
(Currently there is no automatic fix for this section.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.1.254
==================== MSCONFIG/TASK MANAGER disabled items ==
(Currently there is no automatic fix for this section.)
MSCONFIG\startupreg: MobileConnect => %programfiles%\Vodafone\Vodafone Mobile Connect\Bin\MobileConnect.exe /silent
MSCONFIG\startupreg: NokiaMServer => C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup
MSCONFIG\startupreg: Steam => "C:\Program Files (x86)\Steam\steam.exe" -silent
MSCONFIG\startupreg: TomTomHOME.exe => "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe"
==================== Accounts: =============================
Administrator (S-1-5-21-3175191187-1249783048-3626377888-500 - Administrator - Disabled)
Gast (S-1-5-21-3175191187-1249783048-3626377888-501 - Limited - Enabled) => C:\Users\Gast
Heiko (S-1-5-21-3175191187-1249783048-3626377888-1000 - Administrator - Enabled) => C:\Users\Heiko
HomeGroupUser$ (S-1-5-21-3175191187-1249783048-3626377888-1014 - Limited - Enabled)
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (03/24/2015 09:21:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x1604
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
Error: (03/24/2015 09:20:53 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Heiko-Notebook)
Description: Die Anwendung oder der Dienst "MyWinLocker" konnte nicht neu gestartet werden.
Error: (03/24/2015 09:20:53 AM) (Source: Microsoft-Windows-RestartManager) (EventID: 10007) (User: Heiko-Notebook)
Description: Die Anwendung oder der Dienst "EgisUpdate Release Application" konnte nicht neu gestartet werden.
Error: (03/24/2015 09:20:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x1420
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
Error: (03/22/2015 10:21:59 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0xe070
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
Error: (03/22/2015 10:21:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0xd908
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
Error: (03/22/2015 10:00:32 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x6c14
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
Error: (03/22/2015 09:59:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x9020
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
Error: (03/22/2015 08:07:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0x1dcc
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
Error: (03/22/2015 08:07:17 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MobileMeServices.exe, Version: 1.6.65.0, Zeitstempel: 0x4cafa71a
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18409, Zeitstempel: 0x53159a86
Ausnahmecode: 0xc06d007e
Fehleroffset: 0x0000c42d
ID des fehlerhaften Prozesses: 0xf48c
Startzeit der fehlerhaften Anwendung: 0xMobileMeServices.exe0
Pfad der fehlerhaften Anwendung: MobileMeServices.exe1
Pfad des fehlerhaften Moduls: MobileMeServices.exe2
Berichtskennung: MobileMeServices.exe3
System errors:
=============
Error: (03/24/2015 00:10:00 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (03/24/2015 00:08:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HSSP Configuration Module" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (03/24/2015 00:07:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "ElbyCDIO Driver" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (03/24/2015 00:07:37 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\ElbyCDIO.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (03/24/2015 00:07:35 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1275
Error: (03/24/2015 00:07:35 PM) (Source: Application Popup) (EventID: 875) (User: )
Description: Treiber atksgt.sys konnte nicht geladen werden.
Error: (03/24/2015 09:23:32 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\RegKill.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.
Error: (03/24/2015 09:21:04 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {D3F6D4DB-A482-4648-8DBB-3565EBCB7A6B}
Error: (03/24/2015 09:18:27 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureCommand" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Error: (03/24/2015 09:18:18 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen:
%%5
Microsoft Office Sessions:
=========================
Error: (04/24/2014 03:37:42 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 140 seconds with 60 seconds of active time. This session ended with a crash.
Error: (04/24/2014 03:29:27 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 7408 seconds with 900 seconds of active time. This session ended with a crash.
Error: (04/24/2014 01:17:53 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 760 seconds with 60 seconds of active time. This session ended with a crash.
Error: (04/23/2014 08:56:29 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 736 seconds with 480 seconds of active time. This session ended with a crash.
Error: (04/23/2014 08:25:26 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1443 seconds with 600 seconds of active time. This session ended with a crash.
Error: (04/23/2014 04:37:04 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 550 seconds with 420 seconds of active time. This session ended with a crash.
Error: (04/23/2014 04:03:40 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1954 seconds with 660 seconds of active time. This session ended with a crash.
Error: (04/23/2014 03:06:43 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 863 seconds with 120 seconds of active time. This session ended with a crash.
Error: (04/23/2014 02:43:54 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 327 seconds with 240 seconds of active time. This session ended with a crash.
Error: (04/23/2014 02:36:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6691.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2266 seconds with 660 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-02-03 23:16:26.588
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-02-03 23:16:26.244
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-30 03:16:20.035
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-30 03:16:20.008
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-30 03:16:19.444
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-30 03:16:19.426
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-29 00:42:37.523
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-29 00:42:37.508
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\lirsgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-29 00:42:36.915
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2010-12-29 00:42:36.899
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\atksgt.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
==================== Memory info ===========================
Processor: Intel(R) Core(TM)2 Duo CPU T6600 @ 2.20GHz
Percentage of memory in use: 41%
Total physical RAM: 4090.93 MB
Available physical RAM: 2402.6 MB
Total Pagefile: 8180.04 MB
Available Pagefile: 6107.86 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (ACER) (Fixed) (Total:285.3 GB) (Free:40.28 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298.1 GB) (Disk ID: 70077007)
Partition 1: (Not Active) - (Size=12.7 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=285.3 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Vielen Dank Kermit |
|
24.03.2015, 10:34
| #2 |
| | Bei Installation Adobe Flash Player Virus eingefangen... zweiter Teil...
__________________Gmer Teil 1 Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-24 21:56:26
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Heiko\AppData\Local\Temp\pxldiaog.sys
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\services.exe[660] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\lsass.exe[696] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[912] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000100070460
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000100070450
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000100070370
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000100070470
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000001000703e0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000100070320
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000001000703b0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000100070390
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000001000702e0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000001000702d0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000100070310
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000001000703c0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000001000703f0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000100070230
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000100070480
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000001000703a0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000001000702f0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000100070350
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000100070290
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000001000702b0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000001000703d0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000100070330
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000100070410
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000100070240
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000001000701e0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000100070250
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000100070490
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000001000704a0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000100070300
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000100070360
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000001000702a0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000001000702c0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000100070380
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000100070340
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000100070440
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000100070260
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000100070270
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000100070400
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000001000701f0
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000100070210
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000100070200
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000100070420
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000100070430
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000100070220
.text c:\Program Files\Microsoft Security Client\MsMpEng.exe[1008] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000100070280
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\System32\svchost.exe[600] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\System32\svchost.exe[780] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[996] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[1044] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\atieclxx.exe[1260] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
(end)
|
|
24.03.2015, 10:36
| #3 |
| | Bei Installation Adobe Flash Player Virus eingefangen... ... 3. Teil
__________________Gmer Teil 2 Code:
ATTFilter .text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\svchost.exe[1420] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[1688] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000100070280
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074b31401 2 bytes JMP 762cb21b C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074b31419 2 bytes JMP 762cb346 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074b31431 2 bytes JMP 76348ea9 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074b3144a 2 bytes CALL 762a48ad C:\Windows\syswow64\kernel32.dll
.text ... * 9
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074b314dd 2 bytes JMP 763487a2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074b314f5 2 bytes JMP 76348978 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074b3150d 2 bytes JMP 76348698 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074b31525 2 bytes JMP 76348a62 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074b3153d 2 bytes JMP 762bfca8 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074b31555 2 bytes JMP 762c68ef C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074b3156d 2 bytes JMP 76348f61 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074b31585 2 bytes JMP 76348ac2 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074b3159d 2 bytes JMP 7634865c C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074b315b5 2 bytes JMP 762bfd41 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074b315cd 2 bytes JMP 762cb2dc C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074b316b2 2 bytes JMP 76348e24 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074b316bd 2 bytes JMP 763485f1 C:\Windows\syswow64\kernel32.dll
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Program Files\Common Files\Motive\pcCMService.exe[2504] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000100070460
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000100070450
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000100070370
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000100070470
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000001000703e0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000100070320
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000001000703b0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000100070390
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000001000702e0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000001000702d0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000100070310
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000001000703c0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000001000703f0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000100070230
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000100070480
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000001000703a0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000001000702f0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000100070350
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000100070290
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000001000702b0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000001000703d0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000100070330
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000100070410
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000100070240
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000001000701e0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000100070250
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000100070490
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000001000704a0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000100070300
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000100070360
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000001000702a0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000001000702c0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000100070380
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000100070340
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000100070440
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000100070260
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000100070270
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000100070400
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000001000701f0
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000100070210
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000100070200
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000100070420
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000100070430
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000100070220
.text C:\Windows\system32\svchost.exe[3716] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000100070280
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\SearchIndexer.exe[1036] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000100060460
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000100060450
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000100060370
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000100060470
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000001000603e0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000100060320
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000001000603b0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000100060390
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000001000602e0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000001000602d0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000100060310
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000001000603c0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000001000603f0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000100060230
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000100060480
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000001000603a0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000001000602f0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000100060350
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000100060290
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000001000602b0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000001000603d0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000100060330
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000100060410
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000100060240
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000001000601e0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000100060250
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000100060490
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000001000604a0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000100060300
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000100060360
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000001000602a0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000001000602c0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000100060380
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000100060340
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000100060440
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000100060260
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000100060270
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000100060400
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000001000601f0
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000100060210
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000100060200
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000100060420
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000100060430
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000100060220
.text C:\Windows\system32\taskhost.exe[2044] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000100060280
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\system32\Dwm.exe[1660] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[4084] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe[4336] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Program Files\Microsoft Security Client\msseces.exe[4520] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Windows\System32\svchost.exe[248] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePort 0000000076ef1360 5 bytes JMP 0000000077050460
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtQueryObject 0000000076ef13b0 5 bytes JMP 0000000077050450
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess 0000000076ef1510 5 bytes JMP 0000000077050370
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtReplyWaitReceivePortEx 0000000076ef1560 5 bytes JMP 0000000077050470
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 0000000076ef1570 5 bytes JMP 00000000770503e0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSection 0000000076ef1620 5 bytes JMP 0000000077050320
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076ef1650 5 bytes JMP 00000000770503b0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtDuplicateObject 0000000076ef1670 5 bytes JMP 0000000077050390
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEvent 0000000076ef16b0 5 bytes JMP 00000000770502e0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 0000000076ef1730 5 bytes JMP 00000000770502d0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSection 0000000076ef1750 5 bytes JMP 0000000077050310
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThread 0000000076ef1790 5 bytes JMP 00000000770503c0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateThread 0000000076ef17e0 5 bytes JMP 00000000770503f0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtAddBootEntry 0000000076ef1940 5 bytes JMP 0000000077050230
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtAlpcSendWaitReceivePort 0000000076ef1b00 5 bytes JMP 0000000077050480
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtAssignProcessToJobObject 0000000076ef1b30 5 bytes JMP 00000000770503a0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEventPair 0000000076ef1c10 5 bytes JMP 00000000770502f0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateIoCompletion 0000000076ef1c20 5 bytes JMP 0000000077050350
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 0000000076ef1c80 5 bytes JMP 0000000077050290
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 0000000076ef1d10 5 bytes JMP 00000000770502b0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076ef1d30 5 bytes JMP 00000000770503d0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtCreateTimer 0000000076ef1d40 5 bytes JMP 0000000077050330
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtDebugActiveProcess 0000000076ef1db0 5 bytes JMP 0000000077050410
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtDeleteBootEntry 0000000076ef1de0 5 bytes JMP 0000000077050240
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtLoadDriver 0000000076ef20a0 5 bytes JMP 00000000770501e0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtModifyBootEntry 0000000076ef2160 5 bytes JMP 0000000077050250
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeKey 0000000076ef2190 5 bytes JMP 0000000077050490
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtNotifyChangeMultipleKeys 0000000076ef21a0 5 bytes JMP 00000000770504a0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenEventPair 0000000076ef21d0 5 bytes JMP 0000000077050300
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenIoCompletion 0000000076ef21e0 5 bytes JMP 0000000077050360
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenMutant 0000000076ef2240 5 bytes JMP 00000000770502a0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenSemaphore 0000000076ef2290 5 bytes JMP 00000000770502c0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread 0000000076ef22c0 5 bytes JMP 0000000077050380
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtOpenTimer 0000000076ef22d0 5 bytes JMP 0000000077050340
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThreadEx 0000000076ef25c0 5 bytes JMP 0000000077050440
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootEntryOrder 0000000076ef27c0 5 bytes JMP 0000000077050260
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSetBootOptions 0000000076ef27d0 5 bytes JMP 0000000077050270
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076ef27e0 5 bytes JMP 0000000077050400
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemInformation 0000000076ef29a0 5 bytes JMP 00000000770501f0
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSetSystemPowerState 0000000076ef29b0 5 bytes JMP 0000000077050210
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtShutdownSystem 0000000076ef2a20 5 bytes JMP 0000000077050200
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendProcess 0000000076ef2a80 5 bytes JMP 0000000077050420
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSuspendThread 0000000076ef2a90 5 bytes JMP 0000000077050430
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtSystemDebugControl 0000000076ef2aa0 5 bytes JMP 0000000077050220
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3876] C:\Windows\SYSTEM32\ntdll.dll!NtVdmControl 0000000076ef2b80 5 bytes JMP 0000000077050280
.text C:\Program Files\Alwil Software\Avast5\AvastUI.exe[5184] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000762a8791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c4d987570df4
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c4d987570df4 (not active ControlSet)
---- EOF - GMER 2.1 ----
Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 23.03.2015 Suchlauf-Zeit: 20:57:44 Logdatei: Anti malwarebyte1.txt Administrator: Ja Version: 2.00.4.1028 Malware Datenbank: v2015.03.23.02 Rootkit Datenbank: v2015.02.25.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Heiko Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 512065 Verstrichene Zeit: 35 Min, 25 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente erkannt) Module: 0 (Keine schädliche Elemente erkannt) Registrierungsschlüssel: 3 PUP.Optional.AirGlobe.A, HKU\S-1-5-21-3175191187-1249783048-3626377888-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{4E8BF48A-E271-46A9-AED9-F6CCE14E7D2E}, Keine Aktion durch Benutzer, [9955ba8e7515db5b00bd9b85e2211ae6], PUP.Optional.AirGlobe.A, HKU\S-1-5-21-3175191187-1249783048-3626377888-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{4E8BF48A-E271-46A9-AED9-F6CCE14E7D2E}, Keine Aktion durch Benutzer, [9955ba8e7515db5b00bd9b85e2211ae6], PUP.Optional.StormWatchApp.A, HKU\S-1-5-21-3175191187-1249783048-3626377888-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\StormWatchApp, Keine Aktion durch Benutzer, [b03ebd8bd9b1f343186d3a9118eb619f], Registrierungswerte: 0 (Keine schädliche Elemente erkannt) Registrierungsdaten: 0 (Keine schädliche Elemente erkannt) Ordner: 2 PUP.Optional.SoftwareUpdater.A, C:\Program Files (x86)\SoftwareUpdater, Keine Aktion durch Benutzer, [935b65e31476fc3ace0f63622fd409f7], PUP.Optional.AirGlobe.A, C:\Users\Heiko\AppData\Local\Temp\Air Globe, Keine Aktion durch Benutzer, [2dc18bbd98f246f0c503446a0ff49868], Dateien: 8 PUP.Optional.Omniboxes.A, C:\Users\Heiko\AppData\Local\Temp\81427095085\0AB14RN2.exe, Keine Aktion durch Benutzer, [af3f20285f2b132349b085a79472ee12], PUP.Optional.OutBrowse, C:\Users\Heiko\AppData\Local\Temp\nsj6FA4.tmp\eor.dll, Keine Aktion durch Benutzer, [ae403a0e573343f3379d1ffb877b35cb], PUP.Optional.OutBrowse, C:\Users\Heiko\Downloads\installer_adobe_flash_player_English.exe, Keine Aktion durch Benutzer, [e50955f3addd38fee7edc85241c153ad], PUP.Optional.SoftwareUpdater.A, C:\Program Files (x86)\SoftwareUpdater\translations.xml, Keine Aktion durch Benutzer, [935b65e31476fc3ace0f63622fd409f7], PUP.Optional.SoftwareUpdater.A, C:\Program Files (x86)\SoftwareUpdater\AppsUpd4ter.exe.config, Keine Aktion durch Benutzer, [935b65e31476fc3ace0f63622fd409f7], PUP.Optional.SoftwareUpdater.A, C:\Program Files (x86)\SoftwareUpdater\config.xml, Keine Aktion durch Benutzer, [935b65e31476fc3ace0f63622fd409f7], PUP.Optional.SoftwareUpdater.A, C:\Program Files (x86)\SoftwareUpdater\Interop.Shell32.dll, Keine Aktion durch Benutzer, [935b65e31476fc3ace0f63622fd409f7], Trojan.Agent.KLFGen, C:\Users\Heiko\AppData\Local\Temp\bcgcabfdfcbg.exe, In Quarantäne, [846a1731a6e41620a835497050b33bc5], Physische Sektoren: 0 (Keine schädliche Elemente erkannt) Kermit |
|
25.03.2015, 19:18
| #4 |
| /// the machine /// TB-Ausbilder    | Bei Installation Adobe Flash Player Virus eingefangen... hi, Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
26.03.2015, 02:47
| #5 |
| | Bei Installation Adobe Flash Player Virus eingefangen... Hallo Schrauber, vielen Dank fuer deine Antwort... Ich habe beide scans laufen lassen es wurde aber nichts gefunden. Die Acer Warnmeldung popt trotzdem immer wieder auf auch wenn ich am Computer gar nichts mache... Malwarebyte Anti Root kit Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org
Database version:
main: v2015.03.25.07
rootkit: v2015.02.25.01
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17691
Heiko :: HEIKO-NOTEBOOK [administrator]
26.03.2015 12:46:53
mbar-log-2015-03-26 (12-46-53).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 525565
Time elapsed: 47 minute(s), 48 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter 14:05:55.0906 0x1420 TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
14:06:03.0027 0x1420 ============================================================
14:06:03.0027 0x1420 Current date / time: 2015/03/26 14:06:03.0027
14:06:03.0027 0x1420 SystemInfo:
14:06:03.0027 0x1420
14:06:03.0027 0x1420 OS Version: 6.1.7601 ServicePack: 1.0
14:06:03.0027 0x1420 Product type: Workstation
14:06:03.0027 0x1420 ComputerName: HEIKO-NOTEBOOK
14:06:03.0027 0x1420 UserName: Heiko
14:06:03.0027 0x1420 Windows directory: C:\Windows
14:06:03.0027 0x1420 System windows directory: C:\Windows
14:06:03.0027 0x1420 Running under WOW64
14:06:03.0027 0x1420 Processor architecture: Intel x64
14:06:03.0027 0x1420 Number of processors: 2
14:06:03.0027 0x1420 Page size: 0x1000
14:06:03.0027 0x1420 Boot type: Normal boot
14:06:03.0027 0x1420 ============================================================
14:06:03.0678 0x1420 KLMD registered as C:\Windows\system32\drivers\74628340.sys
14:06:04.0453 0x1420 System UUID: {33CAC0F4-97C9-E9AD-DA9A-7A8A86B5DC90}
14:06:05.0739 0x1420 Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 ( 298.09 Gb ), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
14:06:05.0744 0x1420 ============================================================
14:06:05.0744 0x1420 \Device\Harddisk0\DR0:
14:06:05.0744 0x1420 MBR partitions:
14:06:05.0744 0x1420 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1964800, BlocksNum 0x32000
14:06:05.0744 0x1420 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1996800, BlocksNum 0x23A97AB0
14:06:05.0744 0x1420 ============================================================
14:06:05.0786 0x1420 C: <-> \Device\Harddisk0\DR0\Partition2
14:06:05.0786 0x1420 ============================================================
14:06:05.0786 0x1420 Initialize success
14:06:05.0786 0x1420 ============================================================
14:07:44.0589 0x11a0 ============================================================
14:07:44.0589 0x11a0 Scan started
14:07:44.0589 0x11a0 Mode: Manual; SigCheck; TDLFS;
14:07:44.0589 0x11a0 ============================================================
14:07:44.0589 0x11a0 KSN ping started
14:07:47.0631 0x11a0 KSN ping finished: true
14:07:48.0692 0x11a0 ================ Scan system memory ========================
14:07:48.0692 0x11a0 System memory - ok
14:07:48.0692 0x11a0 ================ Scan services =============================
14:07:48.0926 0x11a0 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
14:07:49.0113 0x11a0 1394ohci - ok
14:07:49.0207 0x11a0 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
14:07:49.0269 0x11a0 ACPI - ok
14:07:49.0347 0x11a0 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
14:07:49.0457 0x11a0 AcpiPmi - ok
14:07:49.0659 0x11a0 [ 4C72FDD915D62EAEF149BD9C73AB9CF4, 8EA45A1B88DFD819F0ADA3AF36D464E1BF52574269592370E0CC8D0490680E1F ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
14:07:49.0691 0x11a0 AdobeARMservice - ok
14:07:49.0784 0x11a0 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
14:07:49.0815 0x11a0 adp94xx - ok
14:07:49.0847 0x11a0 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
14:07:49.0878 0x11a0 adpahci - ok
14:07:49.0909 0x11a0 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
14:07:49.0925 0x11a0 adpu320 - ok
14:07:49.0971 0x11a0 [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
14:07:50.0159 0x11a0 AeLookupSvc - ok
14:07:50.0268 0x11a0 [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD C:\Windows\system32\drivers\afd.sys
14:07:50.0408 0x11a0 AFD - ok
14:07:50.0502 0x11a0 [ B65F8DBA54F251906BBE8611B5A0E7AB, 9ADE347CB4E7C33D668DAC79A316C97C78D94D296B158F481F3E32F9DA4D647E ] AgereModemAudio C:\Program Files\LSI SoftModem\agr64svc.exe
14:07:50.0580 0x11a0 AgereModemAudio - ok
14:07:50.0689 0x11a0 [ AF4748EF93416159459769A24A0053AF, AE1C4E67E7555066436112C5A090DC5B49B264E3BA3ECF4CE2F1E9B799089B7D ] AgereSoftModem C:\Windows\system32\DRIVERS\agrsm64.sys
14:07:50.0783 0x11a0 AgereSoftModem - ok
14:07:50.0861 0x11a0 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
14:07:50.0892 0x11a0 agp440 - ok
14:07:50.0939 0x11a0 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
14:07:51.0032 0x11a0 ALG - ok
14:07:51.0095 0x11a0 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
14:07:51.0126 0x11a0 aliide - ok
14:07:51.0204 0x11a0 [ D0D8877969011D1B0ED9C3C55A9A9108, DFF41D12EA353DFACDF5C1C227D2D44D659EB8C484829651C90F8684CE2B9E49 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
14:07:51.0329 0x11a0 AMD External Events Utility - ok
14:07:51.0360 0x11a0 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
14:07:51.0375 0x11a0 amdide - ok
14:07:51.0422 0x11a0 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
14:07:51.0531 0x11a0 AmdK8 - ok
14:07:51.0828 0x11a0 [ C5758BF1DFD762A5B17041FF061B7750, BA732E670536C73523DA0880485E5028C682FBEAF048F564EB626DA61364CAAD ] amdkmdag C:\Windows\system32\DRIVERS\atikmdag.sys
14:07:52.0249 0x11a0 amdkmdag - ok
14:07:52.0311 0x11a0 [ 0E57258E5CC4CC7A9A9A877AFDF0CEC6, 2C3DCB347CD6DAF6F2C8A2531D5165F776855F05D1675A36B9D78BC2C8E0B324 ] amdkmdap C:\Windows\system32\DRIVERS\atikmpag.sys
14:07:52.0405 0x11a0 amdkmdap - ok
14:07:52.0452 0x11a0 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
14:07:52.0530 0x11a0 AmdPPM - ok
14:07:52.0608 0x11a0 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
14:07:52.0639 0x11a0 amdsata - ok
14:07:52.0686 0x11a0 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
14:07:52.0717 0x11a0 amdsbs - ok
14:07:52.0733 0x11a0 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
14:07:52.0764 0x11a0 amdxata - ok
14:07:52.0826 0x11a0 [ 4FC6E2C2FC50445450651F42E90CC0BD, BC04902B1A5A5C3354E1C4A5C69906ED7DF19F90286BE1AC4E4224E05ED36184 ] Apowersoft_AudioDevice C:\Windows\system32\drivers\Apowersoft_AudioDevice.sys
14:07:52.0873 0x11a0 Apowersoft_AudioDevice - ok
14:07:52.0920 0x11a0 [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID C:\Windows\system32\drivers\appid.sys
14:07:53.0013 0x11a0 AppID - ok
14:07:53.0060 0x11a0 [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc C:\Windows\System32\appidsvc.dll
14:07:53.0138 0x11a0 AppIDSvc - ok
14:07:53.0201 0x11a0 [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
14:07:53.0310 0x11a0 Appinfo - ok
14:07:53.0466 0x11a0 [ 612CB66D93ED0F2F21BB109840C7D813, 75484123DA27B8942B13148FCF061C75A08A50386A095143736B593E9C772173 ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
14:07:53.0497 0x11a0 Apple Mobile Device Service - ok
14:07:53.0544 0x11a0 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\DRIVERS\arc.sys
14:07:53.0559 0x11a0 arc - ok
14:07:53.0606 0x11a0 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
14:07:53.0622 0x11a0 arcsas - ok
14:07:53.0809 0x11a0 [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
14:07:53.0840 0x11a0 aspnet_state - ok
14:07:53.0934 0x11a0 [ BA4B999D245287608A79C92CDAE6F3C1, 799CC0FB185FDF3438687184944E6F6AB6EE73B3B542542D3C13C0FF1A8C0276 ] aswHwid C:\Windows\system32\drivers\aswHwid.sys
14:07:53.0965 0x11a0 aswHwid - ok
14:07:53.0981 0x11a0 [ 245D3A0670491E1F88759EC45C9F7314, 1FFBDDDC6FCD29770B439933EEB8BE1ABA9149193932B2481720E8E9F265A797 ] aswMonFlt C:\Windows\system32\drivers\aswMonFlt.sys
14:07:53.0996 0x11a0 aswMonFlt - ok
14:07:54.0059 0x11a0 [ BC18D5B42B19564BA09156410E1FB9BE, 0DA9636632462208AE4D360BFE5A8187644B036A0D43E981665D888A5363B953 ] aswRdr C:\Windows\system32\drivers\aswRdr2.sys
14:07:54.0074 0x11a0 aswRdr - ok
14:07:54.0137 0x11a0 [ 713AFFD4E38553AEF04617C985B4030B, A09FBE4D49390024E8CF93352EACEB5AC53BEE5A4E5A76F5BE0341F8A002C4DD ] aswRvrt C:\Windows\system32\drivers\aswRvrt.sys
14:07:54.0152 0x11a0 aswRvrt - ok
14:07:54.0261 0x11a0 [ 669F6B37965756E407B447272B5EE39F, FE2C0A8F96415191650485AED637A45B26E7B9A25A4BFB5D809844BD24FD6BA9 ] aswSnx C:\Windows\system32\drivers\aswSnx.sys
14:07:54.0371 0x11a0 aswSnx - ok
14:07:54.0417 0x11a0 [ 3A145C94A519E52FE7E99460DD0DF53C, 91E9544B1B72FCC32463BF34838DAA9F14DCABF3BE9FE9382087ACDB3B4FC598 ] aswSP C:\Windows\system32\drivers\aswSP.sys
14:07:54.0464 0x11a0 aswSP - ok
14:07:54.0542 0x11a0 [ 8CDA894FA86D03FB43063D5FD85EFCAE, 20D110ACC84300514557AB6E565CFA0101DA749559B52877A41A509E79314AF6 ] aswStm C:\Windows\system32\drivers\aswStm.sys
14:07:54.0573 0x11a0 aswStm - ok
14:07:54.0651 0x11a0 [ 11644D8399F4AC8BB12C2364DCB87CB4, 828C3A03AB9D5F0650C7B90B7479CCAAD586B22BB7AC6DB7C91E8D9D80427DFB ] aswVmm C:\Windows\system32\drivers\aswVmm.sys
14:07:54.0698 0x11a0 aswVmm - ok
14:07:54.0729 0x11a0 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
14:07:54.0807 0x11a0 AsyncMac - ok
14:07:54.0885 0x11a0 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
14:07:54.0917 0x11a0 atapi - ok
14:07:55.0057 0x11a0 [ E857EEE6B92AAA473EBB3465ADD8F7E7, 1C7E4737E649A025B3C4974A4F7D1353EAB85561FC8ED54E5C22A777E1A189B3 ] athr C:\Windows\system32\DRIVERS\athrx.sys
14:07:55.0275 0x11a0 athr - ok
14:07:55.0353 0x11a0 [ 24464B908E143D2561E9E452FEE97309, F5A24FEBAD1B1795A075130F7FFDD4EB76C8F1855FA1628A29CAFAF03C1C9183 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
14:07:55.0400 0x11a0 AtiHDAudioService - ok
14:07:55.0665 0x11a0 [ C5758BF1DFD762A5B17041FF061B7750, BA732E670536C73523DA0880485E5028C682FBEAF048F564EB626DA61364CAAD ] atikmdag C:\Windows\system32\DRIVERS\atikmdag.sys
14:07:55.0821 0x11a0 atikmdag - ok
14:07:55.0962 0x11a0 [ F88EF61BCD43ADDF2C9555430C16CD96, 7213FE9B9025DA33B0DEA7338B1E00555FCB88326CE26052C9FF16E72E4715AA ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys
14:07:56.0087 0x11a0 atksgt - ok
14:07:56.0180 0x11a0 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:07:56.0274 0x11a0 AudioEndpointBuilder - ok
14:07:56.0289 0x11a0 [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv C:\Windows\System32\Audiosrv.dll
14:07:56.0321 0x11a0 AudioSrv - ok
14:07:56.0430 0x11a0 [ 35714DC1ADD995681D890D4382C75721, C1D10F2D47D348DCEA363B676E35A363FE8FA0E24295C4AD90F7EA37826A822D ] avast! Antivirus C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
14:07:56.0477 0x11a0 avast! Antivirus - ok
14:07:56.0523 0x11a0 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
14:07:56.0617 0x11a0 AxInstSV - ok
14:07:56.0664 0x11a0 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
14:07:56.0757 0x11a0 b06bdrv - ok
14:07:56.0820 0x11a0 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
14:07:56.0898 0x11a0 b57nd60a - ok
14:07:57.0007 0x11a0 [ 9E84A931DBEE0292E38ED672F6293A99, 2945EAF0AC091709E0C5508B45EC343EDE507AC2B08A2D7D64F286D38424CBC4 ] BCM43XX C:\Windows\system32\DRIVERS\bcmwl664.sys
14:07:57.0132 0x11a0 BCM43XX - ok
14:07:57.0179 0x11a0 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
14:07:57.0257 0x11a0 BDESVC - ok
14:07:57.0272 0x11a0 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
14:07:57.0335 0x11a0 Beep - ok
14:07:57.0459 0x11a0 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
14:07:57.0600 0x11a0 BFE - ok
14:07:57.0709 0x11a0 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\System32\qmgr.dll
14:07:57.0974 0x11a0 BITS - ok
14:07:58.0005 0x11a0 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
14:07:58.0037 0x11a0 blbdrive - ok
14:07:58.0161 0x11a0 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
14:07:58.0193 0x11a0 Bonjour Service - ok
14:07:58.0239 0x11a0 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
14:07:58.0333 0x11a0 bowser - ok
14:07:58.0380 0x11a0 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
14:07:58.0442 0x11a0 BrFiltLo - ok
14:07:58.0473 0x11a0 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
14:07:58.0536 0x11a0 BrFiltUp - ok
14:07:58.0583 0x11a0 [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
14:07:58.0692 0x11a0 BridgeMP - ok
14:07:58.0739 0x11a0 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
14:07:58.0817 0x11a0 Browser - ok
14:07:58.0832 0x11a0 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
14:07:58.0910 0x11a0 Brserid - ok
14:07:58.0941 0x11a0 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
14:07:58.0988 0x11a0 BrSerWdm - ok
14:07:59.0035 0x11a0 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
14:07:59.0097 0x11a0 BrUsbMdm - ok
14:07:59.0113 0x11a0 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
14:07:59.0160 0x11a0 BrUsbSer - ok
14:07:59.0238 0x11a0 [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum C:\Windows\system32\DRIVERS\BthEnum.sys
14:07:59.0316 0x11a0 BthEnum - ok
14:07:59.0347 0x11a0 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
14:07:59.0378 0x11a0 BTHMODEM - ok
14:07:59.0441 0x11a0 [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
14:07:59.0519 0x11a0 BthPan - ok
14:07:59.0612 0x11a0 [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT C:\Windows\system32\Drivers\BTHport.sys
14:07:59.0737 0x11a0 BTHPORT - ok
14:07:59.0768 0x11a0 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
14:07:59.0831 0x11a0 bthserv - ok
14:07:59.0909 0x11a0 [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB C:\Windows\system32\Drivers\BTHUSB.sys
14:07:59.0987 0x11a0 BTHUSB - ok
14:08:00.0018 0x11a0 catchme - ok
14:08:00.0049 0x11a0 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
14:08:00.0111 0x11a0 cdfs - ok
14:08:00.0189 0x11a0 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
14:08:00.0267 0x11a0 cdrom - ok
14:08:00.0345 0x11a0 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
14:08:00.0439 0x11a0 CertPropSvc - ok
14:08:00.0455 0x11a0 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\DRIVERS\circlass.sys
14:08:00.0501 0x11a0 circlass - ok
14:08:00.0579 0x11a0 [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS C:\Windows\system32\CLFS.sys
14:08:00.0642 0x11a0 CLFS - ok
14:08:00.0720 0x11a0 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:08:00.0735 0x11a0 clr_optimization_v2.0.50727_32 - ok
14:08:00.0813 0x11a0 [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
14:08:00.0845 0x11a0 clr_optimization_v2.0.50727_64 - ok
14:08:00.0985 0x11a0 [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:08:01.0032 0x11a0 clr_optimization_v4.0.30319_32 - ok
14:08:01.0094 0x11a0 [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
14:08:01.0125 0x11a0 clr_optimization_v4.0.30319_64 - ok
14:08:01.0141 0x11a0 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
14:08:01.0188 0x11a0 CmBatt - ok
14:08:01.0235 0x11a0 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
14:08:01.0266 0x11a0 cmdide - ok
14:08:01.0344 0x11a0 [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG C:\Windows\system32\Drivers\cng.sys
14:08:01.0422 0x11a0 CNG - ok
14:08:01.0469 0x11a0 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
14:08:01.0500 0x11a0 Compbatt - ok
14:08:01.0562 0x11a0 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
14:08:01.0640 0x11a0 CompositeBus - ok
14:08:01.0671 0x11a0 COMSysApp - ok
14:08:01.0687 0x11a0 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
14:08:01.0718 0x11a0 crcdisk - ok
14:08:01.0781 0x11a0 [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc C:\Windows\system32\cryptsvc.dll
14:08:01.0859 0x11a0 CryptSvc - ok
14:08:01.0937 0x11a0 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
14:08:02.0093 0x11a0 DcomLaunch - ok
14:08:02.0139 0x11a0 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
14:08:02.0217 0x11a0 defragsvc - ok
14:08:02.0295 0x11a0 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
14:08:02.0358 0x11a0 DfsC - ok
14:08:02.0420 0x11a0 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
14:08:02.0529 0x11a0 Dhcp - ok
14:08:02.0576 0x11a0 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
14:08:02.0639 0x11a0 discache - ok
14:08:02.0670 0x11a0 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\DRIVERS\disk.sys
14:08:02.0685 0x11a0 Disk - ok
14:08:02.0810 0x11a0 [ D5BCB77BE83CF99F508943945D46343D, 00C5624CE970A05075A19168643BF6E8FA60C764333ECEC088D7FFCA10547833 ] DKbFltr C:\Windows\syswow64\Drivers\DKbFltr.sys
14:08:02.0826 0x11a0 DKbFltr - ok
14:08:02.0919 0x11a0 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
14:08:03.0013 0x11a0 Dnscache - ok
14:08:03.0075 0x11a0 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
14:08:03.0200 0x11a0 dot3svc - ok
14:08:03.0263 0x11a0 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
14:08:03.0387 0x11a0 DPS - ok
14:08:03.0481 0x11a0 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
14:08:03.0512 0x11a0 drmkaud - ok
14:08:03.0621 0x11a0 [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
14:08:03.0715 0x11a0 DXGKrnl - ok
14:08:03.0746 0x11a0 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
14:08:03.0793 0x11a0 EapHost - ok
14:08:03.0949 0x11a0 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
14:08:04.0152 0x11a0 ebdrv - ok
14:08:04.0230 0x11a0 [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] EFS C:\Windows\System32\lsass.exe
14:08:04.0245 0x11a0 EFS - ok
14:08:04.0386 0x11a0 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
14:08:04.0526 0x11a0 ehRecvr - ok
14:08:04.0573 0x11a0 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
14:08:04.0667 0x11a0 ehSched - ok
14:08:04.0698 0x11a0 ElbyCDIO - ok
14:08:04.0745 0x11a0 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
14:08:04.0838 0x11a0 elxstor - ok
14:08:04.0994 0x11a0 [ FB67AA8AC61B9365ADD546139A21BED6, DDE2053071ED1F7E634FF1A74DB0ACC7D0D19B0AD0CF37DE989FA91B93C76452 ] ePowerSvc C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
14:08:05.0025 0x11a0 ePowerSvc - ok
14:08:05.0088 0x11a0 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
14:08:05.0135 0x11a0 ErrDev - ok
14:08:05.0244 0x11a0 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
14:08:05.0353 0x11a0 EventSystem - ok
14:08:05.0462 0x11a0 [ 251AF86E0A4DDF3A6B181ED5103B06B1, 1823E7C87F0D8972A89D71B1FB633C5D43744F9803E6A8B866F6EA610032437C ] ewusbnet C:\Windows\system32\DRIVERS\ewusbnet.sys
14:08:05.0571 0x11a0 ewusbnet - ok
14:08:05.0634 0x11a0 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
14:08:05.0727 0x11a0 exfat - ok
14:08:05.0759 0x11a0 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
14:08:05.0837 0x11a0 fastfat - ok
14:08:05.0946 0x11a0 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
14:08:06.0102 0x11a0 Fax - ok
14:08:06.0149 0x11a0 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\DRIVERS\fdc.sys
14:08:06.0211 0x11a0 fdc - ok
14:08:06.0273 0x11a0 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
14:08:06.0336 0x11a0 fdPHost - ok
14:08:06.0367 0x11a0 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
14:08:06.0414 0x11a0 FDResPub - ok
14:08:06.0429 0x11a0 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
14:08:06.0461 0x11a0 FileInfo - ok
14:08:06.0476 0x11a0 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
14:08:06.0539 0x11a0 Filetrace - ok
14:08:06.0570 0x11a0 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
14:08:06.0617 0x11a0 flpydisk - ok
14:08:06.0695 0x11a0 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
14:08:06.0741 0x11a0 FltMgr - ok
14:08:06.0866 0x11a0 [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache C:\Windows\system32\FntCache.dll
14:08:07.0022 0x11a0 FontCache - ok
14:08:07.0100 0x11a0 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
14:08:07.0116 0x11a0 FontCache3.0.0.0 - ok
14:08:07.0163 0x11a0 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
14:08:07.0178 0x11a0 FsDepends - ok
14:08:07.0225 0x11a0 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
14:08:07.0256 0x11a0 Fs_Rec - ok
14:08:07.0334 0x11a0 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
14:08:07.0381 0x11a0 fvevol - ok
14:08:07.0397 0x11a0 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
14:08:07.0428 0x11a0 gagp30kx - ok
14:08:07.0506 0x11a0 [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
14:08:07.0521 0x11a0 GEARAspiWDM - ok
14:08:07.0631 0x11a0 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
14:08:07.0771 0x11a0 gpsvc - ok
14:08:07.0911 0x11a0 [ 816FD5A6F3C2F3D600900096632FC60E, D92401C4B56663F8A12B6390562608A125713408B00266C53844129679E48E9C ] Greg_Service C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
14:08:07.0958 0x11a0 Greg_Service - ok
14:08:08.0083 0x11a0 [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:08:08.0114 0x11a0 gupdate - ok
14:08:08.0130 0x11a0 [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
14:08:08.0145 0x11a0 gupdatem - ok
14:08:08.0208 0x11a0 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
14:08:08.0301 0x11a0 hcw85cir - ok
14:08:08.0379 0x11a0 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:08:08.0457 0x11a0 HdAudAddService - ok
14:08:08.0551 0x11a0 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
14:08:08.0598 0x11a0 HDAudBus - ok
14:08:08.0629 0x11a0 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
14:08:08.0676 0x11a0 HidBatt - ok
14:08:08.0723 0x11a0 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
14:08:08.0754 0x11a0 HidBth - ok
14:08:08.0785 0x11a0 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
14:08:08.0832 0x11a0 HidIr - ok
14:08:08.0863 0x11a0 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\System32\hidserv.dll
14:08:08.0910 0x11a0 hidserv - ok
14:08:08.0957 0x11a0 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
14:08:09.0019 0x11a0 HidUsb - ok
14:08:09.0050 0x11a0 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
14:08:09.0175 0x11a0 hkmsvc - ok
14:08:09.0222 0x11a0 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:08:09.0347 0x11a0 HomeGroupListener - ok
14:08:09.0409 0x11a0 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:08:09.0471 0x11a0 HomeGroupProvider - ok
14:08:09.0503 0x11a0 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
14:08:09.0549 0x11a0 HpSAMD - ok
14:08:09.0737 0x11a0 [ B6639BF8236BDD3427B10C581332BE71, A6A9DB37BB83C70F01E7D99CA4891FD32F93A96C84215CFCC85AF41625C1023C ] HPSupportSolutionsFrameworkService C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe
14:08:09.0768 0x11a0 HPSupportSolutionsFrameworkService - ok
14:08:09.0799 0x11a0 HsspConfig - ok
14:08:09.0893 0x11a0 [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP C:\Windows\system32\drivers\HTTP.sys
14:08:10.0033 0x11a0 HTTP - ok
14:08:10.0111 0x11a0 [ 4B5C07DB91A0099272FAAE732E1152BD, E0408F85A2E1E310F5143A01A34456F120875D21E0E9D0A9F9EBC96514CFC47C ] hwdatacard C:\Windows\system32\DRIVERS\ewusbmdm.sys
14:08:10.0142 0x11a0 hwdatacard - ok
14:08:10.0205 0x11a0 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
14:08:10.0236 0x11a0 hwpolicy - ok
14:08:10.0298 0x11a0 [ 9C13A2691AC410CC7469F298684DCA5D, 2B07FE759B479A36AB4DE185AF8B4295396A1F8674587721BE7C92FC31ADFF0D ] hwusbfake C:\Windows\system32\DRIVERS\ewusbfake.sys
14:08:10.0345 0x11a0 hwusbfake - ok
14:08:10.0407 0x11a0 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
14:08:10.0423 0x11a0 i8042prt - ok
14:08:10.0501 0x11a0 [ 7548066DF68A8A1A56B043359F915F37, 6225DDE554E45858374CBD284A85A00F773089A667C08492187A637232B8BD9A ] IAANTMON C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
14:08:10.0532 0x11a0 IAANTMON - ok
14:08:10.0579 0x11a0 [ 1D004CB1DA6323B1F55CAEF7F94B61D9, 8FFFB429BA46938724BBB87AB9B3EC77EA17C4B893BABDBDD38309F02963D405 ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
14:08:10.0595 0x11a0 iaStor - ok
14:08:10.0673 0x11a0 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
14:08:10.0719 0x11a0 iaStorV - ok
14:08:10.0860 0x11a0 [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
14:08:10.0907 0x11a0 IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
14:08:14.0058 0x11a0 Detect skipped due to KSN trusted
14:08:14.0058 0x11a0 IDriverT - ok
14:08:14.0198 0x11a0 [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
14:08:14.0245 0x11a0 idsvc - ok
14:08:14.0307 0x11a0 IEEtwCollectorService - ok
14:08:14.0588 0x11a0 [ A87261EF1546325B559374F5689CF5BC, 8DE48A8A13A32AAAC54CDDF58F3F61BE3E2802C1D9CA1CA98E57EB0D65FB6002 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
14:08:14.0994 0x11a0 igfx - ok
14:08:15.0041 0x11a0 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
14:08:15.0056 0x11a0 iirsp - ok
14:08:15.0165 0x11a0 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
14:08:15.0275 0x11a0 IKEEXT - ok
14:08:15.0415 0x11a0 [ 9AA6A93852E36FE76C3F7FC2904F3B01, F4E8E7FB956B59B450F1D830597EA0FBE8F99526EB0EAA886FA21761514C9B05 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
14:08:15.0587 0x11a0 IntcAzAudAddService - ok
14:08:15.0633 0x11a0 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
14:08:15.0649 0x11a0 intelide - ok
14:08:15.0696 0x11a0 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
14:08:15.0774 0x11a0 intelppm - ok
14:08:15.0836 0x11a0 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
14:08:15.0930 0x11a0 IPBusEnum - ok
14:08:15.0992 0x11a0 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:08:16.0086 0x11a0 IpFilterDriver - ok
14:08:16.0164 0x11a0 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
14:08:16.0242 0x11a0 iphlpsvc - ok
14:08:16.0289 0x11a0 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
14:08:16.0320 0x11a0 IPMIDRV - ok
14:08:16.0382 0x11a0 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
14:08:16.0491 0x11a0 IPNAT - ok
14:08:16.0554 0x11a0 [ A4857E8B1DEB9740FB5ADEDF05ED69E0, 24FC7A188D32B08CE4F10EEEF17F37C45DB5433158A7A97A07D43F6BEE58DFFC ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
14:08:16.0585 0x11a0 iPod Service - ok
14:08:16.0616 0x11a0 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
14:08:16.0694 0x11a0 IRENUM - ok
14:08:16.0741 0x11a0 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
14:08:16.0757 0x11a0 isapnp - ok
14:08:16.0819 0x11a0 [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
14:08:16.0866 0x11a0 iScsiPrt - ok
14:08:16.0913 0x11a0 [ 249EE2D26CB1530F3BEDE0AC8B9E3099, 6EBF72DCCDC1EFCD9FE712B895D61359F46C2AF41F1EC47A3C486E79AA1BC026 ] k57nd60a C:\Windows\system32\DRIVERS\k57nd60a.sys
14:08:16.0944 0x11a0 k57nd60a - ok
14:08:16.0975 0x11a0 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
14:08:16.0991 0x11a0 kbdclass - ok
14:08:17.0037 0x11a0 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
14:08:17.0100 0x11a0 kbdhid - ok
14:08:17.0131 0x11a0 [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] KeyIso C:\Windows\system32\lsass.exe
14:08:17.0147 0x11a0 KeyIso - ok
14:08:17.0209 0x11a0 [ 56ED3EE5FED6BF2FC1305CF872042868, 44F77AE3CD83284800FF106156ABCB63047327855E2535EE278289AF6F05579C ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
14:08:17.0256 0x11a0 KSecDD - ok
14:08:17.0271 0x11a0 [ 8BA90F480705D7153AD0060CCA62222A, B3E610DFAB382368114D026947084A72AFC4F5BF9C28317F411D4ED91E0B3192 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
14:08:17.0287 0x11a0 KSecPkg - ok
14:08:17.0318 0x11a0 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
14:08:17.0396 0x11a0 ksthunk - ok
14:08:17.0427 0x11a0 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
14:08:17.0505 0x11a0 KtmRm - ok
14:08:17.0537 0x11a0 [ 2AC603C3188C704CFCE353659AA7AD71, 0DAC2E8858221145FA35883BAE0D6484E60EB624158DE9F063FF209951CD1CDF ] L1E C:\Windows\system32\DRIVERS\L1E62x64.sys
14:08:17.0552 0x11a0 L1E - ok
14:08:17.0615 0x11a0 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\System32\srvsvc.dll
14:08:17.0739 0x11a0 LanmanServer - ok
14:08:17.0802 0x11a0 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:08:17.0895 0x11a0 LanmanWorkstation - ok
14:08:17.0942 0x11a0 [ 8E4CA9AFD55EF6B509C80A8715ABF8C6, 45698605D17285D346D2052607AEF492EBD89E9625367C31584C7C84757EEFE0 ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys
14:08:18.0020 0x11a0 lirsgt - ok
14:08:18.0067 0x11a0 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
14:08:18.0176 0x11a0 lltdio - ok
14:08:18.0207 0x11a0 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
14:08:18.0332 0x11a0 lltdsvc - ok
14:08:18.0363 0x11a0 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
14:08:18.0426 0x11a0 lmhosts - ok
14:08:18.0504 0x11a0 [ 5DCD36FC4A6ECBF6E7F9B3BF7E0D0F55, 265BDBC10CC256CB35F2BF5A9A25246D1859400087370A2B629783B9D3F7D0D4 ] LPDSVC C:\Windows\system32\lpdsvc.dll
14:08:18.0597 0x11a0 LPDSVC - ok
14:08:18.0644 0x11a0 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
14:08:18.0691 0x11a0 LSI_FC - ok
14:08:18.0707 0x11a0 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
14:08:18.0722 0x11a0 LSI_SAS - ok
14:08:18.0738 0x11a0 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
14:08:18.0753 0x11a0 LSI_SAS2 - ok
14:08:18.0785 0x11a0 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
14:08:18.0800 0x11a0 LSI_SCSI - ok
14:08:18.0847 0x11a0 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
14:08:18.0909 0x11a0 luafv - ok
14:08:18.0956 0x11a0 massfilter - ok
14:08:19.0034 0x11a0 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
14:08:19.0081 0x11a0 Mcx2Svc - ok
14:08:19.0097 0x11a0 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
14:08:19.0128 0x11a0 megasas - ok
14:08:19.0175 0x11a0 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
14:08:19.0206 0x11a0 MegaSR - ok
14:08:19.0299 0x11a0 [ 123271BD5237AB991DC5C21FDF8835EB, 004F8F9228EE291A0E36CE33078D572D61733516F9AA5CFC832AF204C6869E89 ] Microsoft Office Groove Audit Service C:\Program Files (x86)\Microsoft Office\Office12\GrooveAuditService.exe
14:08:19.0331 0x11a0 Microsoft Office Groove Audit Service - ok
14:08:19.0362 0x11a0 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
14:08:19.0440 0x11a0 MMCSS - ok
14:08:19.0549 0x11a0 [ 062A6449D8556B98BD9E1AE48D295E89, 057EACA8FC69A685E157FD361CD0ADB5E0FD7C7FE92B64650D24A0FD6652146B ] mod7700 C:\Windows\system32\DRIVERS\mod7700.sys
14:08:19.0643 0x11a0 mod7700 - ok
14:08:19.0674 0x11a0 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
14:08:19.0736 0x11a0 Modem - ok
14:08:19.0814 0x11a0 [ 1862F31D3B42819F5F50EB2B9C1F37C5, 4D45BAF6177162D1E2A8B9F32AE7C429061119335D83AE34A6184DE7C34FDC9D ] MODRC C:\Windows\system32\DRIVERS\modrc.sys
14:08:19.0845 0x11a0 MODRC - ok
14:08:19.0877 0x11a0 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
14:08:19.0923 0x11a0 monitor - ok
14:08:20.0001 0x11a0 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
14:08:20.0017 0x11a0 mouclass - ok
14:08:20.0064 0x11a0 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
14:08:20.0111 0x11a0 mouhid - ok
14:08:20.0173 0x11a0 [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
14:08:20.0204 0x11a0 mountmgr - ok
14:08:20.0313 0x11a0 [ 0A68B3E37961CEC327EED518F6D62530, EDEB16545ECDDEA2ADFF73E4DF3E9FD87E4B7126C8CFB037ABAF883D157103DE ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
14:08:20.0345 0x11a0 MozillaMaintenance - ok
14:08:20.0454 0x11a0 [ FBA4CDA6B3B00D7A116DCC2B5C7E9790, FE909159323290555971F031E7911DCCD035B873E630A230A660C13D57719206 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
14:08:20.0501 0x11a0 MpFilter - ok
14:08:20.0563 0x11a0 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
14:08:20.0594 0x11a0 mpio - ok
14:08:20.0641 0x11a0 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
14:08:20.0688 0x11a0 mpsdrv - ok
14:08:20.0766 0x11a0 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
14:08:20.0906 0x11a0 MpsSvc - ok
14:08:21.0000 0x11a0 [ 9BD4DCB5412921864A7AACDEDFBD1923, 46DEE9B9414D26203B62F0D6CAEBF37A3CEFD118556129547B2C5FC7B6FDBA05 ] MREMP50 C:\PROGRA~2\COMMON~1\Motive\MREMP50.SYS
14:08:21.0031 0x11a0 MREMP50 - detected UnsignedFile.Multi.Generic ( 1 )
14:08:24.0167 0x11a0 Detect skipped due to KSN trusted
14:08:24.0167 0x11a0 MREMP50 - ok
14:08:24.0291 0x11a0 [ C2758DF79C83A0D12A5599A040CA1818, 236641D2AD596CDC53AE8407F7A7AA02719764CCC7E6D5C547F41FE7C1D67BB5 ] MREMP50a64 C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS
14:08:24.0338 0x11a0 MREMP50a64 - ok
14:08:24.0338 0x11a0 MREMPR5 - ok
14:08:24.0354 0x11a0 MRENDIS5 - ok
14:08:24.0416 0x11a0 [ 07C02C892E8E1A72D6BF35004F0E9C5E, 09ECD59AADF08E2AA0C1BAF5D3D7CBB0948153E531E1F82ECACD43F14F88106B ] MRESP50 C:\PROGRA~2\COMMON~1\Motive\MRESP50.SYS
14:08:24.0447 0x11a0 MRESP50 - detected UnsignedFile.Multi.Generic ( 1 )
14:08:27.0599 0x11a0 Detect skipped due to KSN trusted
14:08:27.0599 0x11a0 MRESP50 - ok
14:08:27.0645 0x11a0 [ 38BD5B32E0722752BE8465D2A6DA43D9, EE009F141D77A858C84B4294F4FF51ECA400D48B3AD735FAC99EEF4E3E00E9EE ] MRESP50a64 C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS
14:08:27.0692 0x11a0 MRESP50a64 - ok
14:08:27.0755 0x11a0 [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
14:08:27.0864 0x11a0 MRxDAV - ok
14:08:27.0926 0x11a0 [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
14:08:28.0020 0x11a0 mrxsmb - ok
14:08:28.0082 0x11a0 [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:08:28.0160 0x11a0 mrxsmb10 - ok
14:08:28.0191 0x11a0 [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:08:28.0238 0x11a0 mrxsmb20 - ok
14:08:28.0301 0x11a0 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
14:08:28.0316 0x11a0 msahci - ok
14:08:28.0379 0x11a0 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
14:08:28.0394 0x11a0 msdsm - ok
14:08:28.0425 0x11a0 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
14:08:28.0488 0x11a0 MSDTC - ok
14:08:28.0550 0x11a0 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
14:08:28.0628 0x11a0 Msfs - ok
14:08:28.0659 0x11a0 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
14:08:28.0722 0x11a0 mshidkmdf - ok
14:08:28.0784 0x11a0 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
14:08:28.0815 0x11a0 msisadrv - ok
14:08:28.0862 0x11a0 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
14:08:28.0971 0x11a0 MSiSCSI - ok
14:08:28.0971 0x11a0 msiserver - ok
14:08:29.0003 0x11a0 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
14:08:29.0096 0x11a0 MSKSSRV - ok
14:08:29.0190 0x11a0 [ F46BA4E7F4A34295B20917CD77F6CEC9, 1A91AC1AC1FBFC6922D0430D752240A91C9001373B1F84F960FDE0AC062A411A ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
14:08:29.0221 0x11a0 MsMpSvc - ok
14:08:29.0252 0x11a0 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
14:08:29.0315 0x11a0 MSPCLOCK - ok
14:08:29.0330 0x11a0 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
14:08:29.0377 0x11a0 MSPQM - ok
14:08:29.0439 0x11a0 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
14:08:29.0502 0x11a0 MsRPC - ok
14:08:29.0564 0x11a0 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
14:08:29.0595 0x11a0 mssmbios - ok
14:08:29.0611 0x11a0 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
14:08:29.0658 0x11a0 MSTEE - ok
14:08:29.0673 0x11a0 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
14:08:29.0705 0x11a0 MTConfig - ok
14:08:29.0736 0x11a0 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
14:08:29.0767 0x11a0 Mup - ok
14:08:29.0829 0x11a0 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
14:08:29.0939 0x11a0 napagent - ok
14:08:30.0001 0x11a0 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
14:08:30.0079 0x11a0 NativeWifiP - ok
14:08:30.0157 0x11a0 [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS C:\Windows\system32\drivers\ndis.sys
14:08:30.0266 0x11a0 NDIS - ok
14:08:30.0282 0x11a0 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
14:08:30.0344 0x11a0 NdisCap - ok
14:08:30.0375 0x11a0 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
14:08:30.0453 0x11a0 NdisTapi - ok
14:08:30.0516 0x11a0 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
14:08:30.0578 0x11a0 Ndisuio - ok
14:08:30.0625 0x11a0 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
14:08:30.0719 0x11a0 NdisWan - ok
14:08:30.0781 0x11a0 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
14:08:30.0875 0x11a0 NDProxy - ok
14:08:30.0953 0x11a0 [ 2334DC48997BA203B794DF3EE70521DB, 832F4EC1586C9669F2D54AB3B212943E43B87A33B24DCC8CDAD6A0264291EE2F ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
14:08:30.0999 0x11a0 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
14:08:34.0182 0x11a0 Detect skipped due to KSN trusted
14:08:34.0182 0x11a0 Net Driver HPZ12 - ok
14:08:34.0260 0x11a0 [ EE00C544C025958AF50C7B199F3C8595, D774DB020D9C46D1AA0B2DB9FA2C36C4A9C38D904CC6929695321D32ACA0D4D1 ] Netaapl C:\Windows\system32\DRIVERS\netaapl64.sys
14:08:34.0338 0x11a0 Netaapl - ok
14:08:34.0385 0x11a0 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
14:08:34.0478 0x11a0 NetBIOS - ok
14:08:34.0541 0x11a0 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
14:08:34.0634 0x11a0 NetBT - ok
14:08:34.0650 0x11a0 [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] Netlogon C:\Windows\system32\lsass.exe
14:08:34.0665 0x11a0 Netlogon - ok
14:08:34.0712 0x11a0 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
14:08:34.0821 0x11a0 Netman - ok
14:08:34.0962 0x11a0 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:08:34.0977 0x11a0 NetMsmqActivator - ok
14:08:35.0009 0x11a0 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:08:35.0040 0x11a0 NetPipeActivator - ok
14:08:35.0071 0x11a0 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
14:08:35.0211 0x11a0 netprofm - ok
14:08:35.0243 0x11a0 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:08:35.0274 0x11a0 NetTcpActivator - ok
14:08:35.0274 0x11a0 [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:08:35.0305 0x11a0 NetTcpPortSharing - ok
14:08:35.0601 0x11a0 [ 4D85A450EDEF10C38882182753A49AAE, FB6C2D91B2CF834315498BB31F931E2A49066A3158A588FD705F59628DF2F8FC ] NETw5s64 C:\Windows\system32\DRIVERS\NETw5s64.sys
14:08:36.0007 0x11a0 NETw5s64 - ok
14:08:36.0491 0x11a0 [ 98CF53F7B23F77D082805D5DBBD99A4E, 84285D0192B945262F69FE902C76519741425BD7C674364D6E11F96D2BC38B10 ] NETwNs64 C:\Windows\system32\DRIVERS\Netwsw00.sys
14:08:37.0052 0x11a0 NETwNs64 - ok
14:08:37.0115 0x11a0 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
14:08:37.0130 0x11a0 nfrd960 - ok
14:08:37.0224 0x11a0 [ E10B84385C3FEEF4BDE8E6A980535522, 56D9E47B76CDABE45E64C9E74DCBCC2F7C07A44519ED938BD730018C48445614 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
14:08:37.0271 0x11a0 NisDrv - ok
14:08:37.0333 0x11a0 [ 9BF50324444C46997C2492D505B47F2D, 42C74456C64F7D688E0911255746BD2A52A3590AED22B24F7E385760D720B8E9 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe
14:08:37.0364 0x11a0 NisSrv - ok
14:08:37.0442 0x11a0 [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc C:\Windows\System32\nlasvc.dll
14:08:37.0520 0x11a0 NlaSvc - ok
14:08:37.0551 0x11a0 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
14:08:37.0598 0x11a0 Npfs - ok
14:08:37.0629 0x11a0 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
14:08:37.0692 0x11a0 nsi - ok
14:08:37.0723 0x11a0 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
14:08:37.0785 0x11a0 nsiproxy - ok
14:08:37.0926 0x11a0 [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
14:08:38.0019 0x11a0 Ntfs - ok
14:08:38.0129 0x11a0 [ 6FD534EDE2905D3C3257CFDD881F9705, 4055EFA3B75D6E0CE5F8E6AAE7DC8856D757CDBD4BD0FB6690F8837364F207D9 ] NTI IScheduleSvc C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
14:08:38.0160 0x11a0 NTI IScheduleSvc - ok
14:08:38.0238 0x11a0 [ FD324CCE1D4D5BB5AF65F8E55B462C7E, 901287499F33EFD3B1EE6CBDAD4E4DD342DC62FCDCCEF5375CB9D7B0673EE1E6 ] NTIBackupSvc C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
14:08:38.0253 0x11a0 NTIBackupSvc - ok
14:08:38.0285 0x11a0 [ 64DDD0DEE976302F4BD93E5EFCC2F013, 19F54B4549999EF96FAE1B2B97973F281304843ADE0CF5823574453AB41E3E9C ] NTIDrvr C:\Windows\system32\drivers\NTIDrvr.sys
14:08:38.0300 0x11a0 NTIDrvr - ok
14:08:38.0331 0x11a0 [ 3F6268A2EC33CD38CF75C880AF8DED42, 6CA4A527878042C3BB40A7C0F4F9434827C7E60F989EB7C39BBAD0F270404EEE ] NTISchedulerSvc C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
14:08:38.0363 0x11a0 NTISchedulerSvc - ok
14:08:38.0378 0x11a0 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
14:08:38.0425 0x11a0 Null - ok
14:08:38.0487 0x11a0 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
14:08:38.0519 0x11a0 nvraid - ok
14:08:38.0581 0x11a0 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
14:08:38.0597 0x11a0 nvstor - ok
14:08:38.0675 0x11a0 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
14:08:38.0706 0x11a0 nv_agp - ok
14:08:38.0815 0x11a0 [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
14:08:38.0877 0x11a0 odserv - ok
14:08:38.0940 0x11a0 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
14:08:38.0971 0x11a0 ohci1394 - ok
14:08:39.0096 0x11a0 [ 2BA1E814DCBCDB16CDA4B18A0417F88F, 1A9D41092395786B94926652A4C0E36AFD35CB840D086999339410079451636E ] OpenVPNService C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe
14:08:39.0174 0x11a0 OpenVPNService - ok
14:08:39.0236 0x11a0 [ 30B5F9FB0C35AE6B4A0851D24CE2EE8B, 0340E77E8EC2ADC21B8DDD9C9CC95B3F4BCAFD54618A333C72D7D9587D593B83 ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
14:08:39.0267 0x11a0 ose - ok
14:08:39.0579 0x11a0 [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
14:08:39.0845 0x11a0 osppsvc - ok
14:08:39.0923 0x11a0 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
14:08:40.0032 0x11a0 p2pimsvc - ok
14:08:40.0079 0x11a0 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
14:08:40.0157 0x11a0 p2psvc - ok
14:08:40.0203 0x11a0 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\DRIVERS\parport.sys
14:08:40.0266 0x11a0 Parport - ok
14:08:40.0328 0x11a0 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
14:08:40.0359 0x11a0 partmgr - ok
14:08:40.0406 0x11a0 [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc C:\Windows\System32\pcasvc.dll
14:08:40.0469 0x11a0 PcaSvc - ok
14:08:40.0547 0x11a0 [ 0CA8EC66D00C75BA5009FDE8BD6F45DC, E39BE29DF975FDD6FDFBBA989479CCCAD8E6E63A7CAEA37D63DD511F6B44E1A3 ] pcCMService64 C:\Program Files\Common Files\Motive\pcCMService.exe
14:08:40.0625 0x11a0 pcCMService64 - detected UnsignedFile.Multi.Generic ( 1 )
14:08:43.0745 0x11a0 Detect skipped due to KSN trusted
14:08:43.0745 0x11a0 pcCMService64 - ok
14:08:43.0760 0x11a0 pccsmcfd - ok
14:08:43.0776 0x11a0 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
14:08:43.0807 0x11a0 pci - ok
14:08:43.0869 0x11a0 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
14:08:43.0901 0x11a0 pciide - ok
14:08:43.0947 0x11a0 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
14:08:43.0963 0x11a0 pcmcia - ok
14:08:44.0025 0x11a0 [ 1458F126F56A71673DE7EE968061E7BE, 173E7809A02BA874A99DC5FF4C1278DE70C2F1464E7963C18FCCFA2D452A8A5B ] pcServiceHost C:\Program Files\Common Files\Motive\pcServiceHost.exe
14:08:44.0088 0x11a0 pcServiceHost - detected UnsignedFile.Multi.Generic ( 1 )
14:08:47.0177 0x11a0 Detect skipped due to KSN trusted
14:08:47.0177 0x11a0 pcServiceHost - ok
14:08:47.0239 0x11a0 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
14:08:47.0270 0x11a0 pcw - ok
14:08:47.0348 0x11a0 [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
14:08:47.0457 0x11a0 PEAUTH - ok
14:08:47.0567 0x11a0 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
14:08:47.0629 0x11a0 PerfHost - ok
14:08:47.0738 0x11a0 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
14:08:47.0910 0x11a0 pla - ok
14:08:48.0019 0x11a0 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
14:08:48.0113 0x11a0 PlugPlay - ok
14:08:48.0175 0x11a0 [ AC78DF349F0E4CFB8B667C0CFFF83CCE, 7E635AA2E7350FCA0C954E697F1480A6204920AEFBCF06B90FFA02398DA82822 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
14:08:48.0222 0x11a0 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
14:08:51.0405 0x11a0 Detect skipped due to KSN trusted
14:08:51.0405 0x11a0 Pml Driver HPZ12 - ok
14:08:51.0452 0x11a0 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
14:08:51.0546 0x11a0 PNRPAutoReg - ok
14:08:51.0577 0x11a0 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
14:08:51.0608 0x11a0 PNRPsvc - ok
14:08:51.0670 0x11a0 [ 4F0878FD62D5F7444C5F1C4C66D9D293, B381217D6202C06EE992EBDE061FA20376FF71F698022D0A80168CCD1059453C ] Point64 C:\Windows\system32\DRIVERS\point64.sys
14:08:51.0686 0x11a0 Point64 - ok
14:08:51.0764 0x11a0 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
14:08:51.0858 0x11a0 PolicyAgent - ok
14:08:51.0889 0x11a0 [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power C:\Windows\system32\umpo.dll
14:08:51.0967 0x11a0 Power - ok
14:08:52.0029 0x11a0 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
14:08:52.0076 0x11a0 PptpMiniport - ok
14:08:52.0107 0x11a0 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\DRIVERS\processr.sys
14:08:52.0138 0x11a0 Processor - ok
14:08:52.0201 0x11a0 [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc C:\Windows\system32\profsvc.dll
14:08:52.0357 0x11a0 ProfSvc - ok
14:08:52.0404 0x11a0 [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] ProtectedStorage C:\Windows\system32\lsass.exe
14:08:52.0435 0x11a0 ProtectedStorage - ok
14:08:52.0497 0x11a0 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
14:08:52.0560 0x11a0 Psched - ok
14:08:52.0638 0x11a0 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
14:08:52.0747 0x11a0 ql2300 - ok
14:08:52.0762 0x11a0 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
14:08:52.0778 0x11a0 ql40xx - ok
14:08:52.0825 0x11a0 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
14:08:52.0887 0x11a0 QWAVE - ok
14:08:52.0903 0x11a0 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
14:08:52.0934 0x11a0 QWAVEdrv - ok
14:08:52.0950 0x11a0 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
14:08:53.0012 0x11a0 RasAcd - ok
14:08:53.0059 0x11a0 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
14:08:53.0121 0x11a0 RasAgileVpn - ok
14:08:53.0137 0x11a0 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
14:08:53.0199 0x11a0 RasAuto - ok
14:08:53.0246 0x11a0 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
14:08:53.0355 0x11a0 Rasl2tp - ok
14:08:53.0433 0x11a0 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
14:08:53.0527 0x11a0 RasMan - ok
14:08:53.0574 0x11a0 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
14:08:53.0636 0x11a0 RasPppoe - ok
14:08:53.0667 0x11a0 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
14:08:53.0731 0x11a0 RasSstp - ok
14:08:53.0809 0x11a0 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
14:08:53.0902 0x11a0 rdbss - ok
14:08:53.0933 0x11a0 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
14:08:53.0980 0x11a0 rdpbus - ok
14:08:54.0011 0x11a0 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
14:08:54.0074 0x11a0 RDPCDD - ok
14:08:54.0121 0x11a0 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
14:08:54.0183 0x11a0 RDPENCDD - ok
14:08:54.0214 0x11a0 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
14:08:54.0245 0x11a0 RDPREFMP - ok
14:08:54.0370 0x11a0 [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
14:08:54.0464 0x11a0 RdpVideoMiniport - ok
14:08:54.0526 0x11a0 [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
14:08:54.0573 0x11a0 RDPWD - ok
14:08:54.0651 0x11a0 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
14:08:54.0667 0x11a0 rdyboost - ok
14:08:54.0698 0x11a0 RegKill - ok
14:08:54.0729 0x11a0 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
14:08:54.0776 0x11a0 RemoteAccess - ok
14:08:54.0823 0x11a0 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
14:08:54.0947 0x11a0 RemoteRegistry - ok
14:08:55.0010 0x11a0 [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
14:08:55.0025 0x11a0 RFCOMM - ok
14:08:55.0072 0x11a0 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
14:08:55.0135 0x11a0 RpcEptMapper - ok
14:08:55.0166 0x11a0 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
14:08:55.0197 0x11a0 RpcLocator - ok
14:08:55.0275 0x11a0 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
14:08:55.0337 0x11a0 RpcSs - ok
14:08:55.0384 0x11a0 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
14:08:55.0462 0x11a0 rspndr - ok
14:08:55.0509 0x11a0 [ 2DB8116D52B19216812C4E6D5D837810, 00A524FF80DE69B6B6CA767C90723E833891C006AB43E65A1F6F14C38B8F2427 ] RSUSBSTOR C:\Windows\system32\Drivers\RtsUStor.sys
14:08:55.0603 0x11a0 RSUSBSTOR - ok
14:08:55.0618 0x11a0 RtsUIR - ok
14:08:55.0649 0x11a0 [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] SamSs C:\Windows\system32\lsass.exe
14:08:55.0665 0x11a0 SamSs - ok
14:08:55.0727 0x11a0 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
14:08:55.0743 0x11a0 sbp2port - ok
14:08:55.0805 0x11a0 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
14:08:55.0883 0x11a0 SCardSvr - ok
14:08:55.0946 0x11a0 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
14:08:56.0008 0x11a0 scfilter - ok
14:08:56.0102 0x11a0 [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
14:08:56.0211 0x11a0 Schedule - ok
14:08:56.0273 0x11a0 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
14:08:56.0320 0x11a0 SCPolicySvc - ok
14:08:56.0367 0x11a0 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
14:08:56.0445 0x11a0 SDRSVC - ok
14:08:56.0476 0x11a0 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
14:08:56.0554 0x11a0 secdrv - ok
14:08:56.0601 0x11a0 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
14:08:56.0648 0x11a0 seclogon - ok
14:08:56.0679 0x11a0 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\system32\sens.dll
14:08:56.0741 0x11a0 SENS - ok
14:08:56.0773 0x11a0 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
14:08:56.0835 0x11a0 SensrSvc - ok
14:08:56.0882 0x11a0 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
14:08:56.0929 0x11a0 Serenum - ok
14:08:56.0975 0x11a0 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
14:08:57.0007 0x11a0 Serial - ok
14:08:57.0085 0x11a0 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
14:08:57.0131 0x11a0 sermouse - ok
14:08:57.0194 0x11a0 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
14:08:57.0256 0x11a0 SessionEnv - ok
14:08:57.0319 0x11a0 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
14:08:57.0350 0x11a0 sffdisk - ok
14:08:57.0381 0x11a0 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
14:08:57.0428 0x11a0 sffp_mmc - ok
14:08:57.0459 0x11a0 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
14:08:57.0506 0x11a0 sffp_sd - ok
14:08:57.0553 0x11a0 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
14:08:57.0599 0x11a0 sfloppy - ok
14:08:57.0677 0x11a0 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
14:08:57.0802 0x11a0 SharedAccess - ok
14:08:57.0880 0x11a0 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:08:57.0958 0x11a0 ShellHWDetection - ok
14:08:57.0989 0x11a0 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
14:08:58.0005 0x11a0 SiSRaid2 - ok
14:08:58.0036 0x11a0 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
14:08:58.0067 0x11a0 SiSRaid4 - ok
14:08:58.0192 0x11a0 [ A9C057A9463C25490CF99EA8DF8A4B35, 8F4D1C40D0F17EDBF84ED455B8946F782C7552383F0A07E410A9B6CFF7F51D63 ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
14:08:58.0223 0x11a0 SkypeUpdate - ok
14:08:58.0286 0x11a0 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
14:08:58.0364 0x11a0 Smb - ok
14:08:58.0426 0x11a0 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
14:08:58.0489 0x11a0 SNMPTRAP - ok
14:08:58.0535 0x11a0 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
14:08:58.0551 0x11a0 spldr - ok
14:08:58.0645 0x11a0 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
14:08:58.0738 0x11a0 Spooler - ok
14:08:58.0941 0x11a0 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
14:08:59.0159 0x11a0 sppsvc - ok
14:08:59.0206 0x11a0 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
14:08:59.0300 0x11a0 sppuinotify - ok
14:08:59.0378 0x11a0 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
14:08:59.0487 0x11a0 srv - ok
14:08:59.0549 0x11a0 [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
14:08:59.0627 0x11a0 srv2 - ok
14:08:59.0690 0x11a0 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
14:08:59.0721 0x11a0 srvnet - ok
14:08:59.0830 0x11a0 [ 8F8324ED1DE63FFC7B1A02CD2D963C72, E58603F81DEAFF1D45CB83FB6E625E6A13868741B833B1C9E60D672179D18EE0 ] ssadbus C:\Windows\system32\DRIVERS\ssadbus.sys
14:08:59.0939 0x11a0 ssadbus - ok
14:09:00.0002 0x11a0 [ 58221EFCB74167B73667F0024C661CE0, D9B67A8897B4DC3E4729187F17ABEB4710CF57440D718E17ED828439198D34DB ] ssadmdfl C:\Windows\system32\DRIVERS\ssadmdfl.sys
14:09:00.0127 0x11a0 ssadmdfl - ok
14:09:00.0205 0x11a0 [ 4DA7C71BFAC5AD71255B7E4CAB980163, 4CC0F9C8E96ECEF36EEB021E448A9734B63512D030516DC38B1A2EEAA1043AEC ] ssadmdm C:\Windows\system32\DRIVERS\ssadmdm.sys
14:09:00.0251 0x11a0 ssadmdm - ok
14:09:00.0298 0x11a0 [ D33D1BD3EC0E766211A234F56A12726D, 53EEAA94865554F8422D111D717B548DF553B5B8647D2A45F3718BF4AEEBEC27 ] ssadserd C:\Windows\system32\DRIVERS\ssadserd.sys
14:09:00.0361 0x11a0 ssadserd - ok
14:09:00.0407 0x11a0 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
14:09:00.0470 0x11a0 SSDPSRV - ok
14:09:00.0517 0x11a0 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
14:09:00.0579 0x11a0 SstpSvc - ok
14:09:00.0673 0x11a0 StarOpen - ok
14:09:00.0782 0x11a0 [ DB0768632C680B7C0D3AA92D80416893, BEC3CF4F1CB150AC7C4647DD7C0D5D62B10824308E44467CD77CA3427A46FB20 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
14:09:00.0829 0x11a0 Steam Client Service - ok
14:09:00.0860 0x11a0 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
14:09:00.0891 0x11a0 stexstor - ok
14:09:00.0953 0x11a0 [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam C:\Windows\system32\DRIVERS\serscan.sys
14:09:01.0016 0x11a0 StillCam - ok
14:09:01.0109 0x11a0 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
14:09:01.0203 0x11a0 stisvc - ok
14:09:01.0250 0x11a0 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\drivers\swenum.sys
14:09:01.0281 0x11a0 swenum - ok
14:09:01.0343 0x11a0 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
14:09:01.0453 0x11a0 swprv - ok
14:09:01.0952 0x11a0 [ BA7DBDCE2373EFAC4EF9EB1DEE273E45, 789D71DFCDE94F289F78464E4EE28E7C55E29E145C69BF733032A2B7F190DD60 ] SyncedTool C:\Program Files (x86)\Filecloud\bin\agent_service.exe
14:09:02.0186 0x11a0 SyncedTool - ok
14:09:02.0295 0x11a0 [ ED6D1424E5B0C21A57B28DD8508D6843, EF3BBBBD376F22520060BC6D637CDF79E2D8B43A95E746FC1463E7CDC407C2D9 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
14:09:02.0373 0x11a0 SynTP - ok
14:09:02.0498 0x11a0 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
14:09:02.0669 0x11a0 SysMain - ok
14:09:02.0732 0x11a0 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
14:09:02.0825 0x11a0 TabletInputService - ok
14:09:02.0903 0x11a0 [ 3C32FF010F869BC184DF71290477384E, 55CFCEC7F026C6E2E96A2FBE846AB513BB12BB0348735274FE1B71AF019C837B ] tap0901 C:\Windows\system32\DRIVERS\tap0901.sys
14:09:02.0966 0x11a0 tap0901 - ok
14:09:03.0028 0x11a0 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
14:09:03.0106 0x11a0 TapiSrv - ok
14:09:03.0137 0x11a0 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
14:09:03.0184 0x11a0 TBS - ok
14:09:03.0325 0x11a0 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
14:09:03.0418 0x11a0 Tcpip - ok
14:09:03.0512 0x11a0 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
14:09:03.0574 0x11a0 TCPIP6 - ok
14:09:03.0652 0x11a0 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
14:09:03.0668 0x11a0 tcpipreg - ok
14:09:03.0699 0x11a0 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
14:09:03.0730 0x11a0 TDPIPE - ok
14:09:03.0808 0x11a0 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
14:09:03.0824 0x11a0 TDTCP - ok
14:09:03.0902 0x11a0 [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx C:\Windows\system32\DRIVERS\tdx.sys
14:09:03.0949 0x11a0 tdx - ok
14:09:04.0011 0x11a0 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\drivers\termdd.sys
14:09:04.0027 0x11a0 TermDD - ok
14:09:04.0105 0x11a0 [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService C:\Windows\System32\termsrv.dll
14:09:04.0229 0x11a0 TermService - ok
14:09:04.0276 0x11a0 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
14:09:04.0307 0x11a0 Themes - ok
14:09:04.0339 0x11a0 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
14:09:04.0385 0x11a0 THREADORDER - ok
14:09:04.0432 0x11a0 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
14:09:04.0495 0x11a0 TrkWks - ok
14:09:04.0573 0x11a0 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
14:09:04.0635 0x11a0 TrustedInstaller - ok
14:09:04.0713 0x11a0 [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
14:09:04.0760 0x11a0 tssecsrv - ok
14:09:04.0853 0x11a0 [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
14:09:04.0916 0x11a0 TsUsbFlt - ok
14:09:05.0009 0x11a0 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
14:09:05.0087 0x11a0 tunnel - ok
14:09:05.0134 0x11a0 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
14:09:05.0150 0x11a0 uagp35 - ok
14:09:05.0212 0x11a0 [ 2E22C1FD397A5A9FFEF55E9D1FC96C00, 4646712B3F3AF6188DBCE1A95D92261E8B15E9583FE5DD538EC884F48B51759D ] UBHelper C:\Windows\system32\drivers\UBHelper.sys
14:09:05.0228 0x11a0 UBHelper - ok
14:09:05.0306 0x11a0 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
14:09:05.0369 0x11a0 udfs - ok
14:09:05.0432 0x11a0 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
14:09:05.0494 0x11a0 UI0Detect - ok
14:09:05.0525 0x11a0 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
14:09:05.0556 0x11a0 uliagpkx - ok
14:09:05.0619 0x11a0 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\DRIVERS\umbus.sys
14:09:05.0666 0x11a0 umbus - ok
14:09:05.0744 0x11a0 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
14:09:05.0790 0x11a0 UmPass - ok
14:09:05.0946 0x11a0 [ 70DDE3A86DBEB1D6C3C30AD687B1877A, 2DAE797240DB8F521F1C9D1171524790052E186B060D58A1B102FBFFC80CE48E ] Updater Service C:\Program Files\Acer\Acer Updater\UpdaterService.exe
14:09:05.0962 0x11a0 Updater Service - ok
14:09:06.0009 0x11a0 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
14:09:06.0102 0x11a0 upnphost - ok
14:09:06.0134 0x11a0 upperdev - ok
14:09:06.0196 0x11a0 [ 5C3BE22E485B9BF11FCEFDC676C728D0, F55061066ECF6920D56518A677BB538C18B7F1BB150ED6DB3591408F44E8D53A ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
14:09:07.0740 0x11a0 USBAAPL64 - ok
14:09:07.0850 0x11a0 [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys
14:09:07.0881 0x11a0 usbaudio - ok
14:09:07.0928 0x11a0 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
14:09:08.0006 0x11a0 usbccgp - ok
14:09:08.0021 0x11a0 USBCCID - ok
14:09:08.0099 0x11a0 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
14:09:08.0193 0x11a0 usbcir - ok
14:09:08.0224 0x11a0 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
14:09:08.0271 0x11a0 usbehci - ok
14:09:08.0349 0x11a0 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
14:09:08.0442 0x11a0 usbhub - ok
14:09:08.0474 0x11a0 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\drivers\usbohci.sys
14:09:08.0505 0x11a0 usbohci - ok
14:09:08.0536 0x11a0 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
14:09:08.0598 0x11a0 usbprint - ok
14:09:08.0661 0x11a0 [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan C:\Windows\system32\drivers\usbscan.sys
14:09:08.0739 0x11a0 usbscan - ok
14:09:08.0833 0x11a0 [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
14:09:08.0896 0x11a0 USBSTOR - ok
14:09:08.0927 0x11a0 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\DRIVERS\usbuhci.sys
14:09:08.0974 0x11a0 usbuhci - ok
14:09:09.0052 0x11a0 [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
14:09:09.0130 0x11a0 usbvideo - ok
14:09:09.0161 0x11a0 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
14:09:09.0223 0x11a0 UxSms - ok
14:09:09.0255 0x11a0 [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] VaultSvc C:\Windows\system32\lsass.exe
14:09:09.0286 0x11a0 VaultSvc - ok
14:09:09.0333 0x11a0 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
14:09:09.0364 0x11a0 vdrvroot - ok
14:09:09.0442 0x11a0 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
14:09:09.0551 0x11a0 vds - ok
14:09:09.0567 0x11a0 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
14:09:09.0582 0x11a0 vga - ok
14:09:09.0613 0x11a0 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
14:09:09.0660 0x11a0 VgaSave - ok
14:09:09.0723 0x11a0 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
14:09:09.0754 0x11a0 vhdmp - ok
14:09:09.0816 0x11a0 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
14:09:09.0847 0x11a0 viaide - ok
14:09:09.0863 0x11a0 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
14:09:09.0879 0x11a0 volmgr - ok
14:09:09.0972 0x11a0 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
14:09:10.0019 0x11a0 volmgrx - ok
14:09:10.0050 0x11a0 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
14:09:10.0081 0x11a0 volsnap - ok
14:09:10.0113 0x11a0 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
14:09:10.0144 0x11a0 vsmraid - ok
14:09:10.0269 0x11a0 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
14:09:10.0425 0x11a0 VSS - ok
14:09:10.0440 0x11a0 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
14:09:10.0471 0x11a0 vwifibus - ok
14:09:10.0487 0x11a0 [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
14:09:10.0503 0x11a0 vwififlt - ok
14:09:10.0534 0x11a0 [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
14:09:10.0581 0x11a0 vwifimp - ok
14:09:10.0643 0x11a0 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
14:09:10.0752 0x11a0 W32Time - ok
14:09:10.0799 0x11a0 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
14:09:10.0846 0x11a0 WacomPen - ok
14:09:10.0908 0x11a0 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
14:09:10.0955 0x11a0 WANARP - ok
14:09:10.0971 0x11a0 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
14:09:11.0017 0x11a0 Wanarpv6 - ok
14:09:11.0142 0x11a0 [ 3CEC96DE223E49EAAE3651FCF8FAEA6C, 4150DAB33E8D61076F1D4767BCAFC9B4ECCCCBD58FD4FB3CFE5B8D27DCDCAB61 ] WatAdminSvc C:\Windows\system32\Wat\WatAdminSvc.exe
14:09:11.0251 0x11a0 WatAdminSvc - ok
14:09:11.0392 0x11a0 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
14:09:11.0595 0x11a0 wbengine - ok
14:09:11.0657 0x11a0 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
14:09:11.0735 0x11a0 WbioSrvc - ok
14:09:11.0797 0x11a0 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
14:09:11.0891 0x11a0 wcncsvc - ok
14:09:11.0922 0x11a0 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
14:09:11.0969 0x11a0 WcsPlugInService - ok
14:09:12.0000 0x11a0 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\DRIVERS\wd.sys
14:09:12.0016 0x11a0 Wd - ok
14:09:12.0125 0x11a0 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
14:09:12.0203 0x11a0 Wdf01000 - ok
14:09:12.0281 0x11a0 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost C:\Windows\system32\wdi.dll
14:09:12.0328 0x11a0 WdiServiceHost - ok
14:09:12.0343 0x11a0 [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost C:\Windows\system32\wdi.dll
14:09:12.0359 0x11a0 WdiSystemHost - ok
14:09:12.0437 0x11a0 [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient C:\Windows\System32\webclnt.dll
14:09:12.0546 0x11a0 WebClient - ok
14:09:12.0609 0x11a0 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
14:09:12.0687 0x11a0 Wecsvc - ok
14:09:12.0702 0x11a0 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
14:09:12.0765 0x11a0 wercplsupport - ok
14:09:12.0796 0x11a0 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
14:09:12.0843 0x11a0 WerSvc - ok
14:09:12.0874 0x11a0 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
14:09:12.0921 0x11a0 WfpLwf - ok
14:09:12.0936 0x11a0 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
14:09:12.0952 0x11a0 WIMMount - ok
14:09:12.0983 0x11a0 WinDefend - ok
14:09:12.0999 0x11a0 WinHttpAutoProxySvc - ok
14:09:13.0092 0x11a0 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
14:09:13.0155 0x11a0 Winmgmt - ok
14:09:13.0311 0x11a0 [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM C:\Windows\system32\WsmSvc.dll
14:09:13.0498 0x11a0 WinRM - ok
14:09:13.0592 0x11a0 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
14:09:13.0638 0x11a0 WinUsb - ok
14:09:13.0716 0x11a0 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
14:09:13.0857 0x11a0 Wlansvc - ok
14:09:14.0138 0x11a0 [ 357CABBF155AFD1D3926E62539D2A3A7, C43CFF84E7D930B4999DC061AB0766B57AAD7540B3E6EE54605B10ECE90825F5 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
14:09:14.0200 0x11a0 wlidsvc - ok
14:09:14.0294 0x11a0 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
14:09:14.0340 0x11a0 WmiAcpi - ok
14:09:14.0387 0x11a0 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
14:09:14.0403 0x11a0 wmiApSrv - ok
14:09:14.0481 0x11a0 WMPNetworkSvc - ok
14:09:14.0512 0x11a0 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
14:09:14.0574 0x11a0 WPCSvc - ok
14:09:14.0652 0x11a0 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
14:09:14.0684 0x11a0 WPDBusEnum - ok
14:09:14.0730 0x11a0 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
14:09:14.0808 0x11a0 ws2ifsl - ok
14:09:14.0840 0x11a0 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\system32\wscsvc.dll
14:09:14.0902 0x11a0 wscsvc - ok
14:09:14.0964 0x11a0 [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice C:\Windows\system32\DRIVERS\WSDPrint.sys
14:09:15.0042 0x11a0 WSDPrintDevice - ok
14:09:15.0136 0x11a0 [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan C:\Windows\system32\drivers\WSDScan.sys
14:09:15.0198 0x11a0 WSDScan - ok
14:09:15.0261 0x11a0 WSearch - ok
14:09:15.0464 0x11a0 [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv C:\Windows\system32\wuaueng.dll
14:09:15.0604 0x11a0 wuauserv - ok
14:09:15.0666 0x11a0 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
14:09:15.0760 0x11a0 WudfPf - ok
14:09:15.0822 0x11a0 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
14:09:15.0916 0x11a0 WUDFRd - ok
14:09:16.0010 0x11a0 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
14:09:16.0088 0x11a0 wudfsvc - ok
14:09:16.0166 0x11a0 [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\Windows\System32\wwansvc.dll
14:09:16.0259 0x11a0 WwanSvc - ok
14:09:16.0290 0x11a0 ZTEusbmdm6k - ok
14:09:16.0290 0x11a0 ZTEusbnmea - ok
14:09:16.0322 0x11a0 ZTEusbser6k - ok
14:09:16.0431 0x11a0 [ 74983ADDCA2D9618512C088D856D6615, C4592EFC1206BD813221814FD529AD38ED26E4AE086613EB95D3D5E20448A1F0 ] {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl
14:09:16.0462 0x11a0 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} - ok
14:09:16.0524 0x11a0 ================ Scan global ===============================
14:09:16.0540 0x11a0 [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
14:09:16.0602 0x11a0 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
14:09:16.0634 0x11a0 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
14:09:16.0665 0x11a0 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
14:09:16.0696 0x11a0 [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
14:09:16.0727 0x11a0 [ Global ] - ok
14:09:16.0727 0x11a0 ================ Scan MBR ==================================
14:09:16.0758 0x11a0 [ 5C616939100B85E558DA92B899A0FC36 ] \Device\Harddisk0\DR0
14:09:17.0211 0x11a0 \Device\Harddisk0\DR0 - ok
14:09:17.0211 0x11a0 ================ Scan VBR ==================================
14:09:17.0226 0x11a0 [ D19E75605B72E7E5422E5A81ECB30E4D ] \Device\Harddisk0\DR0\Partition1
14:09:17.0226 0x11a0 \Device\Harddisk0\DR0\Partition1 - ok
14:09:17.0226 0x11a0 [ 402A08552B5030E7EED1FDFA75B69F3F ] \Device\Harddisk0\DR0\Partition2
14:09:17.0226 0x11a0 \Device\Harddisk0\DR0\Partition2 - ok
14:09:17.0226 0x11a0 ================ Scan generic autorun ======================
14:09:17.0289 0x11a0 [ 5AF1E9600E3FF841E522703A4993ED0C, 5189530793747C40B0E3548DA40058989C88A69C593C3E54E6548CFB89B9CE10 ] C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe
14:09:17.0320 0x11a0 IAAnotif - ok
14:09:17.0320 0x11a0 mwlDaemon - ok
14:09:17.0679 0x11a0 [ 901A91A3527F4F5212CF6B03C21DAD82, 246BF06652DEA48DCC486496587E08FCA3F45A0EDEFFAE13251514CE6C46ED4B ] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
14:09:17.0882 0x11a0 RtHDVCpl - ok
14:09:17.0913 0x11a0 SynTPEnh - ok
14:09:17.0944 0x11a0 [ 0D3DFFA8BA3E63592FC2C652CF3B0E9C, B5237E04006436F5C1A156D46BC0FC8F5FFFF049A04A66170FDF934A971F512E ] C:\Windows\PLFSetI.exe
14:09:17.0944 0x11a0 PLFSetI - detected UnsignedFile.Multi.Generic ( 1 )
14:09:21.0064 0x11a0 Detect skipped due to KSN trusted
14:09:21.0064 0x11a0 PLFSetI - ok
14:09:21.0173 0x11a0 [ E64270B5DB7218E60AD62ED0C52E3A09, E9CC0CA9A19868C34EC782FA9F45617DB81C791393BED68EBF8E38BE2C27F8FA ] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
14:09:21.0204 0x11a0 Acer ePower Management - ok
14:09:21.0407 0x11a0 [ 5B72629C8144D1A96490D4C090D28DA1, 114891B9E7E05D2B86C8E3CD7B4096088491E338C3B1902F9352D40B47DD418C ] c:\Program Files\Microsoft IntelliPoint\ipoint.exe
14:09:21.0470 0x11a0 IntelliPoint - ok
14:09:21.0641 0x11a0 [ 705677A1FD2006CF00D066BF87DE96FF, C4768859290D3486E7BF7C2D1525C99DDF85CB97ECF7D13386E391E531F4A1DB ] C:\Program Files\tcnz\pcTrayApp.exe
14:09:21.0782 0x11a0 tcnz_McciTrayApp - detected UnsignedFile.Multi.Generic ( 1 )
14:09:27.0912 0x11a0 Detect skipped due to KSN trusted
14:09:27.0912 0x11a0 tcnz_McciTrayApp - ok
14:09:28.0053 0x11a0 [ 87A4BA086E5B5DF0F36E3F6D7234D701, EE26338497E016A95CB5970777B7B7AC8FAEF4E491713D729EDEFBCDC9FBF4A4 ] c:\Program Files\Microsoft Security Client\msseces.exe
14:09:28.0100 0x11a0 MSC - ok
14:09:28.0146 0x11a0 [ D0B542256A968DFCB8896C140FCE6047, 3F92A9871B521BCCCDFE6D9BFF88930B26C5DB86F6F6578554A3F2ECC5C5EBA0 ] C:\Program Files\iTunes\iTunesHelper.exe
14:09:28.0162 0x11a0 iTunesHelper - ok
14:09:28.0256 0x11a0 [ BCDFB6FAFD26A7FD8BF907E27F51B7A3, F136E13D2C94D3BAE9333C8F99D8A55719C7D1050702DDE491F0AA88C3E27375 ] C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
14:09:28.0271 0x11a0 BackupManagerTray - ok
14:09:28.0380 0x11a0 [ 56D1890D74A8999F756E338210846AF1, 9A5F771B4665D3735B04DD5FBDCED18B1BE99CD97AD4F92B3835CC51E3F5E191 ] C:\Program Files (x86)\Launch Manager\LManager.exe
14:09:28.0427 0x11a0 LManager - ok
14:09:28.0474 0x11a0 [ D93B31DAEF7F116CE8192E266D557912, 60A42914D537CD6EA523F772D131C9EF9534E00628C4C9B8DDF9FBDD9ADD3319 ] C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
14:09:28.0505 0x11a0 ArcadeDeluxeAgent - ok
14:09:28.0552 0x11a0 [ 7D9EDDB07E9EB30D399E630D94DFBCC7, 7D21E54DEA5B5A2B0FDE06E639427FFD071F9BE3C8BC62FC1AE4CD0173DDCC93 ] C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
14:09:28.0568 0x11a0 PlayMovie - ok
14:09:28.0646 0x11a0 [ 0E34B7BB1FCF22BCC1E394D16F9E992B, 382CA8E6BAC301E2F277F8EDA03D263FF71272796A8EED582C36294EEE9191F9 ] C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe
14:09:28.0677 0x11a0 GrooveMonitor - ok
14:09:28.0786 0x11a0 [ 3FBBF6092C4EF5F50302707063E853EF, 70BF8FCDE0A793A66ACB65FA8C2B8C5872C3167DA95D6232A2520628F3768913 ] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
14:09:28.0817 0x11a0 AppleSyncNotifier - ok
14:09:28.0880 0x11a0 [ 9F60097061F79620C9C59FF37A61D852, 9B94C00CAA1F4DF95485F994576DA68B30635C628CFE3D6AE1811E6FEB1A56CA ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
14:09:28.0895 0x11a0 APSDaemon - ok
14:09:29.0020 0x11a0 [ 38D8776F8EC474667A939B2309F9C75F, C4FE2B6E26407D1945E15468EA87AA1196D7F30A9F8A33BBD8BABEB806F5428B ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
14:09:29.0098 0x11a0 StartCCC - ok
14:09:29.0098 0x11a0 AMD AVT - ok
14:09:29.0394 0x11a0 [ 938FA6F63B210FB8EF5A7B2FC1229431, 545DDA9C32DF14B50688F8192A345FE66D2DB3F8763ECBF85B38AC829E49E1D9 ] C:\Program Files\Alwil Software\Avast5\AvastUI.exe
14:09:29.0550 0x11a0 AvastUI.exe - ok
14:09:29.0597 0x11a0 [ 56193BCE4DFD8879AEDEB26B71A0A583, F4DA975054B885F8B74819D830BCBFE2EFF53D3461CB09775BEA1127DBEB86DB ] C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe
14:09:29.0613 0x11a0 RegKillElbyCheck - detected UnsignedFile.Multi.Generic ( 1 )
14:09:32.0733 0x11a0 Detect skipped due to KSN trusted
14:09:32.0733 0x11a0 RegKillElbyCheck - ok
14:09:32.0764 0x11a0 [ D7A308808A2AB81B0FB21D31D27994FE, 564883317D3F3137C856FE6D7B298BB105EA9F143D0928EBE19353F41442345F ] C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\RegKillTray.exe
14:09:32.0811 0x11a0 RegKillTray - detected UnsignedFile.Multi.Generic ( 1 )
14:09:38.0942 0x11a0 Detect skipped due to KSN trusted
14:09:38.0942 0x11a0 RegKillTray - ok
14:09:39.0066 0x11a0 [ 34D296AFC913E302953C70463EF09A48, BC413307CBC56C039EE8A05B51A56E14EF59678FBB33815AEB320078056C8CE7 ] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
14:09:39.0098 0x11a0 HP Software Update - ok
14:09:39.0300 0x11a0 [ 9F1121525EA1FF13F78AABD9157F3AF9, A955D6EF3CFD26CE57C7A3F3B7D6E96A804A32A5C5CD9AC42B4EAE7C30C4D8A7 ] C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
14:09:39.0363 0x11a0 Remote Control Editor - ok
14:09:39.0425 0x11a0 [ EC58C1A9A3281CE0C8FCC05BDBFECB37, 3738BBC112346B32F686F1CB4B4AAD89B06AA1F8FB2D333BC2D2F554212A0A59 ] C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
14:09:39.0456 0x11a0 iCloudServices - ok
14:09:39.0456 0x11a0 Waiting for KSN requests completion. In queue: 179
14:09:40.0470 0x11a0 Waiting for KSN requests completion. In queue: 179
14:09:41.0484 0x11a0 Waiting for KSN requests completion. In queue: 179
14:09:42.0498 0x11a0 Waiting for KSN requests completion. In queue: 179
14:09:43.0512 0x11a0 Waiting for KSN requests completion. In queue: 176
14:09:44.0558 0x11a0 AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.7.205.0 ), 0x61000 ( enabled : updated )
14:09:44.0604 0x11a0 AV detected via SS2: avast! Antivirus, C:\Program Files\Alwil Software\Avast5\VisthAux.exe ( 10.2.2214.845 ), 0x41000 ( enabled : updated )
14:09:44.0604 0x11a0 Win FW state via NFP2: enabled
14:09:47.0740 0x11a0 ============================================================
14:09:47.0740 0x11a0 Scan finished
14:09:47.0740 0x11a0 ============================================================
14:09:47.0740 0x05c4 Detected object count: 0
14:09:47.0740 0x05c4 Actual detected object count: 0
14:41:39.0211 0x0794 Deinitialize success
Kermit |
|
26.03.2015, 17:07
| #6 |
| /// the machine /// TB-Ausbilder | Bei Installation Adobe Flash Player Virus eingefangen... hi, Scan mit Combofix
__________________ --> Bei Installation Adobe Flash Player Virus eingefangen... |
|
27.03.2015, 01:04
| #7 |
| | Bei Installation Adobe Flash Player Virus eingefangen... Hallo Schrauber, es folgt der Combo Fix Log... Code:
ATTFilter ComboFix 15-03-25.01 - Heiko 27.03.2015 12:10:35.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4091.2446 [GMT 13:00]
ausgeführt von:: c:\users\Heiko\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2015-02-26 bis 2015-03-26 ))))))))))))))))))))))))))))))
.
.
2015-03-26 23:23 . 2015-03-26 23:23 -------- d-----w- c:\users\Public\AppData\Local\temp
2015-03-26 11:33 . 2015-03-26 11:33 75888 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{77449F94-0B5E-4AAA-94AE-547EDDD64B79}\offreg.dll
2015-03-25 23:58 . 2015-03-25 23:53 1187344 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{69B1A062-88AE-4CF2-87C4-0AB487109FC4}\gapaengine.dll
2015-03-25 23:53 . 2015-03-14 10:02 12002392 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{77449F94-0B5E-4AAA-94AE-547EDDD64B79}\mpengine.dll
2015-03-25 23:46 . 2015-03-26 01:03 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-03-24 09:01 . 2015-01-29 09:07 11910896 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-03-24 08:41 . 2015-03-24 08:43 -------- d-----w- C:\FRST
2015-03-23 07:52 . 2015-03-23 07:52 778928 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2015-03-23 07:52 . 2015-03-23 07:52 142512 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-03-23 07:26 . 2015-03-23 07:27 -------- d-----w- c:\users\Heiko\AppData\Local\Opera Software
2015-03-23 07:26 . 2015-03-23 07:27 -------- d-----w- c:\users\Heiko\AppData\Roaming\Opera Software
2015-03-23 07:23 . 2015-03-23 07:27 -------- d-----w- c:\program files (x86)\Opera
2015-03-20 21:43 . 2015-03-20 21:43 364472 ----a-w- c:\windows\system32\aswBoot.exe
2015-03-20 21:43 . 2015-03-20 21:43 43112 ----a-w- c:\windows\avastSS.scr
2015-03-17 02:46 . 2015-03-23 10:47 -------- d-----w- C:\AdwCleaner
2015-03-16 20:48 . 2004-03-08 11:00 440352 ----a-w- c:\windows\SysWow64\MSHFLXGD.OCX
2015-03-16 20:35 . 2015-01-17 02:48 1067520 ----a-w- c:\windows\system32\msctf.dll
2015-03-16 20:35 . 2015-01-17 02:30 828928 ----a-w- c:\windows\SysWow64\msctf.dll
2015-03-16 20:33 . 2015-02-03 03:12 3209728 ----a-w- c:\windows\SysWow64\mf.dll
2015-03-16 20:32 . 2015-02-03 03:34 693176 ----a-w- c:\windows\system32\winload.efi
2015-03-16 20:31 . 2015-02-03 03:12 374784 ----a-w- c:\windows\SysWow64\AudioEng.dll
2015-03-16 20:30 . 2015-02-03 03:30 17920 ----a-w- c:\windows\system32\appidcertstorecheck.exe
2015-03-16 20:22 . 2015-03-06 05:42 341504 ----a-w- c:\windows\system32\schannel.dll
2015-03-16 20:21 . 2015-03-06 05:10 17408 ----a-w- c:\windows\SysWow64\credssp.dll
2015-03-16 20:21 . 2015-03-06 05:42 28160 ----a-w- c:\windows\system32\secur32.dll
2015-03-16 20:21 . 2015-03-06 05:10 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2015-03-16 20:21 . 2015-03-06 05:09 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2015-03-16 20:21 . 2015-03-06 05:36 686080 ----a-w- c:\windows\system32\adtschema.dll
2015-03-16 20:21 . 2015-03-06 05:06 686080 ----a-w- c:\windows\SysWow64\adtschema.dll
2015-03-16 20:21 . 2015-03-06 05:07 146432 ----a-w- c:\windows\SysWow64\msaudite.dll
2015-03-16 20:21 . 2015-03-06 05:38 146432 ----a-w- c:\windows\system32\msaudite.dll
2015-03-16 20:21 . 2015-03-06 05:39 60416 ----a-w- c:\windows\system32\msobjs.dll
2015-03-16 20:21 . 2015-03-06 05:07 60416 ----a-w- c:\windows\SysWow64\msobjs.dll
2015-03-16 20:17 . 2015-02-03 03:31 1424896 ----a-w- c:\windows\system32\WindowsCodecs.dll
2015-03-16 20:17 . 2015-02-03 03:12 1230848 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2015-03-16 20:17 . 2015-02-20 03:29 372224 ----a-w- c:\windows\system32\atmfd.dll
2015-03-16 20:16 . 2015-02-20 03:09 299008 ----a-w- c:\windows\SysWow64\atmfd.dll
2015-03-16 20:16 . 2015-02-20 04:41 41984 ----a-w- c:\windows\system32\lpk.dll
2015-03-16 20:16 . 2015-02-20 04:40 46080 ----a-w- c:\windows\system32\atmlib.dll
2015-03-16 20:16 . 2015-02-20 04:13 34304 ----a-w- c:\windows\SysWow64\atmlib.dll
2015-03-16 20:16 . 2015-02-20 04:40 14336 ----a-w- c:\windows\system32\dciman32.dll
2015-03-16 20:16 . 2015-02-20 04:13 10240 ----a-w- c:\windows\SysWow64\dciman32.dll
2015-03-16 20:16 . 2015-02-20 04:40 100864 ----a-w- c:\windows\system32\fontsub.dll
2015-03-16 20:16 . 2015-02-20 04:13 70656 ----a-w- c:\windows\SysWow64\fontsub.dll
2015-03-16 20:16 . 2015-02-20 04:12 25600 ----a-w- c:\windows\SysWow64\lpk.dll
2015-03-16 20:16 . 2015-02-13 05:22 14177280 ----a-w- c:\windows\system32\shell32.dll
2015-03-16 20:13 . 2015-02-03 03:31 215552 ----a-w- c:\windows\system32\ubpm.dll
2015-03-16 20:13 . 2015-02-03 03:12 171520 ----a-w- c:\windows\SysWow64\ubpm.dll
2015-03-16 20:13 . 2015-01-31 03:48 3179520 ----a-w- c:\windows\system32\rdpcorets.dll
2015-03-16 20:13 . 2015-01-30 23:56 243200 ----a-w- c:\windows\system32\rdpudd.dll
2015-03-16 20:13 . 2015-01-31 03:48 16384 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
2015-03-16 20:12 . 2015-02-26 03:25 3204096 ----a-w- c:\windows\system32\win32k.sys
2015-03-16 19:52 . 2015-02-04 03:16 465920 ----a-w- c:\windows\system32\WMPhoto.dll
2015-03-16 19:52 . 2015-02-04 02:54 417792 ----a-w- c:\windows\SysWow64\WMPhoto.dll
2015-03-08 07:52 . 2015-03-08 07:52 -------- d-----w- c:\program files (x86)\iTunes
2015-03-08 07:52 . 2015-03-08 07:52 -------- d-----w- c:\program files\iPod
2015-03-08 07:52 . 2015-03-08 07:53 -------- d-----w- c:\programdata\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-03-08 07:52 . 2015-03-08 07:53 -------- d-----w- c:\program files\iTunes
2015-03-05 19:17 . 2015-03-05 19:17 -------- d-----w- c:\program files (x86)\Common Files\Skype
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-03-25 23:46 . 2014-06-06 21:26 136408 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-03-25 23:43 . 2014-06-06 21:25 107736 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2015-03-20 21:43 . 2013-12-29 08:47 136752 ----a-w- c:\windows\system32\drivers\aswStm.sys
2015-03-20 21:43 . 2013-03-13 22:09 268640 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2015-03-20 21:43 . 2009-12-29 20:01 441728 ----a-w- c:\windows\system32\drivers\aswSP.sys
2015-03-20 21:43 . 2014-04-27 03:11 29168 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2015-03-20 21:43 . 2013-03-13 22:09 65736 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2015-03-20 21:43 . 2009-12-29 20:01 88408 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2015-03-20 21:43 . 2012-02-25 08:27 93528 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2015-03-20 21:42 . 2011-03-13 18:00 1047320 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2015-03-16 21:11 . 2009-12-29 12:59 122905848 ----a-w- c:\windows\system32\MRT.exe
2015-03-03 13:17 . 2009-12-29 12:58 295552 ------w- c:\windows\system32\MpSigStub.exe
2015-02-17 02:29 . 2015-02-17 02:29 1247912 ----a-w- c:\windows\SysWow64\FM20.DLL
2015-01-24 07:05 . 2014-11-18 23:42 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2015-01-09 03:14 . 2015-02-11 21:52 91136 ----a-w- c:\windows\system32\wdi.dll
2015-01-09 03:14 . 2015-02-11 21:52 950272 ----a-w- c:\windows\system32\perftrack.dll
2015-01-09 03:14 . 2015-02-11 21:52 29696 ----a-w- c:\windows\system32\powertracker.dll
2015-01-09 02:48 . 2015-02-11 21:52 76800 ----a-w- c:\windows\SysWow64\wdi.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2014-06-24 22:04 131480 ----a-w- c:\users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Remote Control Editor"="c:\program files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe" [2011-11-09 1844296]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2014-10-17 43816]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AMD AVT"="start AMD Accelerated Video Transcoding device initialization" [X]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2010-05-24 265984]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-11-01 1094736]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-06 419112]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-10-05 181480]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2015-02-12 60712]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-04-05 641664]
"AvastUI.exe"="c:\program files\Alwil Software\Avast5\AvastUI.exe" [2015-03-20 5511352]
"RegKillElbyCheck"="c:\program files (x86)\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe" [2002-11-02 45056]
"RegKillTray"="c:\program files (x86)\Elaborate Bytes\DVD Region Killer\RegKillTray.exe" [2002-11-27 49152]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2013-05-30 96056]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-12-17 508800]
.
c:\users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet 6700\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN39QCRG4M05RQ;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Filecloud.lnk - c:\program files (x86)\Filecloud\bin\agent_gui.exe --config "c:\program files (x86)\Filecloud\conf\config.ini" [2014-6-26 7598264]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableSecureUIAPath"= 1 (0x1)
"SoftwareSASGeneration"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 HsspConfig;HSSP Configuration Module;c:\windows\system32\CfgSrvc.exe;c:\windows\SYSNATIVE\CfgSrvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 Apowersoft_AudioDevice;Apowersoft_AudioDevice;c:\windows\system32\drivers\Apowersoft_AudioDevice.sys;c:\windows\SYSNATIVE\drivers\Apowersoft_AudioDevice.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]
R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbfake.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 MODRC;Cinergy DT USB XS Diversity IR Service;c:\windows\system32\DRIVERS\modrc.sys;c:\windows\SYSNATIVE\DRIVERS\modrc.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RegKill;RegKill;c:\windows\system32\Drivers\RegKill.sys;c:\windows\SYSNATIVE\Drivers\RegKill.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x]
R3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\DRIVERS\ssadserd.sys;c:\windows\SYSNATIVE\DRIVERS\ssadserd.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796};Power Control [2009/11/14 09:27];c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl;c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 Apple Mobile Device Service;Apple Mobile Device Service;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe;c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe;c:\program files (x86)\Acer\Registration\GregHSRW.exe [x]
S2 HPSupportSolutionsFrameworkService;HP Support Solutions Framework Service;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe;c:\program files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
S2 pcCMService64;pcCMService64;c:\program files\Common Files\Motive\pcCMService.exe;c:\program files\Common Files\Motive\pcCMService.exe [x]
S2 pcServiceHost;pcServiceHost;c:\program files\Common Files\Motive\pcServiceHost.exe;c:\program files\Common Files\Motive\pcServiceHost.exe [x]
S2 SyncedTool;Filecloud Service;c:\program files (x86)\Filecloud\bin\agent_service.exe ;c:\program files (x86)\Filecloud\bin\agent_service.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW76.sys;c:\windows\SYSNATIVE\drivers\AtihdW76.sys [x]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-03-21 21:07 1061704 ----a-w- c:\program files (x86)\Google\Chrome\Application\41.0.2272.101\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-07 21:22]
.
2015-03-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-07 21:22]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
@="{8BA85C75-763B-4103-94EB-9470F12FE0F7}"
[HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
2015-01-21 02:03 2334928 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
@="{CD55129A-B1A1-438E-A425-CEBC7DC684EE}"
[HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
2015-01-21 02:03 2334928 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
@="{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}"
[HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
2015-01-21 02:03 2334928 ----a-w- c:\progra~1\MICROS~2\Office15\GROOVEEX.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2015-03-20 21:43 722400 ----a-w- c:\program files\Alwil Software\Avast5\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AnchorOverlayAttention]
@="{40D1DAA7-9CB5-4DB7-8610-A814EDB003A5}"
[HKEY_CLASSES_ROOT\CLSID\{40D1DAA7-9CB5-4DB7-8610-A814EDB003A5}]
2015-02-26 18:44 4184248 ----a-w- c:\program files (x86)\Filecloud\bin\x64\anchoroverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AnchorOverlayLockedSynced]
@="{5B05543A-73D8-4D80-97F9-13F471224DD8}"
[HKEY_CLASSES_ROOT\CLSID\{5B05543A-73D8-4D80-97F9-13F471224DD8}]
2015-02-26 18:44 4184248 ----a-w- c:\program files (x86)\Filecloud\bin\x64\anchoroverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AnchorOverlayLockedSyncing]
@="{1C514AC9-A6B4-4692-A18E-9A2EE0B4E277}"
[HKEY_CLASSES_ROOT\CLSID\{1C514AC9-A6B4-4692-A18E-9A2EE0B4E277}]
2015-02-26 18:44 4184248 ----a-w- c:\program files (x86)\Filecloud\bin\x64\anchoroverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AnchorOverlaySynced]
@="{56E89524-684C-4352-B350-F97A7377DD64}"
[HKEY_CLASSES_ROOT\CLSID\{56E89524-684C-4352-B350-F97A7377DD64}]
2015-02-26 18:44 4184248 ----a-w- c:\program files (x86)\Filecloud\bin\x64\anchoroverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AnchorOverlaySyncing]
@="{C6B3FD8D-C629-4A7F-AF73-9ABB59AF029D}"
[HKEY_CLASSES_ROOT\CLSID\{C6B3FD8D-C629-4A7F-AF73-9ABB59AF029D}]
2015-02-26 18:44 4184248 ----a-w- c:\program files (x86)\Filecloud\bin\x64\anchoroverlay.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 8060960]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-11-14 200704]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-09-30 823840]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"tcnz_McciTrayApp"="c:\program files\tcnz\pcTrayApp.exe" [2013-07-25 2782720]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-01-29 1332296]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2015-02-12 169768]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.spiegel.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
Trusted Zone: agentware.net
Trusted Zone: rundumsorglos.net\mail
Trusted Zone: sabre.com
TCP: DhcpNameServer = 192.168.1.254 0.0.0.0
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files (x86)\Common Files\microsoft shared\OFFICE15\MSOXMLMF.DLL
DPF: {2D36AF92-04D3-11D8-B719-0000865F231B} - hxxps://my.sabre.com/jars/TMinReqX.dll
FF - ProfilePath - c:\users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\532md588.default-1422251137045\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
ShellIconOverlayIdentifiers-{23939489-8B41-45ec-90F3-BD36A9644006} - (no file)
ShellIconOverlayIdentifiers-{23939488-8B41-45ec-90F3-BD36A9644006} - (no file)
HKLM-Run-mwlDaemon - c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Open Systems Client - c:\windows\ISUN0407.EXE
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\SecuROM\License information*]
"datasecu"=hex:c4,50,f1,5a,26,4a,68,6f,ea,47,94,2e,b0,09,0d,c3,65,b7,b2,40,e3,
5c,e5,c6,ee,90,31,06,4d,74,b9,63,8d,4a,ad,4d,7e,a4,3a,09,4a,ba,b3,77,35,6d,\
"rkeysecu"=hex:15,6c,01,a7,f3,08,cc,a5,1f,4f,d9,17,3b,e9,80,0a
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-03-27 12:28:31
ComboFix-quarantined-files.txt 2015-03-26 23:28
.
Vor Suchlauf: 22 Verzeichnis(se), 34.074.013.696 Bytes frei
Nach Suchlauf: 24 Verzeichnis(se), 33.853.222.912 Bytes frei
.
- - End Of File - - EA4A18DBE3CB481B34A9BFA15D6808C0
5C616939100B85E558DA92B899A0FC36
Kermit |
|
27.03.2015, 19:26
| #8 |
| /// the machine /// TB-Ausbilder | Bei Installation Adobe Flash Player Virus eingefangen... Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
28.03.2015, 20:33
| #9 |
| | Bei Installation Adobe Flash Player Virus eingefangen... Hallo Schrauber, anbei die gewünschten Logs... Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlauf Datum: 28.03.2015 Suchlauf-Zeit: 11:11:54 Logdatei: mbam.txt Administrator: Ja Version: 2.01.4.1018 Malware Datenbank: v2015.03.27.10 Rootkit Datenbank: v2015.03.26.01 Lizenz: Kostenlos Malware Schutz: Deaktiviert Bösartiger Webseiten Schutz: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x64 Dateisystem: NTFS Benutzer: Heiko Suchlauf-Art: Bedrohungs-Suchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 530861 Verstrichene Zeit: 35 Min, 3 Sek Speicher: Aktiviert Autostart: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (Keine schädliche Elemente gefunden) Module: 0 (Keine schädliche Elemente gefunden) Registrierungsschlüssel: 0 (Keine schädliche Elemente gefunden) Registrierungswerte: 0 (Keine schädliche Elemente gefunden) Registrierungsdaten: 0 (Keine schädliche Elemente gefunden) Ordner: 0 (Keine schädliche Elemente gefunden) Dateien: 0 (Keine schädliche Elemente gefunden) Physische Sektoren: 0 (Keine schädliche Elemente gefunden) (end) Code:
ATTFilter # AdwCleaner v4.113 - Bericht erstellt 28/03/2015 um 13:47:06
# Aktualisiert 22/03/2015 von Xplode
# Datenbank : 2015-03-27.1 [Server]
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (x64)
# Benutzername : Heiko - HEIKO-NOTEBOOK
# Gestarted von : C:\Users\Heiko\Desktop\adwcleaner_4.113.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Geplante Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
***** [ Internetbrowser ] *****
-\\ Internet Explorer v11.0.9600.17689
-\\ Mozilla Firefox v36.0.4 (x86 de)
-\\ Google Chrome v41.0.2272.101
*************************
AdwCleaner[R0].txt - [1225 Bytes] - [17/03/2015 15:46:36]
AdwCleaner[R1].txt - [1850 Bytes] - [23/03/2015 23:40:20]
AdwCleaner[R2].txt - [1070 Bytes] - [28/03/2015 11:50:32]
AdwCleaner[R3].txt - [1130 Bytes] - [28/03/2015 13:17:21]
AdwCleaner[S0].txt - [1457 Bytes] - [17/03/2015 18:55:31]
AdwCleaner[S1].txt - [1731 Bytes] - [23/03/2015 23:47:21]
AdwCleaner[S2].txt - [1053 Bytes] - [28/03/2015 13:47:06]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1112 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.6 (03.22.2015:1)
OS: Windows 7 Home Premium x64
Ran by Heiko on 28.03.2015 at 13:58:35,64
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
Successfully deleted: [File] "C:\Windows\wininit.ini"
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\flexnet"
Successfully deleted: [Folder] "C:\Users\Heiko\AppData\Roaming\flexnet"
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 28.03.2015 at 14:05:00,97
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Heiko (administrator) on HEIKO-NOTEBOOK on 29-03-2015 08:28:37
Running from C:\Users\Heiko\Desktop
Loaded Profiles: Heiko (Available profiles: Heiko & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcServiceHost.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Alcatel-Lucent) C:\Program Files\tcnz\pcTrayApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_gui.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-14] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-10-01] (Acer Incorporated)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-02] (Microsoft Corporation)
HKLM\...\Run: [tcnz_McciTrayApp] => C:\Program Files\tcnz\pcTrayApp.exe [2782720 2013-07-26] (Alcatel-Lucent)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-05-24] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-07] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-06] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-27] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-28] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] ()
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5511352 2015-03-21] (Avast Software s.r.o.)
HKLM-x32\...\Run: [RegKillElbyCheck] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG)
HKLM-x32\...\Run: [RegKillTray] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\RegKillTray.exe [49152 2002-11-28] (Elaborate Bytes)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [Remote Control Editor] => C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1844296 2011-11-10] (Elgato Systems)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> c:\windows\system32\ACER.SCR [438272 2009-07-08] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Filecloud.lnk
ShortcutTarget: Filecloud.lnk -> C:\Program Files (x86)\Filecloud\bin\agent_gui.exe (eFolder)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileModified] -> {23939489-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileSuccess] -> {23939488-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [AnchorOverlayAttention] -> {40D1DAA7-9CB5-4DB7-8610-A814EDB003A5} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSynced] -> {5B05543A-73D8-4D80-97F9-13F471224DD8} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSyncing] -> {1C514AC9-A6B4-4692-A18E-9A2EE0B4E277} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySynced] -> {56E89524-684C-4352-B350-F97A7377DD64} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySyncing] -> {C6B3FD8D-C629-4A7F-AF73-9ABB59AF029D} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-03-21] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-03-21] (Avast Software s.r.o.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll [2011-06-25] (TerraTec Electronic GmbH)
DPF: HKLM-x32 {2D36AF92-04D3-11D8-B719-0000865F231B} https://my.sabre.com/jars/TMinReqX.dll
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-04-09] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 0.0.0.0
FireFox:
========
FF ProfilePath: C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\532md588.default-1422251137045
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Windows\system32\TVUAx\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-11] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-10-26] (Apple Inc.)
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-03-22]
FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\mcciwbch@motive.com.xpi [2015-03-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-14]
Chrome:
=======
CHR Profile: C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-08]
CHR Extension: (Google Drive) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-08]
CHR Extension: (YouTube) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-08]
CHR Extension: (Google Search) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-08]
CHR Extension: (Motive Extension) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec [2014-03-12]
CHR Extension: (Avast Online Security) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-10]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17]
CHR Extension: (Google Wallet) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-08]
CHR Extension: (Gmail) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-08]
CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2014-03-12]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-03-18]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-03-21] (Avast Software s.r.o.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe [37176 2014-04-15] (The OpenVPN Project)
R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 pcServiceHost; C:\Program Files\Common Files\Motive\pcServiceHost.exe [342528 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SyncedTool; C:\Program Files (x86)\Filecloud\bin\agent_service.exe [8190648 2015-02-27] (eFolder)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HsspConfig; C:\Windows\system32\CfgSrvc.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31968 2012-10-08] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-21] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-21] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-21] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-21] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-21] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [441728 2015-03-21] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-21] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [268640 2015-03-21] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2010-12-30] ()
S2 ElbyCDIO; C:\Windows\SysWOW64\Drivers\ElbyCDIO.sys [16320 2002-11-30] (Elaborate Bytes AG) [File not signed]
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-30] (Huawei Technologies Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-12-30] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [631360 2009-11-17] (DiBcom SA)
S3 MODRC; C:\Windows\System32\DRIVERS\modrc.sys [23744 2009-11-17] (DiBcom S.A.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 RegKill; C:\Windows\SysWOW64\Drivers\RegKill.sys [6400 2002-11-28] (Elaborate Bytes) [File not signed]
S3 StarOpen; No ImagePath
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [146928 2009-10-06] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-28 14:05 - 2015-03-28 14:05 - 00000814 _____ () C:\Users\Heiko\Desktop\JRT.txt
2015-03-28 13:56 - 2015-03-28 13:57 - 01388782 _____ (Thisisu) C:\Users\Heiko\Desktop\JRT.exe
2015-03-28 13:54 - 2015-03-28 13:54 - 00001192 _____ () C:\Users\Heiko\Desktop\AdwCleaner[S2].txt
2015-03-28 11:49 - 2015-03-28 11:49 - 00001207 _____ () C:\Users\Heiko\Desktop\mbam.txt
2015-03-28 11:07 - 2015-03-28 11:09 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Heiko\Desktop\mbam-setup-2.1.4.1018.exe
2015-03-27 12:39 - 2015-03-27 12:39 - 00028301 _____ () C:\Users\Heiko\Desktop\combofix.txt
2015-03-27 12:28 - 2015-03-27 12:28 - 00028301 _____ () C:\ComboFix.txt
2015-03-27 12:06 - 2015-03-27 12:28 - 00000000 ____D () C:\Qoobox
2015-03-27 12:06 - 2011-06-26 19:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-27 12:06 - 2010-11-08 06:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-27 12:06 - 2009-04-20 17:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-27 11:58 - 2015-03-27 11:58 - 00276216 _____ () C:\Windows\Minidump\032715-36629-01.dmp
2015-03-27 11:55 - 2015-03-27 11:56 - 05615749 ____R (Swearware) C:\Users\Heiko\Desktop\ComboFix.exe
2015-03-26 14:05 - 2015-03-26 14:05 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Heiko\Desktop\tdsskiller.exe
2015-03-26 12:46 - 2015-03-26 14:03 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-26 12:43 - 2015-03-26 14:03 - 00000000 ____D () C:\Users\Heiko\Desktop\mbar
2015-03-26 12:40 - 2015-03-26 12:42 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Heiko\Desktop\mbar-1.09.1.1004.exe
2015-03-24 21:59 - 2015-03-24 22:01 - 00003356 _____ () C:\Users\Heiko\Desktop\Anti malwarebyte1.txt
2015-03-24 21:58 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Desktop\gmer.txt
2015-03-24 21:57 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Documents\gmer.txt
2015-03-24 21:42 - 2015-03-24 21:43 - 00044339 _____ () C:\Users\Heiko\Desktop\Addition.txt
2015-03-24 21:41 - 2015-03-29 08:28 - 00027495 _____ () C:\Users\Heiko\Desktop\FRST.txt
2015-03-24 21:41 - 2015-03-29 08:28 - 00000000 ____D () C:\FRST
2015-03-24 21:40 - 2015-03-24 21:40 - 00000472 _____ () C:\Users\Heiko\Desktop\defogger_disable.log
2015-03-24 21:40 - 2015-03-24 21:40 - 00000000 _____ () C:\Users\Heiko\defogger_reenable
2015-03-24 21:38 - 2015-03-24 21:39 - 00380416 _____ () C:\Users\Heiko\Desktop\Gmer-19357.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 02095616 _____ (Farbar) C:\Users\Heiko\Desktop\FRST64.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 01135104 _____ (Farbar) C:\Users\Heiko\Desktop\FRST.exe
2015-03-24 21:37 - 2015-03-24 21:37 - 00050477 _____ () C:\Users\Heiko\Desktop\Defogger.exe
2015-03-24 09:18 - 2015-03-24 09:20 - 00014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-24 00:02 - 2015-03-24 00:02 - 00276016 _____ () C:\Windows\Minidump\032415-22682-01.dmp
2015-03-23 20:56 - 2015-03-28 11:49 - 02168320 _____ () C:\Users\Heiko\Desktop\adwcleaner_4.113.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Opera Software
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Opera Software
2015-03-23 20:23 - 2015-03-23 20:27 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-22 10:41 - 2015-03-22 10:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-21 10:43 - 2015-03-21 10:43 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-03-21 10:43 - 2015-03-21 10:43 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-03-21 10:33 - 2015-03-21 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-03-17 15:46 - 2015-03-28 13:47 - 00000000 ____D () C:\AdwCleaner
2015-03-17 09:48 - 2004-03-09 00:00 - 00440352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSHFLXGD.OCX
2015-03-17 09:35 - 2015-01-17 15:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-17 09:35 - 2015-01-17 15:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-17 09:34 - 2015-02-24 16:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-17 09:34 - 2015-02-24 15:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-17 09:34 - 2015-02-21 14:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-17 09:34 - 2015-02-21 13:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-17 09:34 - 2015-02-21 13:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-17 09:34 - 2015-02-21 12:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-17 09:34 - 2015-02-21 12:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-17 09:34 - 2015-02-20 16:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 16:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-17 09:34 - 2015-02-20 15:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-17 09:34 - 2015-02-20 15:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-17 09:34 - 2015-02-20 15:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 15:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-17 09:34 - 2015-02-20 15:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 15:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-17 09:34 - 2015-02-20 15:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-17 09:34 - 2015-02-20 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 15:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-17 09:34 - 2015-02-20 15:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 15:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-17 09:34 - 2015-02-20 15:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-17 09:34 - 2015-02-20 14:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 14:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-17 09:34 - 2015-02-20 14:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-17 09:34 - 2015-02-20 14:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 14:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-17 09:34 - 2015-02-20 14:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-17 09:34 - 2015-02-20 14:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-17 09:34 - 2015-02-20 14:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-17 09:34 - 2015-02-20 14:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-17 09:34 - 2015-02-20 14:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-17 09:34 - 2015-02-20 13:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-17 09:34 - 2015-02-20 13:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-17 09:33 - 2015-02-03 16:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-17 09:33 - 2015-02-03 16:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-17 09:33 - 2015-02-03 16:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-17 09:33 - 2015-02-03 16:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-17 09:33 - 2015-02-03 16:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-17 09:32 - 2015-02-03 16:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-17 09:32 - 2015-02-03 16:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-17 09:32 - 2015-02-03 16:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-17 09:32 - 2015-02-03 16:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-17 09:32 - 2014-11-01 11:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-17 09:31 - 2015-02-03 16:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-17 09:31 - 2015-02-03 16:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-17 09:31 - 2015-02-03 16:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-17 09:30 - 2015-02-03 16:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-17 09:30 - 2015-02-03 16:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 15:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-17 09:22 - 2015-03-06 18:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-17 09:22 - 2015-03-06 18:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-17 09:22 - 2015-03-06 18:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-17 09:22 - 2015-03-06 18:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-17 09:22 - 2015-01-31 12:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-17 09:21 - 2015-03-06 18:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-17 09:21 - 2015-03-06 18:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-17 09:17 - 2015-02-20 16:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-17 09:17 - 2015-02-03 16:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-17 09:17 - 2015-02-03 16:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-17 09:16 - 2015-02-20 17:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-17 09:16 - 2015-02-20 16:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-17 09:16 - 2015-02-13 18:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-17 09:16 - 2015-02-13 18:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-17 09:13 - 2015-02-03 16:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-17 09:13 - 2015-02-03 16:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-17 09:13 - 2015-01-31 12:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-17 09:12 - 2015-02-26 16:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-17 08:52 - 2015-02-04 16:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-17 08:52 - 2015-02-04 15:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-13 09:54 - 2015-03-13 09:54 - 00010484 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2015-03-08 20:53 - 2015-03-08 20:53 - 00001717 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-03-08 20:53 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\Program Files\iTunes
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files\iPod
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-03-06 08:17 - 2015-03-06 08:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-29 08:07 - 2014-01-08 10:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-29 07:58 - 2014-01-08 10:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-29 07:45 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-29 07:45 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-29 07:43 - 2009-11-14 21:24 - 01502971 _____ () C:\Windows\WindowsUpdate.log
2015-03-29 07:37 - 2011-02-25 21:54 - 00126287 _____ () C:\Windows\setupact.log
2015-03-29 07:37 - 2009-07-14 18:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-28 14:11 - 2009-11-15 06:13 - 00703476 _____ () C:\Windows\system32\perfh007.dat
2015-03-28 14:11 - 2009-11-15 06:13 - 00151084 _____ () C:\Windows\system32\perfc007.dat
2015-03-28 14:11 - 2009-07-14 18:13 - 01630508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-28 11:11 - 2014-06-07 10:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-28 11:10 - 2014-11-08 09:15 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-03-28 11:06 - 2015-02-12 18:24 - 00000050 _____ () C:\Windows\astplus.ini
2015-03-27 13:04 - 2014-02-06 09:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-03-27 12:40 - 2011-02-25 21:54 - 00258046 _____ () C:\Windows\PFRO.log
2015-03-27 12:23 - 2009-07-14 15:34 - 00000292 _____ () C:\Windows\system.ini
2015-03-27 11:58 - 2015-01-29 18:08 - 645570586 _____ () C:\Windows\MEMORY.DMP
2015-03-27 11:58 - 2011-11-29 23:20 - 00000000 ____D () C:\Windows\Minidump
2015-03-27 11:57 - 2014-02-03 23:04 - 00000000 ____D () C:\Windows\erdnt
2015-03-26 12:32 - 2009-10-29 06:36 - 00000000 ____D () C:\Windows\oem
2015-03-24 21:40 - 2009-12-30 01:44 - 00000000 ____D () C:\Users\Heiko
2015-03-24 21:29 - 2014-02-07 14:05 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\BitTorrent
2015-03-24 09:21 - 2014-11-19 15:35 - 00000000 ____D () C:\Users\Heiko\Documents\Outlook Files
2015-03-24 09:21 - 2009-07-14 18:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-03-24 09:18 - 2009-12-31 04:56 - 00000000 ____D () C:\Program Files\Zubehör
2015-03-24 09:17 - 2010-04-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Zattoo4
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-03-23 23:34 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\Web
2015-03-23 20:53 - 2014-08-18 10:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Adobe
2015-03-23 20:27 - 2009-12-30 01:45 - 00001429 _____ () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-23 20:07 - 2009-07-14 18:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-23 20:06 - 2012-05-09 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-22 22:25 - 2009-12-30 06:37 - 00002358 ____H () C:\Users\Heiko\Documents\Default.rdp
2015-03-22 20:18 - 2014-02-01 18:03 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-22 07:24 - 2013-10-07 10:39 - 00000000 ____D () C:\Users\Gast
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\registration
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\AppCompat
2015-03-21 10:43 - 2014-04-27 16:11 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-03-21 10:43 - 2013-12-29 21:47 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00268640 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-03-21 10:43 - 2012-02-25 21:27 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00441728 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-03-21 10:42 - 2011-03-14 07:00 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-03-21 10:40 - 2009-07-14 18:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-03-21 10:33 - 2014-11-22 08:27 - 00001897 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-03-17 18:55 - 2014-04-24 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Computer Troubleshooters Calling Card
2015-03-17 12:29 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\rescache
2015-03-17 10:54 - 2009-07-14 17:45 - 00450496 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-17 10:45 - 2009-10-29 18:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-17 10:28 - 2014-04-24 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-03-17 10:28 - 2009-07-14 15:34 - 00000510 _____ () C:\Windows\win.ini
2015-03-17 10:26 - 2013-07-11 18:58 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-17 10:11 - 2009-12-30 01:59 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-17 09:48 - 2015-02-12 18:24 - 00001751 _____ () C:\Users\Public\Desktop\Astroplus.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00001741 _____ () C:\Users\Public\Desktop\Astroplus (classic Design).lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000872 _____ () C:\Users\Public\Desktop\Planetary Hours.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astrocontact Astroplus
2015-03-17 06:15 - 2014-06-07 10:25 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-17 06:15 - 2014-06-07 10:25 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-17 06:15 - 2014-01-24 00:04 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-13 11:37 - 2014-11-05 20:06 - 00000000 ____D () C:\Users\Heiko\.gimp-2.8
2015-03-13 09:54 - 2014-11-05 20:21 - 00000000 ____D () C:\Users\Heiko\AppData\Local\gtk-2.0
2015-03-08 20:52 - 2010-09-23 09:08 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-03-06 21:40 - 2010-01-04 19:57 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2015-03-06 08:17 - 2014-03-01 21:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ____D () C:\ProgramData\Skype
2015-03-05 12:53 - 2009-07-14 18:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-04 02:17 - 2009-12-30 01:58 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-28 16:20 - 2014-06-26 19:33 - 00000000 ____D () C:\Program Files (x86)\Filecloud
==================== Files in the root of some directories =======
2010-01-27 08:43 - 2010-01-27 08:43 - 0000034 _____ () C:\Users\Heiko\AppData\Roaming\pcouffin.log
2010-01-27 08:42 - 2010-01-27 08:42 - 0082816 _____ (VSO Software) C:\Users\Heiko\AppData\Roaming\pcouffin.sys
2010-01-17 01:40 - 2010-01-17 01:40 - 0003584 _____ () C:\Users\Heiko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-27 03:38 - 2013-10-27 03:38 - 0004096 ____H () C:\Users\Heiko\AppData\Local\keyfile3.drm
2015-03-24 09:18 - 2015-03-24 09:20 - 0014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-13 09:54 - 2015-03-13 09:54 - 0010484 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2010-06-11 23:01 - 2013-12-30 08:25 - 0017408 _____ () C:\Users\Heiko\AppData\Local\WebpageIcons.db
2014-01-08 21:39 - 2014-01-08 21:39 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-11-14 21:25 - 2009-11-14 21:28 - 0008308 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-01-04 19:59 - 2010-01-04 19:59 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-10-29 18:58 - 2009-07-18 14:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
Some content of TEMP:
====================
C:\Users\Heiko\AppData\Local\Temp\Quarantine.exe
C:\Users\Heiko\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-25 00:14
==================== End Of Log ============================
Viele Gruesse Kermit |
|
29.03.2015, 09:43
| #10 |
| /// the machine /// TB-Ausbilder | Bei Installation Adobe Flash Player Virus eingefangen...ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
30.03.2015, 04:39
| #11 |
| | Bei Installation Adobe Flash Player Virus eingefangen... Hallo Schrauber, der Eset online scanner hatte ein paar Funde (die bisher nicht gefixt wurden). Und die "Acer" Warnmeldung (siehe attachment vom ersten Beitrag) popt immer noch alle paar Stunden auf. Eset Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=8031cfc97fb8074ba752a7924163dc83
# engine=23142
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-30 02:25:07
# local_time=2015-03-30 03:25:07 (+1200, Neuseeland Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 3994105 49874301 0 0
# scanned=347621
# found=5
# cleaned=0
# scan_time=14381
sh=485AFD64F09BFCEDD16BEFFE2B3130C493793446 ft=1 fh=4d4bd8b8b7188621 vn="Win32/Verti.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Heiko\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\80IOPKV4\StormWatchSetup[1].exe"
sh=5CED10009F50C650B85D1899677D5D6CADE1FAD0 ft=1 fh=c240816dcf7e5bc8 vn="Win32/BrowseFox.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Heiko\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HMP93XLB\AirGlobeSetup[1].exe"
sh=4EB73C0D59F388086502C5ED862B47291512C2BA ft=1 fh=74559f4ab8dbc80b vn="Variante von MSIL/Rebrand.LittleRegClean.B evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Heiko\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HMP93XLB\ProPCCleaner_1712[1].exe"
sh=C3FAC857E49860697E728266C75F6B0B06FDABEA ft=1 fh=8bc7a344f769545b vn="Variante von Win32/ELEX.CE evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Heiko\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y0BM4D31\obw_omniboxes[1].exe"
sh=320F08D77850B765EF27CD217381C03EB0EFB190 ft=0 fh=0000000000000000 vn="Variante von Win32/Systweak.L evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\Installer\569b79.msi"
Code:
ATTFilter Results of screen317's Security Check version 0.99.97
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials
avast! Antivirus
Antivirus up to date! (On Access scanning disabled!)
`````````Anti-malware/Other Utilities Check:`````````
SpywareBlaster 5.0
Java 7 Update 51
Java 8 Update 25
Java 8 Update 31
Java version 32-bit out of Date!
Java 64-bit 8 Update 31
Adobe Flash Player 17.0.0.134
Adobe Reader XI
Mozilla Firefox (36.0.4)
Google Chrome (41.0.2272.101)
Google Chrome (41.0.2272.89)
````````Process Check: objlist.exe by Laurent````````
Microsoft Security Essentials MSMpEng.exe
Microsoft Security Essentials msseces.exe
Alwil Software Avast5 AvastSvc.exe
Alwil Software Avast5 AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Heiko (administrator) on HEIKO-NOTEBOOK on 30-03-2015 16:14:03
Running from C:\Users\Heiko\Desktop
Loaded Profiles: Heiko (Available profiles: Heiko & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcServiceHost.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Alcatel-Lucent) C:\Program Files\tcnz\pcTrayApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
(Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_gui.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-14] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-10-01] (Acer Incorporated)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-02] (Microsoft Corporation)
HKLM\...\Run: [tcnz_McciTrayApp] => C:\Program Files\tcnz\pcTrayApp.exe [2782720 2013-07-26] (Alcatel-Lucent)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-05-24] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-07] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-06] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-27] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-28] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] ()
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5511352 2015-03-21] (Avast Software s.r.o.)
HKLM-x32\...\Run: [RegKillElbyCheck] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG)
HKLM-x32\...\Run: [RegKillTray] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\RegKillTray.exe [49152 2002-11-28] (Elaborate Bytes)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [Remote Control Editor] => C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1844296 2011-11-10] (Elgato Systems)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> c:\windows\system32\ACER.SCR [438272 2009-07-08] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Filecloud.lnk
ShortcutTarget: Filecloud.lnk -> C:\Program Files (x86)\Filecloud\bin\agent_gui.exe (eFolder)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileModified] -> {23939489-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileSuccess] -> {23939488-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [AnchorOverlayAttention] -> {40D1DAA7-9CB5-4DB7-8610-A814EDB003A5} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSynced] -> {5B05543A-73D8-4D80-97F9-13F471224DD8} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSyncing] -> {1C514AC9-A6B4-4692-A18E-9A2EE0B4E277} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySynced] -> {56E89524-684C-4352-B350-F97A7377DD64} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySyncing] -> {C6B3FD8D-C629-4A7F-AF73-9ABB59AF029D} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-03-21] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-03-21] (Avast Software s.r.o.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll [2011-06-25] (TerraTec Electronic GmbH)
DPF: HKLM-x32 {2D36AF92-04D3-11D8-B719-0000865F231B} https://my.sabre.com/jars/TMinReqX.dll
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-04-09] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 0.0.0.0
FireFox:
========
FF ProfilePath: C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\532md588.default-1422251137045
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Windows\system32\TVUAx\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-11] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-10-26] (Apple Inc.)
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-03-22]
FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\mcciwbch@motive.com.xpi [2015-03-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-14]
Chrome:
=======
CHR Profile: C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-08]
CHR Extension: (Google Drive) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-08]
CHR Extension: (YouTube) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-08]
CHR Extension: (Google Search) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-08]
CHR Extension: (Motive Extension) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec [2014-03-12]
CHR Extension: (Avast Online Security) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-10]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17]
CHR Extension: (Google Wallet) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-08]
CHR Extension: (Gmail) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-08]
CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2014-03-12]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-03-18]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-03-21] (Avast Software s.r.o.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe [37176 2014-04-15] (The OpenVPN Project)
R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 pcServiceHost; C:\Program Files\Common Files\Motive\pcServiceHost.exe [342528 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SyncedTool; C:\Program Files (x86)\Filecloud\bin\agent_service.exe [8190648 2015-02-27] (eFolder)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HsspConfig; C:\Windows\system32\CfgSrvc.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31968 2012-10-08] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-21] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-21] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-21] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-21] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-21] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [441728 2015-03-21] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-21] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [268640 2015-03-21] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2010-12-30] ()
S2 ElbyCDIO; C:\Windows\SysWOW64\Drivers\ElbyCDIO.sys [16320 2002-11-30] (Elaborate Bytes AG) [File not signed]
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-30] (Huawei Technologies Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-12-30] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [631360 2009-11-17] (DiBcom SA)
S3 MODRC; C:\Windows\System32\DRIVERS\modrc.sys [23744 2009-11-17] (DiBcom S.A.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 RegKill; C:\Windows\SysWOW64\Drivers\RegKill.sys [6400 2002-11-28] (Elaborate Bytes) [File not signed]
S3 StarOpen; No ImagePath
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [146928 2009-10-06] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-30 16:13 - 2015-03-30 16:13 - 00001172 _____ () C:\Users\Heiko\Desktop\checkup.txt
2015-03-30 16:09 - 2015-03-30 16:09 - 00852604 _____ () C:\Users\Heiko\Desktop\SecurityCheck.exe
2015-03-30 16:08 - 2015-03-30 15:25 - 00001914 _____ () C:\Users\Heiko\Desktop\eset.txt
2015-03-30 11:21 - 2015-03-30 11:21 - 00000000 ____D () C:\Program Files (x86)\ESET
2015-03-30 11:20 - 2015-03-30 11:20 - 02347384 _____ (ESET) C:\Users\Heiko\Desktop\esetsmartinstaller_deu.exe
2015-03-28 14:05 - 2015-03-28 14:05 - 00000814 _____ () C:\Users\Heiko\Desktop\JRT.txt
2015-03-28 13:56 - 2015-03-28 13:57 - 01388782 _____ (Thisisu) C:\Users\Heiko\Desktop\JRT.exe
2015-03-28 13:54 - 2015-03-28 13:54 - 00001192 _____ () C:\Users\Heiko\Desktop\AdwCleaner[S2].txt
2015-03-28 11:49 - 2015-03-28 11:49 - 00001207 _____ () C:\Users\Heiko\Desktop\mbam.txt
2015-03-28 11:07 - 2015-03-28 11:09 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Heiko\Desktop\mbam-setup-2.1.4.1018.exe
2015-03-27 12:39 - 2015-03-27 12:39 - 00028301 _____ () C:\Users\Heiko\Desktop\combofix.txt
2015-03-27 12:28 - 2015-03-27 12:28 - 00028301 _____ () C:\ComboFix.txt
2015-03-27 12:06 - 2015-03-27 12:28 - 00000000 ____D () C:\Qoobox
2015-03-27 12:06 - 2011-06-26 19:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-27 12:06 - 2010-11-08 06:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-27 12:06 - 2009-04-20 17:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-27 11:58 - 2015-03-27 11:58 - 00276216 _____ () C:\Windows\Minidump\032715-36629-01.dmp
2015-03-27 11:55 - 2015-03-27 11:56 - 05615749 ____R (Swearware) C:\Users\Heiko\Desktop\ComboFix.exe
2015-03-26 14:05 - 2015-03-26 14:05 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Heiko\Desktop\tdsskiller.exe
2015-03-26 12:46 - 2015-03-26 14:03 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-26 12:43 - 2015-03-26 14:03 - 00000000 ____D () C:\Users\Heiko\Desktop\mbar
2015-03-26 12:40 - 2015-03-26 12:42 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Heiko\Desktop\mbar-1.09.1.1004.exe
2015-03-24 21:59 - 2015-03-24 22:01 - 00003356 _____ () C:\Users\Heiko\Desktop\Anti malwarebyte1.txt
2015-03-24 21:58 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Desktop\gmer.txt
2015-03-24 21:57 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Documents\gmer.txt
2015-03-24 21:42 - 2015-03-24 21:43 - 00044339 _____ () C:\Users\Heiko\Desktop\Addition.txt
2015-03-24 21:41 - 2015-03-30 16:14 - 00027495 _____ () C:\Users\Heiko\Desktop\FRST.txt
2015-03-24 21:41 - 2015-03-30 16:14 - 00000000 ____D () C:\FRST
2015-03-24 21:40 - 2015-03-24 21:40 - 00000472 _____ () C:\Users\Heiko\Desktop\defogger_disable.log
2015-03-24 21:40 - 2015-03-24 21:40 - 00000000 _____ () C:\Users\Heiko\defogger_reenable
2015-03-24 21:38 - 2015-03-24 21:39 - 00380416 _____ () C:\Users\Heiko\Desktop\Gmer-19357.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 02095616 _____ (Farbar) C:\Users\Heiko\Desktop\FRST64.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 01135104 _____ (Farbar) C:\Users\Heiko\Desktop\FRST.exe
2015-03-24 21:37 - 2015-03-24 21:37 - 00050477 _____ () C:\Users\Heiko\Desktop\Defogger.exe
2015-03-24 09:18 - 2015-03-24 09:20 - 00014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-24 00:02 - 2015-03-24 00:02 - 00276016 _____ () C:\Windows\Minidump\032415-22682-01.dmp
2015-03-23 20:56 - 2015-03-28 11:49 - 02168320 _____ () C:\Users\Heiko\Desktop\adwcleaner_4.113.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Opera Software
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Opera Software
2015-03-23 20:23 - 2015-03-23 20:27 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-22 10:41 - 2015-03-22 10:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-21 10:43 - 2015-03-21 10:43 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-03-21 10:43 - 2015-03-21 10:43 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-03-21 10:33 - 2015-03-21 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-03-17 15:46 - 2015-03-28 13:47 - 00000000 ____D () C:\AdwCleaner
2015-03-17 09:48 - 2004-03-09 00:00 - 00440352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSHFLXGD.OCX
2015-03-17 09:35 - 2015-01-17 15:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-17 09:35 - 2015-01-17 15:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-17 09:34 - 2015-02-24 16:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-17 09:34 - 2015-02-24 15:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-17 09:34 - 2015-02-21 14:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-17 09:34 - 2015-02-21 13:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-17 09:34 - 2015-02-21 13:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-17 09:34 - 2015-02-21 12:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-17 09:34 - 2015-02-21 12:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-17 09:34 - 2015-02-20 16:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 16:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-17 09:34 - 2015-02-20 15:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-17 09:34 - 2015-02-20 15:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-17 09:34 - 2015-02-20 15:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 15:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-17 09:34 - 2015-02-20 15:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 15:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-17 09:34 - 2015-02-20 15:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-17 09:34 - 2015-02-20 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 15:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-17 09:34 - 2015-02-20 15:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 15:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-17 09:34 - 2015-02-20 15:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-17 09:34 - 2015-02-20 14:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 14:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-17 09:34 - 2015-02-20 14:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-17 09:34 - 2015-02-20 14:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 14:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-17 09:34 - 2015-02-20 14:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-17 09:34 - 2015-02-20 14:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-17 09:34 - 2015-02-20 14:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-17 09:34 - 2015-02-20 14:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-17 09:34 - 2015-02-20 14:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-17 09:34 - 2015-02-20 13:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-17 09:34 - 2015-02-20 13:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-17 09:33 - 2015-02-03 16:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-17 09:33 - 2015-02-03 16:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-17 09:33 - 2015-02-03 16:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-17 09:33 - 2015-02-03 16:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-17 09:33 - 2015-02-03 16:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-17 09:32 - 2015-02-03 16:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-17 09:32 - 2015-02-03 16:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-17 09:32 - 2015-02-03 16:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-17 09:32 - 2015-02-03 16:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-17 09:32 - 2014-11-01 11:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-17 09:31 - 2015-02-03 16:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-17 09:31 - 2015-02-03 16:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-17 09:31 - 2015-02-03 16:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-17 09:30 - 2015-02-03 16:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-17 09:30 - 2015-02-03 16:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 15:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-17 09:22 - 2015-03-06 18:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-17 09:22 - 2015-03-06 18:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-17 09:22 - 2015-03-06 18:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-17 09:22 - 2015-03-06 18:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-17 09:22 - 2015-01-31 12:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-17 09:21 - 2015-03-06 18:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-17 09:21 - 2015-03-06 18:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-17 09:17 - 2015-02-20 16:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-17 09:17 - 2015-02-03 16:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-17 09:17 - 2015-02-03 16:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-17 09:16 - 2015-02-20 17:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-17 09:16 - 2015-02-20 16:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-17 09:16 - 2015-02-13 18:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-17 09:16 - 2015-02-13 18:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-17 09:13 - 2015-02-03 16:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-17 09:13 - 2015-02-03 16:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-17 09:13 - 2015-01-31 12:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-17 09:12 - 2015-02-26 16:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-17 08:52 - 2015-02-04 16:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-17 08:52 - 2015-02-04 15:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-13 09:54 - 2015-03-13 09:54 - 00010484 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2015-03-08 20:53 - 2015-03-08 20:53 - 00001717 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-03-08 20:53 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\Program Files\iTunes
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files\iPod
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-03-06 08:17 - 2015-03-06 08:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-30 16:07 - 2014-01-08 10:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-30 15:07 - 2014-01-08 10:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-30 11:22 - 2009-11-14 21:24 - 01555101 _____ () C:\Windows\WindowsUpdate.log
2015-03-30 11:15 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-30 11:15 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-30 11:12 - 2009-11-15 06:13 - 00703476 _____ () C:\Windows\system32\perfh007.dat
2015-03-30 11:12 - 2009-11-15 06:13 - 00151084 _____ () C:\Windows\system32\perfc007.dat
2015-03-30 11:12 - 2009-07-14 18:13 - 01630508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-30 11:06 - 2011-02-25 21:54 - 00126399 _____ () C:\Windows\setupact.log
2015-03-30 11:06 - 2009-07-14 18:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-28 11:11 - 2014-06-07 10:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-28 11:10 - 2014-11-08 09:15 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-03-28 11:06 - 2015-02-12 18:24 - 00000050 _____ () C:\Windows\astplus.ini
2015-03-27 13:04 - 2014-02-06 09:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-03-27 12:40 - 2011-02-25 21:54 - 00258046 _____ () C:\Windows\PFRO.log
2015-03-27 12:23 - 2009-07-14 15:34 - 00000292 _____ () C:\Windows\system.ini
2015-03-27 11:58 - 2015-01-29 18:08 - 645570586 _____ () C:\Windows\MEMORY.DMP
2015-03-27 11:58 - 2011-11-29 23:20 - 00000000 ____D () C:\Windows\Minidump
2015-03-27 11:57 - 2014-02-03 23:04 - 00000000 ____D () C:\Windows\erdnt
2015-03-26 12:32 - 2009-10-29 06:36 - 00000000 ____D () C:\Windows\oem
2015-03-24 21:40 - 2009-12-30 01:44 - 00000000 ____D () C:\Users\Heiko
2015-03-24 21:29 - 2014-02-07 14:05 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\BitTorrent
2015-03-24 09:21 - 2014-11-19 15:35 - 00000000 ____D () C:\Users\Heiko\Documents\Outlook Files
2015-03-24 09:21 - 2009-07-14 18:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-03-24 09:18 - 2009-12-31 04:56 - 00000000 ____D () C:\Program Files\Zubehör
2015-03-24 09:17 - 2010-04-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Zattoo4
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-03-23 23:34 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\Web
2015-03-23 20:53 - 2014-08-18 10:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Adobe
2015-03-23 20:27 - 2009-12-30 01:45 - 00001429 _____ () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-23 20:07 - 2009-07-14 18:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-23 20:06 - 2012-05-09 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-22 22:25 - 2009-12-30 06:37 - 00002358 ____H () C:\Users\Heiko\Documents\Default.rdp
2015-03-22 20:18 - 2014-02-01 18:03 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-22 07:24 - 2013-10-07 10:39 - 00000000 ____D () C:\Users\Gast
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\registration
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\AppCompat
2015-03-21 10:43 - 2014-04-27 16:11 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-03-21 10:43 - 2013-12-29 21:47 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00268640 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-03-21 10:43 - 2012-02-25 21:27 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00441728 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-03-21 10:42 - 2011-03-14 07:00 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-03-21 10:40 - 2009-07-14 18:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-03-21 10:33 - 2014-11-22 08:27 - 00001897 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-03-17 18:55 - 2014-04-24 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Computer Troubleshooters Calling Card
2015-03-17 12:29 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\rescache
2015-03-17 10:54 - 2009-07-14 17:45 - 00450496 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-17 10:45 - 2009-10-29 18:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-17 10:28 - 2014-04-24 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-03-17 10:28 - 2009-07-14 15:34 - 00000510 _____ () C:\Windows\win.ini
2015-03-17 10:26 - 2013-07-11 18:58 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-17 10:11 - 2009-12-30 01:59 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-17 09:48 - 2015-02-12 18:24 - 00001751 _____ () C:\Users\Public\Desktop\Astroplus.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00001741 _____ () C:\Users\Public\Desktop\Astroplus (classic Design).lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000872 _____ () C:\Users\Public\Desktop\Planetary Hours.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astrocontact Astroplus
2015-03-17 06:15 - 2014-06-07 10:25 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-17 06:15 - 2014-06-07 10:25 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-17 06:15 - 2014-01-24 00:04 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-13 11:37 - 2014-11-05 20:06 - 00000000 ____D () C:\Users\Heiko\.gimp-2.8
2015-03-13 09:54 - 2014-11-05 20:21 - 00000000 ____D () C:\Users\Heiko\AppData\Local\gtk-2.0
2015-03-08 20:52 - 2010-09-23 09:08 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-03-06 21:40 - 2010-01-04 19:57 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2015-03-06 08:17 - 2014-03-01 21:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ____D () C:\ProgramData\Skype
2015-03-05 12:53 - 2009-07-14 18:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-04 02:17 - 2009-12-30 01:58 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-02-28 16:20 - 2014-06-26 19:33 - 00000000 ____D () C:\Program Files (x86)\Filecloud
==================== Files in the root of some directories =======
2010-01-27 08:43 - 2010-01-27 08:43 - 0000034 _____ () C:\Users\Heiko\AppData\Roaming\pcouffin.log
2010-01-27 08:42 - 2010-01-27 08:42 - 0082816 _____ (VSO Software) C:\Users\Heiko\AppData\Roaming\pcouffin.sys
2010-01-17 01:40 - 2010-01-17 01:40 - 0003584 _____ () C:\Users\Heiko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-27 03:38 - 2013-10-27 03:38 - 0004096 ____H () C:\Users\Heiko\AppData\Local\keyfile3.drm
2015-03-24 09:18 - 2015-03-24 09:20 - 0014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-13 09:54 - 2015-03-13 09:54 - 0010484 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2010-06-11 23:01 - 2013-12-30 08:25 - 0017408 _____ () C:\Users\Heiko\AppData\Local\WebpageIcons.db
2014-01-08 21:39 - 2014-01-08 21:39 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-11-14 21:25 - 2009-11-14 21:28 - 0008308 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-01-04 19:59 - 2010-01-04 19:59 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-10-29 18:58 - 2009-07-18 14:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
Some content of TEMP:
====================
C:\Users\Heiko\AppData\Local\Temp\Quarantine.exe
C:\Users\Heiko\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-25 00:14
==================== End Of Log ============================
--- --- --- Viele Grüße Kermit |
|
30.03.2015, 17:14
| #12 |
| /// the machine /// TB-Ausbilder | Bei Installation Adobe Flash Player Virus eingefangen... Alte Java Versionen alle deinstallieren, aktuelle installieren. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Windows\Installer\569b79.msi
AlternateShell: cmd.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 0.0.0.0
Emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Mach bitte mal ein FRST Log wenn die Meldung da ist, und diese dann nicht wegdrücken.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
31.03.2015, 11:29
| #13 |
| | Bei Installation Adobe Flash Player Virus eingefangen... Hallo Schrauber, zuerst schicke ich mal das FRST das ich gemacht habe als die Meldung kam (wobei das Fenster sich automatisch schliesst wenn ich irgendetwas anklicke): FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Heiko (administrator) on HEIKO-NOTEBOOK on 31-03-2015 22:45:41
Running from C:\Users\Heiko\Desktop
Loaded Profiles: Heiko (Available profiles: Heiko & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcServiceHost.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Alcatel-Lucent) C:\Program Files\tcnz\pcTrayApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_gui.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-14] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-10-01] (Acer Incorporated)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-02] (Microsoft Corporation)
HKLM\...\Run: [tcnz_McciTrayApp] => C:\Program Files\tcnz\pcTrayApp.exe [2782720 2013-07-26] (Alcatel-Lucent)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-05-24] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-07] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-06] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-27] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-28] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] ()
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5511352 2015-03-21] (Avast Software s.r.o.)
HKLM-x32\...\Run: [RegKillElbyCheck] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG)
HKLM-x32\...\Run: [RegKillTray] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\RegKillTray.exe [49152 2002-11-28] (Elaborate Bytes)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [Remote Control Editor] => C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1844296 2011-11-10] (Elgato Systems)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> c:\windows\system32\ACER.SCR [438272 2009-07-08] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Filecloud.lnk
ShortcutTarget: Filecloud.lnk -> C:\Program Files (x86)\Filecloud\bin\agent_gui.exe (eFolder)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileModified] -> {23939489-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileSuccess] -> {23939488-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [AnchorOverlayAttention] -> {40D1DAA7-9CB5-4DB7-8610-A814EDB003A5} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSynced] -> {5B05543A-73D8-4D80-97F9-13F471224DD8} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSyncing] -> {1C514AC9-A6B4-4692-A18E-9A2EE0B4E277} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySynced] -> {56E89524-684C-4352-B350-F97A7377DD64} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySyncing] -> {C6B3FD8D-C629-4A7F-AF73-9ABB59AF029D} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-03-21] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-03-21] (Avast Software s.r.o.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll [2011-06-25] (TerraTec Electronic GmbH)
DPF: HKLM-x32 {2D36AF92-04D3-11D8-B719-0000865F231B} https://my.sabre.com/jars/TMinReqX.dll
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-04-09] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 0.0.0.0
FireFox:
========
FF ProfilePath: C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\532md588.default-1422251137045
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Windows\system32\TVUAx\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-11] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-10-26] (Apple Inc.)
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-03-22]
FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\mcciwbch@motive.com.xpi [2015-03-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-14]
Chrome:
=======
CHR Profile: C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-08]
CHR Extension: (Google Drive) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-08]
CHR Extension: (YouTube) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-08]
CHR Extension: (Google Search) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-08]
CHR Extension: (Motive Extension) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec [2014-03-12]
CHR Extension: (Avast Online Security) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-10]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17]
CHR Extension: (Google Wallet) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-08]
CHR Extension: (Gmail) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-08]
CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2014-03-12]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-03-18]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-03-21] (Avast Software s.r.o.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe [37176 2014-04-15] (The OpenVPN Project)
R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 pcServiceHost; C:\Program Files\Common Files\Motive\pcServiceHost.exe [342528 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SyncedTool; C:\Program Files (x86)\Filecloud\bin\agent_service.exe [8190648 2015-02-27] (eFolder)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HsspConfig; C:\Windows\system32\CfgSrvc.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31968 2012-10-08] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-21] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-21] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-21] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-21] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-21] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [441728 2015-03-21] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-21] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [268640 2015-03-21] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2010-12-30] ()
S2 ElbyCDIO; C:\Windows\SysWOW64\Drivers\ElbyCDIO.sys [16320 2002-11-30] (Elaborate Bytes AG) [File not signed]
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-30] (Huawei Technologies Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-12-30] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [631360 2009-11-17] (DiBcom SA)
S3 MODRC; C:\Windows\System32\DRIVERS\modrc.sys [23744 2009-11-17] (DiBcom S.A.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 RegKill; C:\Windows\SysWOW64\Drivers\RegKill.sys [6400 2002-11-28] (Elaborate Bytes) [File not signed]
S3 StarOpen; No ImagePath
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [146928 2009-10-06] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-31 15:00 - 2015-03-31 15:00 - 00007890 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2015-03-30 16:13 - 2015-03-30 16:13 - 00001172 _____ () C:\Users\Heiko\Desktop\checkup.txt
2015-03-30 16:09 - 2015-03-30 16:09 - 00852604 _____ () C:\Users\Heiko\Desktop\SecurityCheck.exe
2015-03-30 16:08 - 2015-03-30 15:25 - 00001914 _____ () C:\Users\Heiko\Desktop\eset.txt
2015-03-30 11:20 - 2015-03-30 11:20 - 02347384 _____ (ESET) C:\Users\Heiko\Desktop\esetsmartinstaller_deu.exe
2015-03-28 14:05 - 2015-03-28 14:05 - 00000814 _____ () C:\Users\Heiko\Desktop\JRT.txt
2015-03-28 13:56 - 2015-03-28 13:57 - 01388782 _____ (Thisisu) C:\Users\Heiko\Desktop\JRT.exe
2015-03-28 13:54 - 2015-03-28 13:54 - 00001192 _____ () C:\Users\Heiko\Desktop\AdwCleaner[S2].txt
2015-03-28 11:49 - 2015-03-28 11:49 - 00001207 _____ () C:\Users\Heiko\Desktop\mbam.txt
2015-03-28 11:07 - 2015-03-28 11:09 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Heiko\Desktop\mbam-setup-2.1.4.1018.exe
2015-03-27 12:39 - 2015-03-27 12:39 - 00028301 _____ () C:\Users\Heiko\Desktop\combofix.txt
2015-03-27 12:28 - 2015-03-27 12:28 - 00028301 _____ () C:\ComboFix.txt
2015-03-27 12:06 - 2015-03-27 12:28 - 00000000 ____D () C:\Qoobox
2015-03-27 12:06 - 2011-06-26 19:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-27 12:06 - 2010-11-08 06:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-27 12:06 - 2009-04-20 17:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-27 11:58 - 2015-03-27 11:58 - 00276216 _____ () C:\Windows\Minidump\032715-36629-01.dmp
2015-03-27 11:55 - 2015-03-27 11:56 - 05615749 ____R (Swearware) C:\Users\Heiko\Desktop\ComboFix.exe
2015-03-26 14:05 - 2015-03-26 14:05 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Heiko\Desktop\tdsskiller.exe
2015-03-26 12:46 - 2015-03-26 14:03 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-26 12:43 - 2015-03-26 14:03 - 00000000 ____D () C:\Users\Heiko\Desktop\mbar
2015-03-26 12:40 - 2015-03-26 12:42 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Heiko\Desktop\mbar-1.09.1.1004.exe
2015-03-24 21:59 - 2015-03-24 22:01 - 00003356 _____ () C:\Users\Heiko\Desktop\Anti malwarebyte1.txt
2015-03-24 21:58 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Desktop\gmer.txt
2015-03-24 21:57 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Documents\gmer.txt
2015-03-24 21:42 - 2015-03-24 21:43 - 00044339 _____ () C:\Users\Heiko\Desktop\Addition.txt
2015-03-24 21:41 - 2015-03-31 22:45 - 00027574 _____ () C:\Users\Heiko\Desktop\FRST.txt
2015-03-24 21:41 - 2015-03-31 22:45 - 00000000 ____D () C:\FRST
2015-03-24 21:40 - 2015-03-24 21:40 - 00000472 _____ () C:\Users\Heiko\Desktop\defogger_disable.log
2015-03-24 21:40 - 2015-03-24 21:40 - 00000000 _____ () C:\Users\Heiko\defogger_reenable
2015-03-24 21:38 - 2015-03-24 21:39 - 00380416 _____ () C:\Users\Heiko\Desktop\Gmer-19357.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 02095616 _____ (Farbar) C:\Users\Heiko\Desktop\FRST64.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 01135104 _____ (Farbar) C:\Users\Heiko\Desktop\FRST.exe
2015-03-24 21:37 - 2015-03-24 21:37 - 00050477 _____ () C:\Users\Heiko\Desktop\Defogger.exe
2015-03-24 09:18 - 2015-03-24 09:20 - 00014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-24 00:02 - 2015-03-24 00:02 - 00276016 _____ () C:\Windows\Minidump\032415-22682-01.dmp
2015-03-23 20:56 - 2015-03-28 11:49 - 02168320 _____ () C:\Users\Heiko\Desktop\adwcleaner_4.113.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Opera Software
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Opera Software
2015-03-23 20:23 - 2015-03-23 20:27 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-22 10:41 - 2015-03-22 10:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-21 10:43 - 2015-03-21 10:43 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-03-21 10:43 - 2015-03-21 10:43 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-03-21 10:33 - 2015-03-21 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-03-17 15:46 - 2015-03-28 13:47 - 00000000 ____D () C:\AdwCleaner
2015-03-17 09:48 - 2004-03-09 00:00 - 00440352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSHFLXGD.OCX
2015-03-17 09:35 - 2015-01-17 15:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-17 09:35 - 2015-01-17 15:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-17 09:34 - 2015-02-24 16:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-17 09:34 - 2015-02-24 15:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-17 09:34 - 2015-02-21 14:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-17 09:34 - 2015-02-21 13:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-17 09:34 - 2015-02-21 13:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-17 09:34 - 2015-02-21 12:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-17 09:34 - 2015-02-21 12:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-17 09:34 - 2015-02-20 16:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 16:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-17 09:34 - 2015-02-20 15:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-17 09:34 - 2015-02-20 15:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-17 09:34 - 2015-02-20 15:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 15:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-17 09:34 - 2015-02-20 15:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 15:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-17 09:34 - 2015-02-20 15:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-17 09:34 - 2015-02-20 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 15:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-17 09:34 - 2015-02-20 15:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 15:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-17 09:34 - 2015-02-20 15:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-17 09:34 - 2015-02-20 14:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 14:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-17 09:34 - 2015-02-20 14:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-17 09:34 - 2015-02-20 14:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 14:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-17 09:34 - 2015-02-20 14:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-17 09:34 - 2015-02-20 14:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-17 09:34 - 2015-02-20 14:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-17 09:34 - 2015-02-20 14:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-17 09:34 - 2015-02-20 14:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-17 09:34 - 2015-02-20 13:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-17 09:34 - 2015-02-20 13:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-17 09:33 - 2015-02-03 16:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-17 09:33 - 2015-02-03 16:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-17 09:33 - 2015-02-03 16:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-17 09:33 - 2015-02-03 16:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-17 09:33 - 2015-02-03 16:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-17 09:32 - 2015-02-03 16:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-17 09:32 - 2015-02-03 16:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-17 09:32 - 2015-02-03 16:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-17 09:32 - 2015-02-03 16:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-17 09:32 - 2014-11-01 11:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-17 09:31 - 2015-02-03 16:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-17 09:31 - 2015-02-03 16:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-17 09:31 - 2015-02-03 16:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-17 09:30 - 2015-02-03 16:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-17 09:30 - 2015-02-03 16:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 15:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-17 09:22 - 2015-03-06 18:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-17 09:22 - 2015-03-06 18:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-17 09:22 - 2015-03-06 18:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-17 09:22 - 2015-03-06 18:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-17 09:22 - 2015-01-31 12:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-17 09:21 - 2015-03-06 18:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-17 09:21 - 2015-03-06 18:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-17 09:17 - 2015-02-20 16:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-17 09:17 - 2015-02-03 16:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-17 09:17 - 2015-02-03 16:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-17 09:16 - 2015-02-20 17:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-17 09:16 - 2015-02-20 16:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-17 09:16 - 2015-02-13 18:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-17 09:16 - 2015-02-13 18:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-17 09:13 - 2015-02-03 16:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-17 09:13 - 2015-02-03 16:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-17 09:13 - 2015-01-31 12:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-17 09:12 - 2015-02-26 16:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-17 08:52 - 2015-02-04 16:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-17 08:52 - 2015-02-04 15:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-08 20:53 - 2015-03-08 20:53 - 00001717 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-03-08 20:53 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\Program Files\iTunes
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files\iPod
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-03-06 08:17 - 2015-03-06 08:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-31 22:07 - 2014-01-08 10:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-31 22:03 - 2014-01-08 10:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-31 20:13 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-31 20:13 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-31 20:10 - 2009-11-15 06:13 - 00703476 _____ () C:\Windows\system32\perfh007.dat
2015-03-31 20:10 - 2009-11-15 06:13 - 00151084 _____ () C:\Windows\system32\perfc007.dat
2015-03-31 20:10 - 2009-11-14 21:24 - 01614507 _____ () C:\Windows\WindowsUpdate.log
2015-03-31 20:10 - 2009-07-14 18:13 - 01630508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-31 20:05 - 2009-07-14 18:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-31 20:04 - 2011-02-25 21:54 - 00126567 _____ () C:\Windows\setupact.log
2015-03-31 18:42 - 2015-02-12 18:24 - 00000050 _____ () C:\Windows\astplus.ini
2015-03-31 15:33 - 2014-11-05 20:06 - 00000000 ____D () C:\Users\Heiko\.gimp-2.8
2015-03-31 15:00 - 2014-11-05 20:21 - 00000000 ____D () C:\Users\Heiko\AppData\Local\gtk-2.0
2015-03-31 14:05 - 2014-02-06 09:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-03-28 11:11 - 2014-06-07 10:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-28 11:10 - 2014-11-08 09:15 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-03-27 12:40 - 2011-02-25 21:54 - 00258046 _____ () C:\Windows\PFRO.log
2015-03-27 12:23 - 2009-07-14 15:34 - 00000292 _____ () C:\Windows\system.ini
2015-03-27 11:58 - 2015-01-29 18:08 - 645570586 _____ () C:\Windows\MEMORY.DMP
2015-03-27 11:58 - 2011-11-29 23:20 - 00000000 ____D () C:\Windows\Minidump
2015-03-27 11:57 - 2014-02-03 23:04 - 00000000 ____D () C:\Windows\erdnt
2015-03-26 12:32 - 2009-10-29 06:36 - 00000000 ____D () C:\Windows\oem
2015-03-24 21:40 - 2009-12-30 01:44 - 00000000 ____D () C:\Users\Heiko
2015-03-24 21:29 - 2014-02-07 14:05 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\BitTorrent
2015-03-24 09:21 - 2014-11-19 15:35 - 00000000 ____D () C:\Users\Heiko\Documents\Outlook Files
2015-03-24 09:21 - 2009-07-14 18:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-03-24 09:18 - 2009-12-31 04:56 - 00000000 ____D () C:\Program Files\Zubehör
2015-03-24 09:17 - 2010-04-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Zattoo4
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-03-23 23:34 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\Web
2015-03-23 20:53 - 2014-08-18 10:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Adobe
2015-03-23 20:27 - 2009-12-30 01:45 - 00001429 _____ () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-23 20:07 - 2009-07-14 18:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-23 20:06 - 2012-05-09 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-22 22:25 - 2009-12-30 06:37 - 00002358 ____H () C:\Users\Heiko\Documents\Default.rdp
2015-03-22 20:18 - 2014-02-01 18:03 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-22 07:24 - 2013-10-07 10:39 - 00000000 ____D () C:\Users\Gast
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\registration
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\AppCompat
2015-03-21 10:43 - 2014-04-27 16:11 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-03-21 10:43 - 2013-12-29 21:47 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00268640 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-03-21 10:43 - 2012-02-25 21:27 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00441728 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-03-21 10:42 - 2011-03-14 07:00 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-03-21 10:40 - 2009-07-14 18:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-03-21 10:33 - 2014-11-22 08:27 - 00001897 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-03-17 18:55 - 2014-04-24 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Computer Troubleshooters Calling Card
2015-03-17 12:29 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\rescache
2015-03-17 10:54 - 2009-07-14 17:45 - 00450496 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-17 10:45 - 2009-10-29 18:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-17 10:28 - 2014-04-24 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-03-17 10:28 - 2009-07-14 15:34 - 00000510 _____ () C:\Windows\win.ini
2015-03-17 10:26 - 2013-07-11 18:58 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-17 10:11 - 2009-12-30 01:59 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-17 09:48 - 2015-02-12 18:24 - 00001751 _____ () C:\Users\Public\Desktop\Astroplus.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00001741 _____ () C:\Users\Public\Desktop\Astroplus (classic Design).lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000872 _____ () C:\Users\Public\Desktop\Planetary Hours.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astrocontact Astroplus
2015-03-17 06:15 - 2014-06-07 10:25 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-17 06:15 - 2014-06-07 10:25 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-17 06:15 - 2014-01-24 00:04 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-08 20:52 - 2010-09-23 09:08 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-03-06 21:40 - 2010-01-04 19:57 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2015-03-06 08:17 - 2014-03-01 21:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ____D () C:\ProgramData\Skype
2015-03-05 12:53 - 2009-07-14 18:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-04 02:17 - 2009-12-30 01:58 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Files in the root of some directories =======
2010-01-27 08:43 - 2010-01-27 08:43 - 0000034 _____ () C:\Users\Heiko\AppData\Roaming\pcouffin.log
2010-01-27 08:42 - 2010-01-27 08:42 - 0082816 _____ (VSO Software) C:\Users\Heiko\AppData\Roaming\pcouffin.sys
2010-01-17 01:40 - 2010-01-17 01:40 - 0003584 _____ () C:\Users\Heiko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-27 03:38 - 2013-10-27 03:38 - 0004096 ____H () C:\Users\Heiko\AppData\Local\keyfile3.drm
2015-03-24 09:18 - 2015-03-24 09:20 - 0014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-31 15:00 - 2015-03-31 15:00 - 0007890 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2010-06-11 23:01 - 2013-12-30 08:25 - 0017408 _____ () C:\Users\Heiko\AppData\Local\WebpageIcons.db
2014-01-08 21:39 - 2014-01-08 21:39 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-11-14 21:25 - 2009-11-14 21:28 - 0008308 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-01-04 19:59 - 2010-01-04 19:59 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-10-29 18:58 - 2009-07-18 14:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
Some content of TEMP:
====================
C:\Users\Heiko\AppData\Local\Temp\Quarantine.exe
C:\Users\Heiko\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-25 00:14
==================== End Of Log ============================
--- --- --- |
|
31.03.2015, 11:30
| #14 |
| | Bei Installation Adobe Flash Player Virus eingefangen... und der zweite Teil da zu lang... Und nochmal das FRST nachdem ich Java geloescht und neu installiert habe und die fixlist datei angewendet habe: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by Heiko (administrator) on HEIKO-NOTEBOOK on 31-03-2015 22:45:41
Running from C:\Users\Heiko\Desktop
Loaded Profiles: Heiko (Available profiles: Heiko & Gast)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Hewlett-Packard Company) C:\Program Files (x86)\HP\Common\HPSupportSolutionsFrameworkService.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcCMService.exe
(Alcatel-Lucent) C:\Program Files\Common Files\Motive\pcServiceHost.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_service.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Alcatel-Lucent) C:\Program Files\tcnz\pcTrayApp.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Elgato Systems) C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(eFolder) C:\Program Files (x86)\Filecloud\bin\agent_gui.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Alcatel-Lucent) C:\Program Files (x86)\Common Files\Motive\pcContextHookShim.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Officejet 6700\Bin\HPNetworkCommunicatorCom.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Acer Corp.) C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avast Software s.r.o.) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-11-14] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [823840 2009-10-01] (Acer Incorporated)
HKLM\...\Run: [IntelliPoint] => c:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-02] (Microsoft Corporation)
HKLM\...\Run: [tcnz_McciTrayApp] => C:\Program Files\tcnz\pcTrayApp.exe [2782720 2013-07-26] (Alcatel-Lucent)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [169768 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [265984 2010-05-24] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [ArcadeDeluxeAgent] => C:\Program Files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [419112 2009-10-07] (CyberLink Corp.)
HKLM-x32\...\Run: [PlayMovie] => C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe [181480 2009-10-06] (Acer Corp.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-27] (Microsoft Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-28] (Apple Inc.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2015-02-13] (Apple Inc.)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] ()
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [5511352 2015-03-21] (Avast Software s.r.o.)
HKLM-x32\...\Run: [RegKillElbyCheck] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\ElbyCheck.exe [45056 2002-11-02] (Elaborate Bytes AG)
HKLM-x32\...\Run: [RegKillTray] => C:\Program Files (x86)\Elaborate Bytes\DVD Region Killer\RegKillTray.exe [49152 2002-11-28] (Elaborate Bytes)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [96056 2013-05-30] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [508800 2014-12-17] (Oracle Corporation)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [Remote Control Editor] => C:\Program Files (x86)\Common Files\TerraTec\Remote\TTTvRc.exe [1844296 2011-11-10] (Elgato Systems)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [43816 2014-10-17] (Apple Inc.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> c:\windows\system32\ACER.SCR [438272 2009-07-08] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Filecloud.lnk
ShortcutTarget: Filecloud.lnk -> C:\Program Files (x86)\Filecloud\bin\agent_gui.exe (eFolder)
Startup: C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Officejet 6700 (Netzwerk).lnk -> C:\Program Files\HP\HP Officejet 6700\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileModified] -> {23939489-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00-Zukmo-SyncFileSuccess] -> {23939488-8B41-45ec-90F3-BD36A9644006} => No File
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (Avast Software s.r.o.)
ShellIconOverlayIdentifiers: [AnchorOverlayAttention] -> {40D1DAA7-9CB5-4DB7-8610-A814EDB003A5} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSynced] -> {5B05543A-73D8-4D80-97F9-13F471224DD8} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlayLockedSyncing] -> {1C514AC9-A6B4-4692-A18E-9A2EE0B4E277} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySynced] -> {56E89524-684C-4352-B350-F97A7377DD64} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [AnchorOverlaySyncing] -> {C6B3FD8D-C629-4A7F-AF73-9ABB59AF029D} => C:\Program Files (x86)\Filecloud\bin\x64\anchoroverlay.dll (eFolder)
ShellIconOverlayIdentifiers: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
ShellIconOverlayIdentifiers: [DropboxExt4] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Users\Heiko\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (Dropbox, Inc.)
BootExecute: autocheck autochk * sdnclean64.exe
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-3175191187-1249783048-3626377888-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.spiegel.de/
SearchScopes: HKLM-x32 -> {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-21-3175191187-1249783048-3626377888-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll [2015-03-21] (Avast Software s.r.o.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL [2014-01-22] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL [2015-01-21] (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-27] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\ssv.dll [2015-01-24] (Oracle Corporation)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll [2015-03-21] (Avast Software s.r.o.)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2012-07-17] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office15\URLREDIR.DLL [2014-01-23] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\jp2ssv.dll [2015-01-24] (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File
Toolbar: HKLM-x32 - TerraTec Home Cinema - {AD6E6555-FB2C-47D4-8339-3E2965509877} - C:\Program Files (x86)\TerraTec\TerraTec Home Cinema\ThcDeskBand.dll [2011-06-25] (TerraTec Electronic GmbH)
DPF: HKLM-x32 {2D36AF92-04D3-11D8-B719-0000865F231B} https://my.sabre.com/jars/TMinReqX.dll
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2012-04-09] (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll [2014-05-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 0.0.0.0
FireFox:
========
FF ProfilePath: C:\Users\Heiko\AppData\Roaming\Mozilla\Firefox\Profiles\532md588.default-1422251137045
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll [2015-03-23] ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.1.4 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2014-07-30] (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll [2015-03-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2014-10-30] ()
FF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\dtplugin\npDeployJava1.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.31.2 -> C:\Program Files (x86)\Java\jre1.8.0_31\bin\plugin2\npjp2.dll [2015-01-24] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-14] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~2\Office15\NPSPWRAP.DLL [2014-01-23] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2014-03-31] (Microsoft Corporation)
FF Plugin-x32: @Motive.com/NpMotive,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotive.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @Motive.com/npMotiveRequest,version=1.0 -> C:\Program Files (x86)\Common Files\Motive\npMotiveRequest.dll [2013-07-26] (Alcatel-Lucent)
FF Plugin-x32: @pages.tvunetworks.com/WebPlayer -> C:\Windows\system32\TVUAx\npTVUAx.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-11] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll [2007-04-11] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npDivxPlayerPlugin.dll [2009-11-14] (DivX, Inc)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL [2006-10-27] (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2014-10-26] (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2014-10-26] (Apple Inc.)
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2015-03-22]
FF Extension: Motive Extension - C:\Program Files (x86)\Mozilla Firefox\extensions\mcciwbch@motive.com.xpi [2015-03-22]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: Avast Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-14]
Chrome:
=======
CHR Profile: C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-08]
CHR Extension: (Google Drive) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-08]
CHR Extension: (YouTube) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-08]
CHR Extension: (Google Search) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-08]
CHR Extension: (Motive Extension) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\edmgmpmklgfbohogafcfobonnkogchec [2014-03-12]
CHR Extension: (Avast Online Security) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-10]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-17]
CHR Extension: (Google Wallet) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-08]
CHR Extension: (Gmail) - C:\Users\Heiko\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-08]
CHR HKLM-x32\...\Chrome\Extension: [edmgmpmklgfbohogafcfobonnkogchec] - C:\Program Files (x86)\Common Files\Motive\extensions\MotiveRequest.crx [2014-03-12]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2015-03-18]
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77128 2015-01-19] (Apple Inc.)
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [343336 2015-03-21] (Avast Software s.r.o.)
R2 HPSupportSolutionsFrameworkService; C:\Program Files (x86)\Hp\Common\HPSupportSolutionsFrameworkService.exe [89864 2014-12-11] (Hewlett-Packard Company)
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 LPDSVC; C:\Windows\system32\lpdsvc.dll [45568 2009-07-14] (Microsoft Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)
S3 OpenVPNService; C:\Program Files (x86)\HMA! Pro VPN\bin\openvpnserv.exe [37176 2014-04-15] (The OpenVPN Project)
R2 pcCMService64; C:\Program Files\Common Files\Motive\pcCMService.exe [460288 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 pcServiceHost; C:\Program Files\Common Files\Motive\pcServiceHost.exe [342528 2013-07-26] (Alcatel-Lucent) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
R2 SyncedTool; C:\Program Files (x86)\Filecloud\bin\agent_service.exe [8190648 2015-02-27] (eFolder)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HsspConfig; C:\Windows\system32\CfgSrvc.exe [X]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
S3 Apowersoft_AudioDevice; C:\Windows\System32\drivers\Apowersoft_AudioDevice.sys [31968 2012-10-08] (Wondershare)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29168 2015-03-21] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [88408 2015-03-21] (Avast Software s.r.o.)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93528 2015-03-21] (Avast Software s.r.o.)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65736 2015-03-21] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1047320 2015-03-21] (Avast Software s.r.o.)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [441728 2015-03-21] (Avast Software s.r.o.)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [136752 2015-03-21] (Avast Software s.r.o.)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [268640 2015-03-21] ()
S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2010-12-30] ()
S2 ElbyCDIO; C:\Windows\SysWOW64\Drivers\ElbyCDIO.sys [16320 2002-11-30] (Elaborate Bytes AG) [File not signed]
S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [132608 2009-06-30] (Huawei Technologies Co., Ltd.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-12-30] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-03-17] (Malwarebytes Corporation)
S3 mod7700; C:\Windows\System32\DRIVERS\mod7700.sys [631360 2009-11-17] (DiBcom SA)
S3 MODRC; C:\Windows\System32\DRIVERS\modrc.sys [23744 2009-11-17] (DiBcom S.A.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)
S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.SYS [43008 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA)) [File not signed]
R3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.SYS [40960 2013-07-26] (Printing Communications Assoc., Inc. (PCAUSA))
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)
S3 RegKill; C:\Windows\SysWOW64\Drivers\RegKill.sys [6400 2002-11-28] (Elaborate Bytes) [File not signed]
S3 StarOpen; No ImagePath
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files (x86)\Acer Arcade Deluxe\PlayMovie\000.fcl [146928 2009-10-06] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 massfilter; system32\drivers\massfilter.sys [X]
S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]
S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]
S3 pccsmcfd; system32\DRIVERS\pccsmcfdx64.sys [X]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [X]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [X]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-31 15:00 - 2015-03-31 15:00 - 00007890 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2015-03-30 16:13 - 2015-03-30 16:13 - 00001172 _____ () C:\Users\Heiko\Desktop\checkup.txt
2015-03-30 16:09 - 2015-03-30 16:09 - 00852604 _____ () C:\Users\Heiko\Desktop\SecurityCheck.exe
2015-03-30 16:08 - 2015-03-30 15:25 - 00001914 _____ () C:\Users\Heiko\Desktop\eset.txt
2015-03-30 11:20 - 2015-03-30 11:20 - 02347384 _____ (ESET) C:\Users\Heiko\Desktop\esetsmartinstaller_deu.exe
2015-03-28 14:05 - 2015-03-28 14:05 - 00000814 _____ () C:\Users\Heiko\Desktop\JRT.txt
2015-03-28 13:56 - 2015-03-28 13:57 - 01388782 _____ (Thisisu) C:\Users\Heiko\Desktop\JRT.exe
2015-03-28 13:54 - 2015-03-28 13:54 - 00001192 _____ () C:\Users\Heiko\Desktop\AdwCleaner[S2].txt
2015-03-28 11:49 - 2015-03-28 11:49 - 00001207 _____ () C:\Users\Heiko\Desktop\mbam.txt
2015-03-28 11:07 - 2015-03-28 11:09 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Heiko\Desktop\mbam-setup-2.1.4.1018.exe
2015-03-27 12:39 - 2015-03-27 12:39 - 00028301 _____ () C:\Users\Heiko\Desktop\combofix.txt
2015-03-27 12:28 - 2015-03-27 12:28 - 00028301 _____ () C:\ComboFix.txt
2015-03-27 12:06 - 2015-03-27 12:28 - 00000000 ____D () C:\Qoobox
2015-03-27 12:06 - 2011-06-26 19:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-27 12:06 - 2010-11-08 06:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-27 12:06 - 2009-04-20 17:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-27 12:06 - 2000-08-31 13:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-27 11:58 - 2015-03-27 11:58 - 00276216 _____ () C:\Windows\Minidump\032715-36629-01.dmp
2015-03-27 11:55 - 2015-03-27 11:56 - 05615749 ____R (Swearware) C:\Users\Heiko\Desktop\ComboFix.exe
2015-03-26 14:05 - 2015-03-26 14:05 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Heiko\Desktop\tdsskiller.exe
2015-03-26 12:46 - 2015-03-26 14:03 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-26 12:43 - 2015-03-26 14:03 - 00000000 ____D () C:\Users\Heiko\Desktop\mbar
2015-03-26 12:40 - 2015-03-26 12:42 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Heiko\Desktop\mbar-1.09.1.1004.exe
2015-03-24 21:59 - 2015-03-24 22:01 - 00003356 _____ () C:\Users\Heiko\Desktop\Anti malwarebyte1.txt
2015-03-24 21:58 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Desktop\gmer.txt
2015-03-24 21:57 - 2015-03-24 21:57 - 00194854 _____ () C:\Users\Heiko\Documents\gmer.txt
2015-03-24 21:42 - 2015-03-24 21:43 - 00044339 _____ () C:\Users\Heiko\Desktop\Addition.txt
2015-03-24 21:41 - 2015-03-31 22:45 - 00027574 _____ () C:\Users\Heiko\Desktop\FRST.txt
2015-03-24 21:41 - 2015-03-31 22:45 - 00000000 ____D () C:\FRST
2015-03-24 21:40 - 2015-03-24 21:40 - 00000472 _____ () C:\Users\Heiko\Desktop\defogger_disable.log
2015-03-24 21:40 - 2015-03-24 21:40 - 00000000 _____ () C:\Users\Heiko\defogger_reenable
2015-03-24 21:38 - 2015-03-24 21:39 - 00380416 _____ () C:\Users\Heiko\Desktop\Gmer-19357.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 02095616 _____ (Farbar) C:\Users\Heiko\Desktop\FRST64.exe
2015-03-24 21:38 - 2015-03-24 21:38 - 01135104 _____ (Farbar) C:\Users\Heiko\Desktop\FRST.exe
2015-03-24 21:37 - 2015-03-24 21:37 - 00050477 _____ () C:\Users\Heiko\Desktop\Defogger.exe
2015-03-24 09:18 - 2015-03-24 09:20 - 00014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-24 00:02 - 2015-03-24 00:02 - 00276016 _____ () C:\Windows\Minidump\032415-22682-01.dmp
2015-03-23 20:56 - 2015-03-28 11:49 - 02168320 _____ () C:\Users\Heiko\Desktop\adwcleaner_4.113.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00778928 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-03-23 20:52 - 2015-03-23 20:52 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Opera Software
2015-03-23 20:26 - 2015-03-23 20:27 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Opera Software
2015-03-23 20:23 - 2015-03-23 20:27 - 00000000 ____D () C:\Program Files (x86)\Opera
2015-03-22 10:41 - 2015-03-22 10:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-03-21 10:43 - 2015-03-21 10:43 - 00364472 _____ (Avast Software s.r.o.) C:\Windows\system32\aswBoot.exe
2015-03-21 10:43 - 2015-03-21 10:43 - 00043112 _____ (Avast Software s.r.o.) C:\Windows\avastSS.scr
2015-03-21 10:33 - 2015-03-21 10:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVAST Software
2015-03-17 15:46 - 2015-03-28 13:47 - 00000000 ____D () C:\AdwCleaner
2015-03-17 09:48 - 2004-03-09 00:00 - 00440352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSHFLXGD.OCX
2015-03-17 09:35 - 2015-01-17 15:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-17 09:35 - 2015-01-17 15:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-17 09:34 - 2015-02-24 16:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-17 09:34 - 2015-02-24 15:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-17 09:34 - 2015-02-21 14:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-17 09:34 - 2015-02-21 13:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-17 09:34 - 2015-02-21 13:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-17 09:34 - 2015-02-21 13:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-17 09:34 - 2015-02-21 12:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-17 09:34 - 2015-02-21 12:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-17 09:34 - 2015-02-20 16:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 16:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-17 09:34 - 2015-02-20 15:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-17 09:34 - 2015-02-20 15:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-17 09:34 - 2015-02-20 15:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 15:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-17 09:34 - 2015-02-20 15:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 15:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-17 09:34 - 2015-02-20 15:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-17 09:34 - 2015-02-20 15:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-17 09:34 - 2015-02-20 15:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-17 09:34 - 2015-02-20 15:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 15:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-17 09:34 - 2015-02-20 15:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-17 09:34 - 2015-02-20 15:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-17 09:34 - 2015-02-20 15:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-17 09:34 - 2015-02-20 15:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-17 09:34 - 2015-02-20 15:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-17 09:34 - 2015-02-20 15:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-17 09:34 - 2015-02-20 14:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-17 09:34 - 2015-02-20 14:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-17 09:34 - 2015-02-20 14:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-17 09:34 - 2015-02-20 14:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-17 09:34 - 2015-02-20 14:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-17 09:34 - 2015-02-20 14:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-17 09:34 - 2015-02-20 14:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-17 09:34 - 2015-02-20 14:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-17 09:34 - 2015-02-20 14:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-17 09:34 - 2015-02-20 14:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-17 09:34 - 2015-02-20 14:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-17 09:34 - 2015-02-20 14:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-17 09:34 - 2015-02-20 14:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-17 09:34 - 2015-02-20 14:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-17 09:34 - 2015-02-20 13:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-17 09:34 - 2015-02-20 13:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-17 09:33 - 2015-02-03 16:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-17 09:33 - 2015-02-03 16:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-17 09:33 - 2015-02-03 16:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-17 09:33 - 2015-02-03 16:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-17 09:33 - 2015-02-03 16:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-17 09:33 - 2015-02-03 16:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-17 09:33 - 2015-02-03 16:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-17 09:33 - 2015-02-03 16:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-17 09:33 - 2015-02-03 16:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-17 09:32 - 2015-02-03 16:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-17 09:32 - 2015-02-03 16:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-17 09:32 - 2015-02-03 16:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-17 09:32 - 2015-02-03 16:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-17 09:32 - 2015-02-03 16:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-17 09:32 - 2015-02-03 16:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-17 09:32 - 2015-02-03 16:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-17 09:32 - 2014-11-01 11:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-17 09:31 - 2015-02-03 16:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-17 09:31 - 2015-02-03 16:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-17 09:31 - 2015-02-03 16:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-17 09:31 - 2015-02-03 16:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-17 09:31 - 2015-02-03 16:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-17 09:31 - 2015-02-03 16:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-17 09:31 - 2015-02-03 16:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-17 09:31 - 2015-02-03 16:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-17 09:30 - 2015-02-03 16:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-17 09:30 - 2015-02-03 16:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 16:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-17 09:30 - 2015-02-03 16:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-17 09:30 - 2015-02-03 16:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-17 09:30 - 2015-02-03 16:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-17 09:30 - 2015-02-03 16:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-17 09:30 - 2015-02-03 15:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-17 09:22 - 2015-03-06 18:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-17 09:22 - 2015-03-06 18:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-17 09:22 - 2015-03-06 18:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-17 09:22 - 2015-03-06 18:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-17 09:22 - 2015-03-06 18:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-17 09:22 - 2015-03-06 18:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-17 09:22 - 2015-03-06 18:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-17 09:22 - 2015-03-06 18:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-17 09:22 - 2015-01-31 12:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-17 09:21 - 2015-03-06 18:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-17 09:21 - 2015-03-06 18:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-17 09:21 - 2015-03-06 18:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-17 09:21 - 2015-03-06 18:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-17 09:21 - 2015-03-06 18:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-17 09:17 - 2015-02-20 16:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-17 09:17 - 2015-02-03 16:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-17 09:17 - 2015-02-03 16:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-17 09:16 - 2015-02-20 17:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-17 09:16 - 2015-02-20 17:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-17 09:16 - 2015-02-20 17:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-17 09:16 - 2015-02-20 16:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-17 09:16 - 2015-02-13 18:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-17 09:16 - 2015-02-13 18:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-17 09:13 - 2015-02-03 16:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-17 09:13 - 2015-02-03 16:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-17 09:13 - 2015-01-31 16:48 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2015-03-17 09:13 - 2015-01-31 12:56 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-17 09:12 - 2015-02-26 16:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-17 08:52 - 2015-02-04 16:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-17 08:52 - 2015-02-04 15:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-08 20:53 - 2015-03-08 20:53 - 00001717 _____ () C:\Users\Public\Desktop\iTunes.lnk
2015-03-08 20:53 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\ProgramData\E1864A66-75E3-486a-BD95-D1B7D99A84A7
2015-03-08 20:52 - 2015-03-08 20:53 - 00000000 ____D () C:\Program Files\iTunes
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files\iPod
2015-03-08 20:52 - 2015-03-08 20:52 - 00000000 ____D () C:\Program Files (x86)\iTunes
2015-03-06 08:17 - 2015-03-06 08:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2015-03-31 22:07 - 2014-01-08 10:22 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-31 22:03 - 2014-01-08 10:22 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-31 20:13 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-31 20:13 - 2009-07-14 17:45 - 00017600 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-31 20:10 - 2009-11-15 06:13 - 00703476 _____ () C:\Windows\system32\perfh007.dat
2015-03-31 20:10 - 2009-11-15 06:13 - 00151084 _____ () C:\Windows\system32\perfc007.dat
2015-03-31 20:10 - 2009-11-14 21:24 - 01614507 _____ () C:\Windows\WindowsUpdate.log
2015-03-31 20:10 - 2009-07-14 18:13 - 01630508 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-31 20:05 - 2009-07-14 18:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-31 20:04 - 2011-02-25 21:54 - 00126567 _____ () C:\Windows\setupact.log
2015-03-31 18:42 - 2015-02-12 18:24 - 00000050 _____ () C:\Windows\astplus.ini
2015-03-31 15:33 - 2014-11-05 20:06 - 00000000 ____D () C:\Users\Heiko\.gimp-2.8
2015-03-31 15:00 - 2014-11-05 20:21 - 00000000 ____D () C:\Users\Heiko\AppData\Local\gtk-2.0
2015-03-31 14:05 - 2014-02-06 09:40 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2015-03-28 11:11 - 2014-06-07 10:26 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-28 11:10 - 2014-11-08 09:15 - 00001110 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware
2015-03-28 11:10 - 2014-06-07 10:25 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware
2015-03-27 12:40 - 2011-02-25 21:54 - 00258046 _____ () C:\Windows\PFRO.log
2015-03-27 12:23 - 2009-07-14 15:34 - 00000292 _____ () C:\Windows\system.ini
2015-03-27 11:58 - 2015-01-29 18:08 - 645570586 _____ () C:\Windows\MEMORY.DMP
2015-03-27 11:58 - 2011-11-29 23:20 - 00000000 ____D () C:\Windows\Minidump
2015-03-27 11:57 - 2014-02-03 23:04 - 00000000 ____D () C:\Windows\erdnt
2015-03-26 12:32 - 2009-10-29 06:36 - 00000000 ____D () C:\Windows\oem
2015-03-24 21:40 - 2009-12-30 01:44 - 00000000 ____D () C:\Users\Heiko
2015-03-24 21:29 - 2014-02-07 14:05 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\BitTorrent
2015-03-24 09:21 - 2014-11-19 15:35 - 00000000 ____D () C:\Users\Heiko\Documents\Outlook Files
2015-03-24 09:21 - 2009-07-14 18:32 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2015-03-24 09:18 - 2009-12-31 04:56 - 00000000 ____D () C:\Program Files\Zubehör
2015-03-24 09:17 - 2010-04-19 21:59 - 00000000 ____D () C:\Program Files (x86)\Zattoo4
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer
2015-03-24 09:17 - 2009-10-29 06:36 - 00000000 ____D () C:\Program Files (x86)\Acer
2015-03-23 23:34 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\Web
2015-03-23 20:53 - 2014-08-18 10:22 - 00000000 ____D () C:\Users\Heiko\AppData\Local\Adobe
2015-03-23 20:27 - 2009-12-30 01:45 - 00001429 _____ () C:\Users\Heiko\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2015-03-23 20:07 - 2009-07-14 18:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2015-03-23 20:06 - 2012-05-09 18:37 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-03-22 22:25 - 2009-12-30 06:37 - 00002358 ____H () C:\Users\Heiko\Documents\Default.rdp
2015-03-22 20:18 - 2014-02-01 18:03 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-22 07:24 - 2013-10-07 10:39 - 00000000 ____D () C:\Users\Gast
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\registration
2015-03-22 07:23 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\AppCompat
2015-03-21 10:43 - 2014-04-27 16:11 - 00029168 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2015-03-21 10:43 - 2013-12-29 21:47 - 00136752 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswStm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00268640 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2015-03-21 10:43 - 2013-03-14 11:09 - 00065736 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2015-03-21 10:43 - 2012-02-25 21:27 - 00093528 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswRdr2.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00441728 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSP.sys
2015-03-21 10:43 - 2009-12-30 09:01 - 00088408 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswMonFlt.sys
2015-03-21 10:42 - 2011-03-14 07:00 - 01047320 _____ (Avast Software s.r.o.) C:\Windows\system32\Drivers\aswSnx.sys
2015-03-21 10:40 - 2009-07-14 18:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2015-03-21 10:33 - 2014-11-22 08:27 - 00001897 _____ () C:\Users\Public\Desktop\Avast Free Antivirus.lnk
2015-03-17 18:55 - 2014-04-24 16:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Computer Troubleshooters Calling Card
2015-03-17 12:29 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\rescache
2015-03-17 10:54 - 2009-07-14 17:45 - 00450496 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-17 10:50 - 2009-07-14 16:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-17 10:45 - 2009-10-29 18:45 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-17 10:28 - 2014-04-24 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013
2015-03-17 10:28 - 2009-07-14 15:34 - 00000510 _____ () C:\Windows\win.ini
2015-03-17 10:26 - 2013-07-11 18:58 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-17 10:11 - 2009-12-30 01:59 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-17 09:48 - 2015-02-12 18:24 - 00001751 _____ () C:\Users\Public\Desktop\Astroplus.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00001741 _____ () C:\Users\Public\Desktop\Astroplus (classic Design).lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000872 _____ () C:\Users\Public\Desktop\Planetary Hours.lnk
2015-03-17 09:48 - 2015-02-12 18:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Astrocontact Astroplus
2015-03-17 06:15 - 2014-06-07 10:25 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-17 06:15 - 2014-06-07 10:25 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-17 06:15 - 2014-01-24 00:04 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-08 20:52 - 2010-09-23 09:08 - 00000000 ____D () C:\Program Files\Common Files\Apple
2015-03-06 21:40 - 2010-01-04 19:57 - 00000000 ____D () C:\Users\Heiko\AppData\Roaming\Skype
2015-03-06 08:17 - 2014-03-01 21:01 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ___RD () C:\Program Files (x86)\Skype
2015-03-06 08:17 - 2010-01-04 19:57 - 00000000 ____D () C:\ProgramData\Skype
2015-03-05 12:53 - 2009-07-14 18:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-04 02:17 - 2009-12-30 01:58 - 00295552 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
==================== Files in the root of some directories =======
2010-01-27 08:43 - 2010-01-27 08:43 - 0000034 _____ () C:\Users\Heiko\AppData\Roaming\pcouffin.log
2010-01-27 08:42 - 2010-01-27 08:42 - 0082816 _____ (VSO Software) C:\Users\Heiko\AppData\Roaming\pcouffin.sys
2010-01-17 01:40 - 2010-01-17 01:40 - 0003584 _____ () C:\Users\Heiko\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-10-27 03:38 - 2013-10-27 03:38 - 0004096 ____H () C:\Users\Heiko\AppData\Local\keyfile3.drm
2015-03-24 09:18 - 2015-03-24 09:20 - 0014191 _____ () C:\Users\Heiko\AppData\Local\MyWinLockerInstaller.txt-20150324.log
2015-03-31 15:00 - 2015-03-31 15:00 - 0007890 _____ () C:\Users\Heiko\AppData\Local\recently-used.xbel
2010-06-11 23:01 - 2013-12-30 08:25 - 0017408 _____ () C:\Users\Heiko\AppData\Local\WebpageIcons.db
2014-01-08 21:39 - 2014-01-08 21:39 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-11-14 21:25 - 2009-11-14 21:28 - 0008308 _____ () C:\ProgramData\ArcadeDeluxe3.log
2010-01-04 19:59 - 2010-01-04 19:59 - 0000056 ____H () C:\ProgramData\ezsidmv.dat
2009-10-29 18:58 - 2009-07-18 14:57 - 0036136 _____ (Oberon Media) C:\ProgramData\FullRemove.exe
Some content of TEMP:
====================
C:\Users\Heiko\AppData\Local\Temp\Quarantine.exe
C:\Users\Heiko\AppData\Local\Temp\sqlite3.dll
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2015-03-25 00:14
==================== End Of Log ============================
--- --- --- Viele Grüße Kermit |
|
31.03.2015, 19:15
| #15 |
| /// the machine /// TB-Ausbilder | Bei Installation Adobe Flash Player Virus eingefangen... Wahnsinn, im Log seh ich nix. Lade SystemLook von jpshortstuff von einem der folgenden Spiegel herunter und speichere das Tool auf dem Desktop. SystemLook (64 bit)
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Bei Installation Adobe Flash Player Virus eingefangen... |
| antivirus, combofix, computer, device driver, fehlercode 0xc06d007e, fehlercode windows, flash player, installation, launch, netzwerk, officejet, pup.optional.airglobe.a, pup.optional.omniboxes.a, pup.optional.outbrowse, pup.optional.softwareupdater.a, pup.optional.stormwatchapp.a, registry, security, software, svchost.exe, trojan.agent.klfgen, trojaner, trojaner board, virus total |
WARNUNG an die MITLESER: 
Linear-Darstellung
