Datenleck Aufspüren PC2

Armer_Thor · 21.06.2015, 07:12

Hallo,
Nach missbräuchlicher Nutzung meiner Daten ist hier das 2. Gerät welches kompromittiert sein könnte.

Bisher wurde dieser Rechner mit CT desinfect und den MS Security Essentials gescannt.

3x wurde Alarm geschlagen. Jedes mal in einem Unterverzeichnis von %Appdata%.
Bis auf eine *.exe wurden die anderen Dateien bei hxxp://virusscan.jotti.org/de & https://anubis.iseclab.org hochgeladen.

Außerdem sind die Logdaten von Defogger, FRST64, Gmer ( 2 Fehlermeldungen) & tdsskiller angefügt.

-Das einzig ungewöhnliche Verhalten am Computer ist eine regelmäßig auftauchende Fehlermeldung. Singemäß "Notepad.exe konnnte nicht gestartet werden ....05"

/AppData/Roaming/Skype/Phone/Skype.exe

Code:

ATTFilter

hxxp://virusscan.jotti.org/de/scanresult/6df332e87627a8017f8e2267cf9444e84f06fd0b

https://anubis.iseclab.org/?action=result&task_id=1a821847bef034664a5f655ab1c4f57f9

/AppData/Local/Temp/InSetup1395069832.exe

Code:

ATTFilter

hxxp://virusscan.jotti.org/de/scanresult/0d981b28e44120b38a54e2d4fbea19ebd01bd92b/3a14c40f8af7a6fe0ad714270413690356e8da95 

hxxp://anubis.iseclab.org/?action=result&task_id=1cd7cfbfdc0e3b1b41d0e60569199b02f

hxxp://virusscan.jotti.org/de/scanresult/0d981b28e44120b38a54e2d4fbea19ebd01bd92b/7f6434b34bd8addee64a049b38a9860c19181934

/AppData/Local/Temp/CDBurnerXP-updates/cdbxp_setup_4.4.2.3442.exe

Code:

ATTFilter

ttp://virusscan.jotti.org/de/scanresult/1218dc510ca37d6701d82ae7dea08284c4cf0dea

Defogger

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 07:31 on 21/06/2015 (Profilname)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version:13-06-2015
Ran by Profilname at 2015-06-21 07:33:16
Running from C:\Users\Profilname\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-3184420333-268895486-2121797410-500 - Administrator - Disabled)
Profilname (S-1-5-21-3184420333-268895486-2121797410-1000 - Administrator - Enabled) => C:\Users\Profilname
Gast (S-1-5-21-3184420333-268895486-2121797410-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-3184420333-268895486-2121797410-1002 - Limited - Enabled)

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

abgx360 v1.0.6 (HKLM-x32\...\abgx360) (Version:  - )
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.160 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Arma 2 (HKLM-x32\...\Steam App 33900) (Version:  - Bohemia Interactive)
Arma 2: DayZ Mod (HKLM-x32\...\Steam App 224580) (Version:  - )
Arma 2: Operation Arrowhead (HKLM-x32\...\Steam App 33930) (Version:  - Bohemia Interactive)
Arma 2: Operation Arrowhead Beta (HKLM-x32\...\Steam App 219540) (Version:  - )
ARMA 2: Private Military Company - Data cache removal (HKLM-x32\...\A2PMC Data cache removal) (Version:  - )
Arma 2: Private Military Company (HKLM-x32\...\Steam App 65720) (Version:  - Bohemia Interactive)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.0.15.16 - Atheros Communications Inc.)
Battle.net (HKLM-x32\...\Battle.net) (Version:  - Blizzard Entertainment)
Battlefield 3™ (HKLM-x32\...\{76285C16-411A-488A-BCE3-C83CB933D8CF}) (Version: 1.4.0.0 - Electronic Arts)
Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.4.2.30944 - Electronic Arts)
Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.6.2 - EA Digital Illusions CE AB)
BattlEye for OA Uninstall (HKLM-x32\...\BattlEye for OA) (Version:  - )
BattlEye Uninstall (HKLM-x32\...\BattlEye for A2) (Version:  - )
Behaviors SDK (Windows Phone) for Visual Studio 2013 (x32 Version: 12.0.50716.0 - Microsoft Corporation) Hidden
Behaviors SDK (Windows) for Visual Studio 2013 (x32 Version: 12.0.50429.0 - Microsoft Corporation) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BUFFALO SecureLockManagerEasy for HD (HKLM-x32\...\UN090430) (Version:  - )
Build Tools - amd64 (Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools - x86 (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools Language Resources - amd64 (Version: 12.0.31101 - Microsoft Corporation) Hidden
Build Tools Language Resources - x86 (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Canon IJ Scan Utility (HKLM-x32\...\Canon_IJ_Scan_Utility) (Version:  - ‪Canon Inc.‬)
Canon MG5400 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5400_series) (Version: 1.01 - Canon Inc.)
Canon My Image Garden (HKLM-x32\...\Canon My Image Garden) (Version: 3.0.1 - Canon Inc.)
Canon My Image Garden Design Files (HKLM-x32\...\Canon My Image Garden Design Files) (Version: 3.0.0 - Canon Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.4.1.3341 - CDBurnerXP)
Command & Conquer Generals (x32 Version: 0.50.0000 - Electronic Arts) Hidden
coverXP (remove only) (HKLM-x32\...\coverXP) (Version:  - )
Diablo III (HKLM-x32\...\Diablo III) (Version:  - Blizzard Entertainment)
Dying Light Update v1.4.0 (HKLM-x32\...\RHlpbmdMaWdodA==_is1) (Version: 1 - )
Entity Framework 6.1.1 Tools  for Visual Studio 2013 (HKLM-x32\...\{85253F13-EE42-4850-A3A5-79B90E92D7AC}) (Version: 12.0.30610.0 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{2466E484-9D86-416B-9C88-AA533F15AF1C}) (Version: 12.0.2000.8 - Microsoft Corporation)
Erforderliche Komponenten für SSDT  (HKLM-x32\...\{3FF082A7-A5DE-4BDA-B56A-1D2BEFD617A3}) (Version: 11.1.3000.0 - Microsoft Corporation)
FileZilla Client 3.5.3 (HKLM-x32\...\FileZilla Client) (Version: 3.5.3 - FileZilla Project)
GDR 5520 für SQL Server 2008 (KB 2977321) (64-bit) (HKLM\...\KB2977321) (Version: 10.3.5520.0 - Microsoft Corporation)
Gemeinsam genutzte Microsoft Azure-Komponenten für Visual Studio 2013 Sprachpaket (DEU) - v1.3 (x32 Version: 1.3.21014.1603 - Microsoft Corporation) Hidden
GetDataBack Simple (HKLM-x32\...\{D06B8000-52B4-4D0B-A003-DA83ED982B51}) (Version: 1.02.000 - Runtime Software)
Haali Media Splitter (HKLM-x32\...\HaaliMkx) (Version:  - )
HxD Hex Editor Version 1.7.7.0 (HKLM-x32\...\HxD Hex Editor_is1) (Version: 1.7.7.0 - Maël Hörz)
ImgBurn (HKLM-x32\...\ImgBurn) (Version: 2.5.7.0 - LIGHTNING UK!)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.12.1498 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.1.0.1006 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
Jabra PC Suite 2.16.9388 (HKLM-x32\...\{991E6364-748E-4B71-BD25-0B851046C562}) (Version: 2.16.9388.0 - GN Netcom A/S)
Kaspersky Security Scan (HKLM-x32\...\InstallWIX_{D1282694-0693-41A8-ABC1-6D1FFC1F65C4}) (Version: 12.0.1.881 - Kaspersky Lab)
Kaspersky Security Scan (x32 Version: 12.0.1.881 - Kaspersky Lab) Hidden
LocalESPC (x32 Version: 8.59.29989 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5 Multi-Targeting Pack (HKLM-x32\...\{56E962F0-4FB0-3C67-88DB-9EAA6EEFC493}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK - DEU Lang Pack (HKLM-x32\...\{21B0F482-5EF9-45DA-8840-340AFE705A6C}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5 SDK (HKLM-x32\...\{4AE57014-05C4-4864-A13D-86517A7E1BA4}) (Version: 4.5.50710 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 Multi-Targeting Pack (HKLM-x32\...\{6A0C6700-EA93-372C-8871-DCCF13D160A4}) (Version: 4.5.50932 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (Deutsch) (HKLM-x32\...\{CBD7095F-7211-43FD-9FE7-FB08D753AF79}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 SDK (HKLM-x32\...\{19A5926D-66E1-46FC-854D-163AA10A52D3}) (Version: 4.5.51641 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM-x32\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 Language Pack - DEU (HKLM\...\Microsoft Help Viewer 1.0 Language Pack - DEU) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 2.1 (HKLM-x32\...\Microsoft Help Viewer 2.1) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft Help Viewer 2.1 Sprachpaket - DEU (HKLM-x32\...\Microsoft Help Viewer 2.1 Sprachpaket - DEU) (Version: 2.1.21005 - Microsoft Corporation)
Microsoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.8.204.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft SQL Server 2008 (64-bit) (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files  (HKLM\...\{393CA5BF-0362-42FD-ABC2-BA9D22EF925E}) (Version: 10.3.5520.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Command Line Utilities  (HKLM\...\{F09DEB00-9F41-4BC9-BA81-9F131B12B3D5}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (HKLM-x32\...\{D4E30517-FE6F-491E-942F-AE10E1B18F38}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Data-Tier App Framework  (x64) (HKLM\...\{B4EDAE03-DB34-4DD0-BA7E-2ED80DEA50B1}) (Version: 11.1.2902.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Express LocalDB  (HKLM\...\{269A8DF6-BBDA-441F-932B-233F9B746D72}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (HKLM-x32\...\{EC75BD20-F9CA-4E77-825F-ABD77E95BE91}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Management Objects (x64) (HKLM\...\{0BF65908-D137-4A9E-B7C9-78F32F74F6FD}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Native Client  (HKLM\...\{93945D16-4C3D-433E-B7E4-3D0D86B284C8}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (HKLM\...\{6F173435-3F19-4043-BA3D-A46AA8472859}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server 2012 T-SQL-Sprachdienst  (HKLM-x32\...\{1D812D86-D8EF-41AC-A518-BA12E1913747}) (Version: 11.1.3000.0 - Microsoft Corporation)
Microsoft SQL Server Compact 4.0 SP1 x64 DEU  (HKLM\...\{98225B15-ECF5-4645-B5AC-F8C5E869A5D5}) (Version: 4.0.8876.1 - Microsoft Corporation)
Microsoft SQL Server Data Tools - DEU (12.0.41012.0) (HKLM-x32\...\{79AB8378-D661-4021-9941-FE5F4AEB57BB}) (Version: 12.0.41012.0 - Microsoft Corporation)
Microsoft SQL Server Data Tools Build Utilities - DEU (12.0.30919.1) (HKLM-x32\...\{BCB8A870-2B3D-4CC0-87D6-F931E065AC0C}) (Version: 12.0.30919.1 - Microsoft Corporation)
Microsoft SQL Server 2014 Express LocalDB  (HKLM\...\{CA191120-4CB1-4E3D-89B8-79FDB9017A2E}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects  (HKLM-x32\...\{4F4CB3E2-9D2F-465A-854B-8276B02F4E7D}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Management Objects (x64) (HKLM\...\{03CB711D-679E-46ED-851B-C568418CF914}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 Transact-SQL ScriptDom  (HKLM\...\{F2A2DB39-2C5A-4764-AA0F-5AB112663FFA}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft SQL Server 2014 T-SQL Language Service  (HKLM-x32\...\{06BE8B71-46C6-434B-869E-85C58EF3120A}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030 (HKLM-x32\...\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM-x32\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM-x32\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio Express 2013 für Windows Desktop - DEU mit Update 4 (HKLM-x32\...\{74d92646-2565-4a60-8008-448470da91db}) (Version: 12.0.31101.0 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (HKLM-x32\...\{43341417-7882-4F34-8390-53DFD00F6C0F}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2012 (x64) (HKLM\...\{24440413-490E-41CA-BD33-0B30FD3EBE3A}) (Version: 11.1.3366.16 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2014 (HKLM\...\{9408684F-E1CC-4D2E-AE15-886023557682}) (Version: 12.0.2000.8 - Microsoft Corporation)
Microsoft-System-CLR-Typen für SQL Server 2014 (HKLM-x32\...\{B9A7B46F-0120-406B-9A12-3AD1DCC94D97}) (Version: 12.0.2000.8 - Microsoft Corporation)
mIRC (HKLM-x32\...\mIRC) (Version: 6.35 - mIRC Co. Ltd.)
mkv2vob (HKLM-x32\...\{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}) (Version: 2.4.9 - 3r1c)
Mozilla Firefox 27.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 27.0.1 (x86 de)) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.3.0 - Mozilla)
Mozilla Thunderbird 31.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.3.0 (x86 de)) (Version: 31.3.0 - Mozilla)
Mp3tag v2.52 (HKLM-x32\...\Mp3tag) (Version: v2.52 - Florian Heidenreich)
NVIDIA 3D Vision Controller-Treiber 352.65 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 352.65 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 352.86 - NVIDIA Corporation)
NVIDIA GeForce Experience 2.4.3.31 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.4.3.31 - NVIDIA Corporation)
NVIDIA Grafiktreiber 352.86 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 352.86 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.3 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Orcs Must Die! 2 (HKLM-x32\...\Steam App 201790) (Version:  - )
Origin (HKLM-x32\...\Origin) (Version: 8.6.0.357 - Electronic Arts, Inc.)
Paket zur Festlegung von Zielversionen für Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM-x32\...\{D5409B11-EF28-37A1-AE7A-6051A5BAD923}) (Version: 4.5.50932 - Microsoft Corporation)
Platform (x32 Version: 1.39 - VIA Technologies, Inc.) Hidden
PowreShellIntegration.Notifications (x32 Version: 2.5.21003.1603 - Microsoft Corporation) Hidden
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.)
Python Tools - Umleitungsvorlage (x32 Version: 1.1 - Microsoft Corporation) Hidden
QuickPar 0.9 (HKLM-x32\...\QuickPar) (Version: 0.9 - Peter B. Clements)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.3.14123.5 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.3.14123.5 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 3 für SQL Server 2008 (KB2546951) (64-bit) (HKLM\...\KB2546951) (Version: 10.3.5500.0 - Microsoft Corporation)
Shadow Warrior (HKLM-x32\...\Steam App 233130) (Version:  - Flying Wild Hog)
SHIELD Streaming (Version: 4.1.1000 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.4.3.31 - NVIDIA Corporation) Hidden
Sql Server Customer Experience Improvement Program (Version: 10.3.5500.0 - Microsoft Corporation) Hidden
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Team Explorer for Microsoft Visual Studio 2013 (x32 Version: 12.0.21005 - Microsoft Corporation) Hidden
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.14 - TeamSpeak Systems GmbH)
TeamViewer 10 (HKLM-x32\...\TeamViewer) (Version: 10.0.36244 - TeamViewer)
TypeScript Power Tool (x32 Version: 1.0.5.0 - Microsoft Corporation) Hidden
TypeScript Tools for Microsoft Visual Studio 2013 (x32 Version: 1.0.5.0 - Microsoft Corporation) Hidden
Update for  (KB2504637) (HKLM-x32\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}.KB2504637) (Version: 1 - Microsoft Corporation)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.39 - VIA Technologies, Inc.)
Visual Studio 2013 Update 4 (KB2829760) (HKLM-x32\...\{53d408db-eb91-43fb-9d8f-167681c19763}) (Version: 12.0.31101 - Microsoft Corporation)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
VMware Player (HKLM-x32\...\VMware_Player) (Version: 5.0.1 - VMware, Inc)
VMware Player (Version: 5.0.1 - VMware, Inc.) Hidden
VS Update core components (x32 Version: 12.0.31101 - Microsoft Corporation) Hidden
Windows Automated Installation Kit (HKLM\...\{31E8F586-4EF7-4500-844D-BA8756474FF1}) (Version: 2.0.0.0 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
World of Tanks (HKLM-x32\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812EU}_is1) (Version:  - Wargaming.net)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== Restore Points =========================


==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {08934B94-3D18-4A98-829A-C8BE14CF0FB4} - System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser => C:\Windows\system32\compattel\DiagTrackRunner.exe [2015-03-16] (Microsoft Corporation)
Task: {215F28A6-47FB-4D35-96E0-29534DDB3496} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {4745C4E6-A9AE-4574-9D1A-B2EF02A68298} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-06-10] (Adobe Systems Incorporated)
Task: {47DDFA35-E87A-4CD4-8B5F-ED83FD731277} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Time-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {81DA8E1A-66CB-4511-B3CD-90AA486BCF61} - System32\Tasks\{291C3BD6-86B1-42A7-9186-CBA962C7F4CD} => pcalua.exe -a "C:\Spiele\Steam\steamapps\common\ARMA 2 Operation Arrowhead\DLCsetup\PMC\datacachepreprocessor.exe" -d "C:\Spiele\Steam\steamapps\common\ARMA 2 Operation Arrowhead" -c -updater
Task: {9FE1298F-98BF-4352-A7AD-05460EC6BB31} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {A2DA6627-9F57-454F-A893-5B5EC8F841FA} - System32\Tasks\Microsoft\Windows\Setup\gwx\launchtrayprocess => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {A3C0E66E-0B09-46CD-9F08-7936EDDB354B} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\Logon-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {AB43AB98-F744-4BE8-BAEB-A8374AB70422} - System32\Tasks\{245BBF70-36F7-4625-B58A-53FA0F62C290} => pcalua.exe -a "C:\Spiele\Steam\steamapps\common\ARMA 2 Operation Arrowhead\DLCsetup\BAF\datacachepreprocessor.exe" -d "C:\Spiele\Steam\steamapps\common\ARMA 2 Operation Arrowhead" -c -updater
Task: {B049213C-D024-4021-B2BD-9C1A55FE8780} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B => schtasks
Task: {BCD3EE38-43D2-4BC2-A206-C1B52E7AB13E} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {E4EDA37E-55A6-48B8-81D1-14E5C058784C} - System32\Tasks\Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-10s => C:\Windows\system32\GWX\GWX.exe [2015-05-07] (Microsoft Corporation)
Task: {FFD49C34-315C-4E57-82FD-C89D1D62EFDA} - System32\Tasks\Microsoft\Windows\Setup\gwx\refreshgwxconfig => C:\Windows\system32\GWX\GWXConfigManager.exe [2015-05-07] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (Whitelisted) ==============

2012-08-02 20:16 - 2015-05-12 05:30 - 00116368 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2015-05-26 21:33 - 2015-05-26 21:33 - 00076152 _____ () C:\Windows\system32\PnkBstrA.exe
2012-08-02 20:22 - 2012-05-23 09:01 - 00078480 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2012-08-02 20:22 - 2012-05-23 09:01 - 00386192 _____ () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2015-05-20 13:22 - 2015-05-08 02:36 - 00011920 _____ () C:\Program Files (x86)\NVIDIA Corporation\Update Core\detoured.dll
2012-11-01 03:34 - 2012-11-01 03:34 - 01260184 _____ () C:\Program Files (x86)\VMware\VMware Player\libxml2.dll
2014-06-15 23:40 - 2014-06-15 23:40 - 02124256 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtCore4.dll
2014-06-15 23:39 - 2014-06-15 23:39 - 07422144 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtGui4.dll
2014-06-15 23:39 - 2014-06-15 23:39 - 02453696 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtDeclarative4.dll
2014-06-15 23:39 - 2014-06-15 23:39 - 01269952 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtScript4.dll
2014-06-15 23:39 - 2014-06-15 23:39 - 00192704 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtSql4.dll
2014-06-15 23:39 - 2014-06-15 23:39 - 00794816 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\QtNetwork4.dll
2013-03-12 18:10 - 2015-04-16 19:40 - 00776192 _____ () C:\Spiele\Steam\SDL2.dll
2015-01-22 08:24 - 2015-04-23 04:16 - 04962816 _____ () C:\Spiele\Steam\v8.dll
2015-01-22 08:24 - 2015-04-23 04:16 - 01556992 _____ () C:\Spiele\Steam\icui18n.dll
2015-01-22 08:24 - 2015-04-23 04:16 - 01187840 _____ () C:\Spiele\Steam\icuuc.dll
2014-05-23 05:22 - 2015-06-04 20:56 - 02407104 _____ () C:\Spiele\Steam\video.dll
2014-08-29 03:16 - 2014-12-01 23:31 - 02396672 _____ () C:\Spiele\Steam\libavcodec-56.dll
2014-08-29 03:16 - 2014-12-01 23:31 - 00442880 _____ () C:\Spiele\Steam\libavutil-54.dll
2014-08-29 03:16 - 2014-12-01 23:31 - 00479744 _____ () C:\Spiele\Steam\libavformat-56.dll
2014-08-29 03:16 - 2014-12-01 23:31 - 00332800 _____ () C:\Spiele\Steam\libavresample-2.dll
2014-08-29 03:16 - 2014-12-01 23:31 - 00485888 _____ () C:\Spiele\Steam\libswscale-3.dll
2012-08-03 08:14 - 2015-06-04 20:56 - 00703168 _____ () C:\Spiele\Steam\bin\chromehtml.DLL
2012-08-03 08:14 - 2015-05-11 21:01 - 36302728 _____ () C:\Spiele\Steam\bin\libcef.dll
2014-10-20 19:21 - 2014-10-20 19:21 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1eeea3ab8d69ec722bdcb28b8eb8dd75\IsdiInterop.ni.dll
2012-08-02 20:26 - 2012-02-01 16:25 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-08-02 20:20 - 2012-05-10 15:03 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)

AlternateDataStreams: C:\ProgramData\TEMP:4FC01C57

==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-3184420333-268895486-2121797410-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Profilname\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.178.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [TCP Query User{C2DF6249-698F-4CB0-A54C-2CC37F1F6D94}C:\users\Profilname\appdata\local\microsoft\windows\temporary internet files\content.ie5\l9v90ybm\hfs.exe] => (Allow) C:\users\Profilname\appdata\local\microsoft\windows\temporary internet files\content.ie5\l9v90ybm\hfs.exe
FirewallRules: [UDP Query User{06D05DA7-0A8B-4B86-BB3C-FBE252EF202D}C:\users\Profilname\appdata\local\microsoft\windows\temporary internet files\content.ie5\l9v90ybm\hfs.exe] => (Allow) C:\users\Profilname\appdata\local\microsoft\windows\temporary internet files\content.ie5\l9v90ybm\hfs.exe
FirewallRules: [TCP Query User{D4178DAA-C515-48B9-969B-E19D6F88E1D1}C:\program files (x86)\hfs fileserver\hfs.exe] => (Allow) C:\program files (x86)\hfs fileserver\hfs.exe
FirewallRules: [UDP Query User{8DBE6A2E-E250-4498-92CC-0BBBB376E664}C:\program files (x86)\hfs fileserver\hfs.exe] => (Allow) C:\program files (x86)\hfs fileserver\hfs.exe
FirewallRules: [{A6B6DDB4-B130-4301-B773-C8D8D80805F7}] => (Allow) C:\Spiele\Steam\Steam.exe
FirewallRules: [{EFA59655-FEC4-46C8-AC8D-BE5F4E0A2919}] => (Allow) C:\Spiele\Steam\Steam.exe
FirewallRules: [{14E1AFEF-DBCA-41E1-B70C-C4E48B3B2932}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{10CDDC57-194D-43A8-AB8B-116FB7E71F56}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{7ACE703C-12FE-4AB4-892F-EF2F98082F02}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{02EC4357-3665-40D8-966A-D4BE693EA684}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [TCP Query User{FE1F2512-7663-4648-B2C9-80026B53E353}C:\users\Profilname\desktop\utorrentportable\app\utorrent\utorrent.exe] => (Allow) C:\users\Profilname\desktop\utorrentportable\app\utorrent\utorrent.exe
FirewallRules: [UDP Query User{49C9EE58-03BC-483E-8EFA-D55CA7E49A29}C:\users\Profilname\desktop\utorrentportable\app\utorrent\utorrent.exe] => (Allow) C:\users\Profilname\desktop\utorrentportable\app\utorrent\utorrent.exe
FirewallRules: [{BABE2604-4C62-406E-905E-BDAD50CFCD5E}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.524\Agent.exe
FirewallRules: [{B9F852BA-B228-450D-9320-D4C30D6C5410}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.524\Agent.exe
FirewallRules: [{21846550-1C1E-44AC-B452-C911ED7DB113}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1225\Agent.exe
FirewallRules: [{C8E298D6-E0DC-49A9-A889-5FF20D1BEC0D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1225\Agent.exe
FirewallRules: [{6F749A5A-157B-45CB-BC8A-544811CCCCC9}] => (Allow) C:\Spiele\Diablo III\Diablo III.exe
FirewallRules: [{E7B9BD85-5116-4375-8311-0330C4D18D51}] => (Allow) C:\Spiele\Diablo III\Diablo III.exe
FirewallRules: [{277F3C94-FAA4-497F-ABFF-2CA6F9F841EE}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1267\Agent.exe
FirewallRules: [{AE2A2804-87EA-4FC1-8BA0-C6A002CBD038}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1267\Agent.exe
FirewallRules: [{853B4061-E25B-4EA4-A732-CB5E499E338C}] => (Allow) C:\Spiele\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{7D031C2F-604D-4DB8-BF6B-D037C4B037B3}] => (Allow) C:\Spiele\Origin Games\Battlefield 3\bf3.exe
FirewallRules: [{B17CC06F-C4C6-49C5-958D-65F76C698253}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1363\Agent.exe
FirewallRules: [{2EB3ACDC-EC26-4CD4-936A-58F0C0053CBF}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1363\Agent.exe
FirewallRules: [{5C814E34-87F2-474B-B764-B77DAC732098}] => (Allow) C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{6C0FB449-4B64-464D-8FCA-9243C2C53442}] => (Allow) C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\SonarHost.exe
FirewallRules: [{8297213C-3106-4FB3-8DFA-E4221B816903}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{E8E0FACE-7E99-466D-BEE3-F5EB5E90747C}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
FirewallRules: [{F811A28B-5465-4471-9F89-1218E168816B}] => (Allow) C:\Spiele\Steam\SteamApps\common\Orcs Must Die 2\build\release\OrcsMustDie2.exe
FirewallRules: [{5EE88DDF-F656-40D5-BDB5-32BF060F0B9F}] => (Allow) C:\Spiele\Steam\SteamApps\common\Orcs Must Die 2\build\release\OrcsMustDie2.exe
FirewallRules: [{42D661FE-8AB9-44DB-9309-22014ADEEDA5}] => (Allow) C:\Spiele\Steam\SteamApps\common\aliens vs predator\AvP_Launcher.exe
FirewallRules: [{AB8957C1-6C6A-4627-A5C2-15B32F760A81}] => (Allow) C:\Spiele\Steam\SteamApps\common\aliens vs predator\AvP_Launcher.exe
FirewallRules: [{B15F0ED8-B621-46CF-8CA1-3DA867ABBA3A}] => (Allow) C:\Spiele\Steam\SteamApps\common\aliens vs predator\AvP_DX11.exe
FirewallRules: [{663F6478-416F-4D4C-A475-177903F8E173}] => (Allow) C:\Spiele\Steam\SteamApps\common\aliens vs predator\AvP_DX11.exe
FirewallRules: [{C2BACE63-6D5A-446E-B0E8-13427180E290}] => (Allow) C:\Spiele\Steam\SteamApps\common\aliens vs predator\AvP.exe
FirewallRules: [{A75CB5B9-E260-4605-A159-E31A9EE91C00}] => (Allow) C:\Spiele\Steam\SteamApps\common\aliens vs predator\AvP.exe
FirewallRules: [{F787A438-1DEB-482F-BFE9-FA7AC6C383F2}] => (Allow) C:\Spiele\Steam\SteamApps\common\command and conquer 3 tiberium wars\CNC3.exe
FirewallRules: [{8D33D765-DDC0-41BB-9357-0A1507D2C2AE}] => (Allow) C:\Spiele\Steam\SteamApps\common\command and conquer 3 tiberium wars\CNC3.exe
FirewallRules: [{4E283797-7564-4FA4-81F3-F3C69AA78ACA}] => (Allow) C:\Spiele\Steam\SteamApps\common\command and conquer 3 tiberium wars\Support\EA Help\Electronic_Arts_Technical_Support.htm
FirewallRules: [{3126A4D8-04CD-4C42-B8A0-1F3D6C73E483}] => (Allow) C:\Spiele\Steam\SteamApps\common\command and conquer 3 tiberium wars\Support\EA Help\Electronic_Arts_Technical_Support.htm
FirewallRules: [{5CE96F08-C68A-4A1E-973B-DA875B79E7E6}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty modern warfare 3\iw5sp.exe
FirewallRules: [{2518E664-F2DA-40E6-BBA3-2EF392313E18}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty modern warfare 3\iw5sp.exe
FirewallRules: [{F8390316-E542-418C-A847-67AF4DD22953}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty modern warfare 3\iw5mp.exe
FirewallRules: [{B0332C68-F2DE-4A6E-83DF-66397315EF47}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty modern warfare 3\iw5mp.exe
FirewallRules: [{A16E97FD-DD46-4AAB-9802-684A177B0CA9}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{7E718200-D5F8-490F-A0FB-5944B92182AD}] => (Allow) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
FirewallRules: [{1AD5372F-4CF4-43D6-8AA1-53F59A74ADAE}] => (Allow) G:\Tobit Radio.fx\Server\rfx-server.exe
FirewallRules: [{DBC32C55-FED8-4402-BD6D-43E9472F8E94}] => (Allow) G:\Tobit Radio.fx\Server\rfx-server.exe
FirewallRules: [{95C40E91-54E5-4584-A197-DB4F15D686A7}] => (Allow) G:\Tobit Radio.fx\Client\rfx-client.exe
FirewallRules: [{21D97969-8895-4515-819A-CBAFE2C39CDA}] => (Allow) G:\Tobit Radio.fx\Client\rfx-client.exe
FirewallRules: [{B7821752-A32F-4ADA-BAC0-264AA1E53E00}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\DLCsetup\PMC\datacachepreprocessor.exe
FirewallRules: [{46EAAD62-3B42-4A44-9D64-FB5DBA337A59}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\DLCsetup\PMC\datacachepreprocessor.exe
FirewallRules: [{071A5E27-C3E1-40CF-A958-342460423F92}] => (Allow) C:\Spiele\Steam\SteamApps\common\Arma 2\arma2.exe
FirewallRules: [{3808B696-EC20-443A-B4FD-9AFC9042536B}] => (Allow) C:\Spiele\Steam\SteamApps\common\Arma 2\arma2.exe
FirewallRules: [TCP Query User{FADA2874-99EB-4A83-9DC0-DCC83BB9A80E}C:\spiele\free to play\world_of_tanks\worldoftanks.exe] => (Allow) C:\spiele\free to play\world_of_tanks\worldoftanks.exe
FirewallRules: [UDP Query User{2172896B-F7B6-4A9C-8380-4E90157CB0AE}C:\spiele\free to play\world_of_tanks\worldoftanks.exe] => (Allow) C:\spiele\free to play\world_of_tanks\worldoftanks.exe
FirewallRules: [{AF21E506-9805-46FA-B266-E076FE1003A4}] => (Block) C:\spiele\free to play\world_of_tanks\worldoftanks.exe
FirewallRules: [{3566207C-F071-45E3-8468-D5ECC1BCA239}] => (Block) C:\spiele\free to play\world_of_tanks\worldoftanks.exe
FirewallRules: [{978CD257-8CD8-44E5-BB14-4A55CDB97ED3}] => (Allow) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe
FirewallRules: [{01580272-2722-4065-A10A-10186C531B2B}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F8D5EB2F-A164-493B-A15E-4AA76735C0E9}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{9CAE1177-02D1-4E0C-8428-47041EE6F58D}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{A9490C56-36CE-438B-9FAD-557FA2E1806C}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{DC54CC25-3DB0-41B1-BC2C-3C953ACD757F}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1363\Agent.exe
FirewallRules: [{12B68F34-258E-401E-B6B2-6DA15DD6202D}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1363\Agent.exe
FirewallRules: [{C36AD314-1D48-4912-8483-77A92D795D5A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
FirewallRules: [{490D070F-BF08-494F-B06A-93D0CFD86196}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.1737\Agent.exe
FirewallRules: [TCP Query User{B94353E9-F7E2-4626-8E9E-74E675D79F5D}C:\program files (x86)\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [UDP Query User{C65BAE63-10BD-41B3-8237-814D717A6F96}C:\program files (x86)\filezilla ftp client\filezilla.exe] => (Allow) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [{FD2B9BC2-0FFB-45A8-AC3B-D8DF23220F3D}] => (Block) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [{FA19CC06-3E09-47A3-AB87-0A099E1285E5}] => (Block) C:\program files (x86)\filezilla ftp client\filezilla.exe
FirewallRules: [{4CA9B7A9-235F-4E24-8365-F092E5E67911}] => (Allow) C:\Spiele\Steam\SteamApps\common\Orcs Must Die 2\build\release\OrcsMustDie2.exe
FirewallRules: [{FADD2E87-57FB-4A0F-8D40-38B7FAA34F52}] => (Allow) C:\Spiele\Steam\SteamApps\common\Orcs Must Die 2\build\release\OrcsMustDie2.exe
FirewallRules: [TCP Query User{A7127235-F5AB-462B-BDCB-E016CE4DD90B}C:\spiele\steam\steamapps\common\orcs must die 2\build\game\orcsmustdie2.exe] => (Allow) C:\spiele\steam\steamapps\common\orcs must die 2\build\game\orcsmustdie2.exe
FirewallRules: [UDP Query User{2AD12397-B029-4FFF-B9B0-20D5E4186225}C:\spiele\steam\steamapps\common\orcs must die 2\build\game\orcsmustdie2.exe] => (Allow) C:\spiele\steam\steamapps\common\orcs must die 2\build\game\orcsmustdie2.exe
FirewallRules: [{9A1CAD2F-1374-4A31-89A0-E55942CEFA47}] => (Block) C:\spiele\steam\steamapps\common\orcs must die 2\build\game\orcsmustdie2.exe
FirewallRules: [{88F95410-2791-4504-A315-9FBBB99C7D33}] => (Block) C:\spiele\steam\steamapps\common\orcs must die 2\build\game\orcsmustdie2.exe
FirewallRules: [TCP Query User{35B5B66B-1C8E-4164-98E1-388E02F797DC}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [UDP Query User{90B1BD82-A641-4EA6-B60B-EF7B00E287F3}C:\program files (x86)\internet explorer\iexplore.exe] => (Allow) C:\program files (x86)\internet explorer\iexplore.exe
FirewallRules: [TCP Query User{5CE3FC1C-DE61-48E6-9E7B-DB681BBBF538}C:\windows\explorer.exe] => (Allow) C:\windows\explorer.exe
FirewallRules: [UDP Query User{6C356C3D-6493-4717-A207-13DC5B267F46}C:\windows\explorer.exe] => (Allow) C:\windows\explorer.exe
FirewallRules: [{92F8621A-088E-4789-B521-38F9FEB177FF}] => (Block) C:\windows\explorer.exe
FirewallRules: [{97D9AB4F-14BC-4892-AC47-19723C8FE20D}] => (Block) C:\windows\explorer.exe
FirewallRules: [{4D8924F0-0A15-40C2-9FC5-692FDB0C0AE4}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\ArmA2OA.exe
FirewallRules: [{F9DE5BDF-CA15-463D-A1CA-B36744080028}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\ArmA2OA.exe
FirewallRules: [{DDD5F695-47E7-4572-A3E4-CC198CA6F74E}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\Expansion\beta\Arma2OA.exe
FirewallRules: [{3EC139A7-A969-4D6A-95EA-E03ABD3BEB32}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\Expansion\beta\Arma2OA.exe
FirewallRules: [{3B0CA6D0-F2FF-4402-92B9-93D476B714BB}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{05C44780-BDD7-411F-B81A-9ACB03ED162C}] => (Allow) C:\Windows\SysWOW64\PnkBstrA.exe
FirewallRules: [{891FFB54-77C7-42E4-8D79-6F264279C926}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{F1FAD904-33EE-478D-B8E2-4645DD0AA8A3}] => (Allow) C:\Windows\SysWOW64\PnkBstrB.exe
FirewallRules: [{86EC669F-909C-442A-9F0E-556028BA6D55}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{3123BD5C-4BA5-4280-B767-6A1F1E6CAEDF}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
FirewallRules: [{9A0CC8D9-8085-4FD1-8097-3D53C5897731}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{91DF4CA0-D59B-4DA5-9DF2-0EC6FF1E65F0}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{534A947A-52AB-4612-858B-3597BA5E3D1A}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{53D15B52-1BFF-4843-A255-BADD943E9E54}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{1CF5BA87-BBA1-4395-B3A9-4591196671C9}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{5E5B0A19-5691-4CAB-8063-EF4B498414FE}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{4AD3DB20-1464-45B1-BABB-C330B4FE4E14}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty modern warfare 3\iw5mp.exe
FirewallRules: [{E75FC4AA-9DF5-4FCA-A30E-D0D743A0649B}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty modern warfare 3\iw5mp.exe
FirewallRules: [TCP Query User{EFAB600B-7338-4AA0-916A-85FBC097A50A}C:\spiele\steam\steam.exe] => (Allow) C:\spiele\steam\steam.exe
FirewallRules: [UDP Query User{5DF3BEAD-C08A-475E-9DED-BA599B2FA939}C:\spiele\steam\steam.exe] => (Allow) C:\spiele\steam\steam.exe
FirewallRules: [{19DAF18A-2B29-49A1-95A6-003F1BCF62A6}] => (Allow) C:\Program Files (x86)\iTunes\iTunes.exe
FirewallRules: [TCP Query User{90A8C26F-217D-4A49-86A1-E89384363745}D:\mirc\mirc.exe] => (Allow) D:\mirc\mirc.exe
FirewallRules: [UDP Query User{86C1AB73-9A50-4DEB-90AF-3ABD3C75EC17}D:\mirc\mirc.exe] => (Allow) D:\mirc\mirc.exe
FirewallRules: [{76B7A0EF-B19E-43BE-AB88-7D627E0F3F9D}] => (Block) D:\mirc\mirc.exe
FirewallRules: [{588A4874-C017-4A7F-A2D8-27DA7FB0FA30}] => (Block) D:\mirc\mirc.exe
FirewallRules: [{EDB222B0-5CB5-4EAD-9817-03BB47A06433}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{FAB05808-CC3C-4C94-8FD7-AC0680555BF7}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2717\Agent.exe
FirewallRules: [{1756112A-EA42-46BC-90BB-91582FC14B8A}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{6425D166-3B50-4D51-B39E-E91C74D9A396}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.beta.2737\Agent.exe
FirewallRules: [{C857AF68-8534-46B8-9AB5-649CD1BA12B8}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [{0AF14283-342E-4B8C-AA12-DDF551008963}] => (Allow) C:\Program Files (x86)\Battle.net\Battle.net.exe
FirewallRules: [TCP Query User{6D56BE39-2262-48F0-8857-1D3086A56ED4}C:\programdata\battle.net\agent\agent.2787\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.2787\agent.exe
FirewallRules: [UDP Query User{19BBBDCF-F2E5-41B0-BF04-64E70C27116E}C:\programdata\battle.net\agent\agent.2787\agent.exe] => (Allow) C:\programdata\battle.net\agent\agent.2787\agent.exe
FirewallRules: [{F66F5550-3CE1-4850-8BC9-10C2135CA59B}] => (Allow) C:\programdata\battle.net\agent\agent.2787\agent.exe
FirewallRules: [{015B7D77-4F77-4B8C-A797-4B7D1B32BD33}] => (Allow) C:\programdata\battle.net\agent\agent.2787\agent.exe
FirewallRules: [{804C8E92-7A8B-49D5-907B-EC770DC0C75E}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{6A3E4C18-50C7-46E8-B730-44CA1A226171}] => (Allow) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{F02A8A10-6D1F-4B3A-AD08-B07A7F05CAB5}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{51E1C0EB-C9A9-49B5-A60F-2385E9D8DFCE}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2816\Agent.exe
FirewallRules: [{292D640D-44C0-499D-8533-7D49BDF1A73E}] => (Allow) C:\Windows\SysWOW64\rundll32.exe
FirewallRules: [{6D4DA3AD-B7A7-4E48-94B5-249F796E0C52}] => (Allow) C:\Windows\SysWOW64\rundll32.exe
FirewallRules: [{D5F9D289-8587-4ACA-AA3F-F3479E012AB7}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\ArmA2OA_BE.exe
FirewallRules: [{E843F8EB-9C29-464E-9A1C-C70BA97684CB}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\ArmA2OA_BE.exe
FirewallRules: [{80570D4E-BA2E-45F5-B509-EC85E9BADC3C}] => (Allow) C:\Spiele\Steam\bin\steamwebhelper.exe
FirewallRules: [{5CF18A8F-CAFE-40DB-8340-BB7369E373B0}] => (Allow) C:\Spiele\Steam\bin\steamwebhelper.exe
FirewallRules: [{8022ED2E-EBBE-4C89-85C1-7BA54FCB71E3}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\DLCsetup\ACR\datacachepreprocessor.exe
FirewallRules: [{6FC330F8-4B1C-4BAC-AEB4-5E6A0843CD8E}] => (Allow) C:\Spiele\Steam\SteamApps\common\arma 2 operation arrowhead\DLCsetup\ACR\datacachepreprocessor.exe
FirewallRules: [{4EA83774-2BBC-495B-AAC5-5B6ABEC12455}] => (Allow) C:\Spiele\Steam\SteamApps\common\Shadow Warrior\sw.exe
FirewallRules: [{5FD86532-2E6C-4F87-B04C-609B07E1BB7B}] => (Allow) C:\Spiele\Steam\SteamApps\common\Shadow Warrior\sw.exe
FirewallRules: [{00FA1147-A534-43AF-BBA9-99DA6A8CB24C}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{29B13CD2-50DA-4E5D-B1B9-675057ACAA80}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer.exe
FirewallRules: [{3BD130D9-CCFB-40C0-ACEC-3C1C93EAFB34}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [{780DF0D1-2736-4040-8F0D-C53782054A2D}] => (Allow) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
FirewallRules: [TCP Query User{AA70D074-33C0-4788-BE28-9F53F212BEEF}C:\spiele\free to play\world_of_tanks\wotlauncher.exe] => (Allow) C:\spiele\free to play\world_of_tanks\wotlauncher.exe
FirewallRules: [UDP Query User{8DC96F09-6E1A-441A-AD54-A170A52C7E15}C:\spiele\free to play\world_of_tanks\wotlauncher.exe] => (Allow) C:\spiele\free to play\world_of_tanks\wotlauncher.exe
FirewallRules: [{04A8A965-FC14-4CE1-82E7-F5CFF2AFCE16}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{E7A6FCCF-E9C3-49D2-B4FE-39774FB56412}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.2880\Agent.exe
FirewallRules: [{63B3FBD8-D4C2-42A1-B3BE-2FD57E967896}] => (Allow) C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\IDE\WDExpress.exe
FirewallRules: [{A19401A4-B32D-4C45-A400-81DA0CF966E5}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{1DA35CC1-C584-4067-A875-AC36C9003BDF}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [TCP Query User{AD4A0F99-80C9-46EB-8A78-2E10649337BC}C:\spiele\dying light\dyinglightgame.exe] => (Block) C:\spiele\dying light\dyinglightgame.exe
FirewallRules: [UDP Query User{07D3278C-F914-4D19-BA09-7DE749CB76FA}C:\spiele\dying light\dyinglightgame.exe] => (Block) C:\spiele\dying light\dyinglightgame.exe
FirewallRules: [{C18A24C5-5129-405F-BEE1-B9D9E5515E92}] => (Allow) C:\Spiele\Steam\SteamApps\common\Shadow Warrior\dx11\launcher.exe
FirewallRules: [{111088EB-8F84-4115-AF0E-8DC7E5FCBC7D}] => (Allow) C:\Spiele\Steam\SteamApps\common\Shadow Warrior\dx11\launcher.exe
FirewallRules: [TCP Query User{13E4AAA8-98C6-4628-BD12-F042361E20BE}D:\d9\programme\m_irc-1635\devilision\mirc.exe] => (Block) D:\d9\programme\m_irc-1635\devilision\mirc.exe
FirewallRules: [UDP Query User{57465715-CFB7-44B4-9917-EC8011B29A13}D:\d9\programme\m_irc-1635\devilision\mirc.exe] => (Block) D:\d9\programme\m_irc-1635\devilision\mirc.exe
FirewallRules: [{9A77DB1E-6FAF-4BA9-8E56-33FB9D379513}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{8F195108-0DD8-4C03-93DC-E5076DDB17AD}] => (Allow) C:\ProgramData\Battle.net\Agent\Agent.3634\Agent.exe
FirewallRules: [{DC14D06B-2FEE-4DCB-95FA-C545624BBCAD}] => (Allow) C:\Spiele\Steam\SteamApps\common\Deus Ex - Human Revolution\dxhr.exe
FirewallRules: [{0B8CF605-58BA-48F4-89DE-733DF6D6D2CD}] => (Allow) C:\Spiele\Steam\SteamApps\common\Deus Ex - Human Revolution\dxhr.exe
FirewallRules: [{02B10BC1-ECCB-4E48-9EF8-EB0CF6758351}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty black ops\BlackOps.exe
FirewallRules: [{26DA827F-935E-4154-91D2-AA59DDAB985D}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty black ops\BlackOps.exe
FirewallRules: [{15AC8A2E-FFFF-4294-A54F-49EC295C658E}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty black ops\BlackOpsMP.exe
FirewallRules: [{C16FEC1E-917F-426E-BB22-AC603B4C7B37}] => (Allow) C:\Spiele\Steam\SteamApps\common\call of duty black ops\BlackOpsMP.exe
FirewallRules: [{676A1B00-8412-495B-A9AA-75B83A67F7B8}] => (Allow) C:\Spiele\Steam\SteamApps\common\skyrim\SkyrimLauncher.exe
FirewallRules: [{155CD1DF-5815-4EBF-89AD-BD75C73D6A31}] => (Allow) C:\Spiele\Steam\SteamApps\common\skyrim\SkyrimLauncher.exe
FirewallRules: [{0C4D746B-339B-45D0-8D4D-609E6450E9C2}] => (Allow) C:\Spiele\Steam\SteamApps\common\DXHRML\dxhrml.exe
FirewallRules: [{AB383C01-EF97-4EA8-8A21-DEF2A763A1C2}] => (Allow) C:\Spiele\Steam\SteamApps\common\DXHRML\dxhrml.exe
FirewallRules: [{52CD97C6-848C-4DA6-89DF-FFE35D8B175E}] => (Allow) C:\Spiele\Steam\SteamApps\common\max payne 3\Max Payne 3\MaxPayne3.exe
FirewallRules: [{03D27DDB-7A55-4209-9397-DF7444A99996}] => (Allow) C:\Spiele\Steam\SteamApps\common\max payne 3\Max Payne 3\MaxPayne3.exe
FirewallRules: [{7800F5BA-F2AE-45B9-9DD6-BA2E6F807FA8}] => (Allow) C:\Spiele\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{9084EA38-373D-4786-9A47-47A571D429FB}] => (Allow) C:\Spiele\Origin Games\Battlefield 4\bf4_x86.exe
FirewallRules: [{E6FD3857-2FC4-4FCA-B4D7-7D0C23CFF6A0}] => (Allow) C:\Spiele\Origin Games\Battlefield 4\bf4.exe
FirewallRules: [{D006741F-2531-4748-AC7C-2934D0D7C7E5}] => (Allow) C:\Spiele\Origin Games\Battlefield 4\bf4.exe

==================== Faulty Device Manager Devices =============

Name: USB (Universal Serial Bus)-Controller
Description: USB (Universal Serial Bus)-Controller
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/19/2015 07:12:37 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).

Error: (06/19/2015 00:00:00 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).

Error: (06/18/2015 07:12:10 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).

Error: (06/18/2015 00:00:00 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).

Error: (06/17/2015 07:52:52 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).

Error: (06/16/2015 04:19:21 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).

Error: (06/15/2015 00:00:01 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Beschreibung = Geplanter Prüfpunkt; Fehler = 0x80070422).

Error: (06/14/2015 00:18:52 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).

Error: (06/14/2015 02:06:14 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).

Error: (06/14/2015 01:06:04 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\svchost.exe -k netsvcs; Beschreibung = Windows Update; Fehler = 0x80070422).


System errors:
=============
Error: (06/19/2015 08:16:15 PM) (Source: Microsoft-Windows-DriverFrameworks-UserMode) (EventID: 10101) (User: NT-AUTORITÄT)
Description: Das Treiberpaket konnte nicht installiert werden. Der letzte Status war "1115".

Error: (06/18/2015 02:04:30 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (06/13/2015 00:30:39 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.

Error: (06/11/2015 04:32:06 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "FailureCommand" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (06/11/2015 04:32:04 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Start" aufgrund folgenden Fehlers fehlgeschlagen: 
%%5

Error: (06/09/2015 04:54:10 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (06/09/2015 04:54:10 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (06/09/2015 04:54:09 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (06/09/2015 04:54:09 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (06/09/2015 00:19:21 PM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.


Microsoft Office:
=========================
Error: (06/19/2015 07:12:37 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422

Error: (06/19/2015 00:00:00 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422

Error: (06/18/2015 07:12:10 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422

Error: (06/18/2015 00:00:00 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422

Error: (06/17/2015 07:52:52 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422

Error: (06/16/2015 04:19:21 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422

Error: (06/15/2015 00:00:01 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreationGeplanter Prüfpunkt0x80070422

Error: (06/14/2015 00:18:52 PM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422

Error: (06/14/2015 02:06:14 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422

Error: (06/14/2015 01:06:04 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\svchost.exe -k netsvcsWindows Update0x80070422


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-3770K CPU @ 3.50GHz
Percentage of memory in use: 16%
Total physical RAM: 16346.25 MB
Available physical RAM: 13605.07 MB
Total Pagefile: 32690.71 MB
Available Pagefile: 29701.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:476.71 GB) (Free:89.87 GB) NTFS
Drive d: (Volume) (Fixed) (Total:2794.39 GB) (Free:913.44 GB) NTFS
Drive f: (CDROM) (CDROM) (Total:1.47 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 476.9 GB) (Disk ID: 991376CB)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 2794.5 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End of log ============================

FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:13-06-2015
Ran by Profilname (administrator) on Profilname-DESKTOP on 21-06-2015 07:32:46
Running from C:\Users\Profilname\Desktop
Loaded Profiles: Profilname (Available Profiles: Profilname)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\SLManagerEasy\Inputps.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\System32\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Valve Corporation) C:\Spiele\Steam\Steam.exe
(Valve Corporation) C:\Spiele\Steam\bin\steamwebhelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-08] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5120144 2012-05-23] (VIA)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-12-17] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [EADM] => C:\Spiele\Origin\Origin.exe [3632472 2015-06-03] (Electronic Arts)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [Steam] => C:\Spiele\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-12-17] (Samsung)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [Skype] => C:\Users\Profilname\AppData\Roaming\Skype\Phone\Skype.exe [811008 2014-05-10] ()
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\MountPoints2: {6a39d9d5-21a6-11e2-aae8-902b34312428} - G:\Windows\CHECK\DriveNavigator.exe
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\MountPoints2: {c028ed50-dd2d-11e1-8b35-806e6f6e6963} - E:\install.EXE id= ver=1.0.0.0

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3184420333-268895486-2121797410-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKU\S-1-5-21-3184420333-268895486-2121797410-1000 -> DefaultScope {9F24406C-E1F8-4D62-B61C-4B0120CD5F63} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3184420333-268895486-2121797410-1000 -> {9F24406C-E1F8-4D62-B61C-4B0120CD5F63} URL = https://www.google.com/search?q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-06-03] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-06-03] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: AntiGameOrigin - C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default\Extensions\antigameorigin@antigame.de.xpi [2014-03-17]
FF Extension: NoScript - C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-08-02]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 bufssvr; C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe [90112 2010-03-12] (BUFFALO INC.) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-08] (NVIDIA Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-10] (Intel Corporation)
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58387104 2014-07-12] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-08] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-08] (NVIDIA Corporation)
S3 Origin Client Service; C:\Spiele\Origin\OriginClientService.exe [1997168 2015-06-03] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2015-05-26] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] ()
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [441504 2014-07-12] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2012-05-04] (VIA Technologies, Inc.)
R2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe [79872 2012-11-01] (VMware, Inc.) [File not signed]
S3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 JabraDFU; C:\Windows\System32\Drivers\JabraBcDfuX64.sys [39288 2014-11-27] (GN Netcom A/S)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-21 07:32 - 2015-06-21 07:33 - 00014968 _____ C:\Users\Profilname\Desktop\FRST.txt
2015-06-21 07:32 - 2015-06-21 07:32 - 00000000 ____D C:\FRST
2015-06-21 07:31 - 2015-06-21 07:31 - 00000472 _____ C:\Users\Profilname\Desktop\defogger_disable.log
2015-06-21 07:31 - 2015-06-21 07:31 - 00000000 _____ C:\Users\Profilname\defogger_reenable
2015-06-21 07:29 - 2015-06-21 07:29 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Profilname\Desktop\tdsskiller.exe
2015-06-21 07:26 - 2015-06-21 07:26 - 02109952 _____ (Farbar) C:\Users\Profilname\Desktop\FRST64.exe
2015-06-21 07:26 - 2015-06-21 07:26 - 00050477 _____ C:\Users\Profilname\Desktop\Defogger.exe
2015-06-21 07:25 - 2015-06-21 07:25 - 00380416 _____ C:\Users\Profilname\Desktop\Gmer-if4hbj4t.exe
2015-06-21 07:22 - 2015-06-21 07:22 - 00000900 _____ C:\Unbenanntes Dokument
2015-06-21 07:14 - 2015-06-21 07:14 - 00000776 _____ C:\Unbenanntes Dokument~
2015-06-19 06:43 - 2015-06-19 06:43 - 00001077 _____ C:\Users\Profilname\Desktop\Kaspersky Security Scan.lnk
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-06-18 09:43 - 2015-06-19 06:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-06-10 05:10 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 05:10 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 05:10 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 05:10 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 05:10 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 05:10 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 05:10 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 05:10 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 05:10 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 05:10 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 05:10 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 05:10 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 05:10 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 05:10 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 05:10 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 05:10 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 05:10 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 05:10 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 05:10 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 05:10 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:10 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 05:10 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 05:10 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 05:10 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 05:10 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 05:10 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 05:10 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 05:10 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 05:10 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 05:10 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 05:10 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 05:10 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 05:10 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 05:10 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 05:10 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 05:10 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 05:10 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 05:10 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 05:10 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 05:10 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 05:10 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 05:10 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 05:10 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 05:10 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 05:10 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 05:10 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 05:10 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 05:10 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 05:10 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 05:10 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 05:10 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 05:10 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 05:10 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 05:10 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 05:10 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 05:10 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 05:10 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 05:10 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 05:10 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 05:10 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 05:10 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 05:10 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 05:10 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 05:10 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 05:10 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 05:10 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 05:10 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 05:10 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 05:10 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 05:10 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 05:10 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 05:10 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 05:10 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 05:10 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 05:10 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 05:10 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 05:10 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 05:10 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 05:10 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 05:10 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 05:10 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 05:10 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 05:10 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 05:10 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 05:10 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-02 15:37 - 2015-06-02 15:37 - 00000000 ____D C:\Users\Profilname\AppData\Local\GWX
2015-05-26 21:33 - 2015-05-26 21:33 - 00076152 _____ C:\Windows\system32\PnkBstrA.exe
2015-05-26 21:22 - 2015-05-26 21:22 - 01533584 _____ C:\Users\Profilname\Desktop\battlelog-web-plugins_2.6.2_157.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-21 07:31 - 2012-08-03 08:09 - 00000000 ____D C:\ProgramData\Origin
2015-06-21 07:31 - 2012-08-02 16:05 - 00000000 ____D C:\Users\Profilname
2015-06-21 07:31 - 2009-07-14 06:45 - 00026128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-21 07:31 - 2009-07-14 06:45 - 00026128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-21 07:29 - 2009-07-14 19:58 - 00768288 _____ C:\Windows\system32\perfh007.dat
2015-06-21 07:29 - 2009-07-14 19:58 - 00176044 _____ C:\Windows\system32\perfc007.dat
2015-06-21 07:29 - 2009-07-14 07:13 - 01815528 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-21 07:27 - 2012-08-02 16:05 - 01573652 _____ C:\Windows\WindowsUpdate.log
2015-06-21 07:23 - 2013-02-01 09:24 - 00000000 ____D C:\ProgramData\VMware
2015-06-21 07:23 - 2012-08-02 20:16 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-21 07:23 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-21 07:23 - 2009-07-14 06:51 - 00181205 _____ C:\Windows\setupact.log
2015-06-19 20:15 - 2012-08-02 21:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-19 19:50 - 2012-08-02 20:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-19 09:01 - 2012-08-02 21:12 - 00000000 ____D C:\Users\Profilname\AppData\Local\Thunderbird
2015-06-15 08:41 - 2014-01-09 16:32 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\mIRC
2015-06-14 21:54 - 2013-03-27 05:00 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\vlc
2015-06-14 18:41 - 2013-03-15 02:57 - 00000000 ____D C:\Users\Profilname\AppData\Local\QuickPar
2015-06-13 17:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-13 13:39 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-11 04:22 - 2014-11-15 08:54 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieBrowserModeList
2015-06-11 04:22 - 2014-04-14 11:26 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieUserList
2015-06-11 04:22 - 2014-04-14 11:26 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieSiteList
2015-06-11 04:22 - 2009-07-14 06:45 - 00344912 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 04:21 - 2014-12-10 04:19 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 04:21 - 2014-04-29 15:00 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-11 04:21 - 2012-08-02 16:22 - 00335668 _____ C:\Windows\PFRO.log
2015-06-11 04:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-10 05:28 - 2012-08-02 16:14 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-10 05:26 - 2013-08-14 03:00 - 00000000 ____D C:\Windows\system32\MRT
2015-06-10 05:24 - 2012-08-02 20:56 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 04:57 - 2014-06-14 19:59 - 00000000 ____D C:\Users\Profilname\AppData\Local\Adobe
2015-06-10 04:57 - 2012-08-02 20:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-10 04:57 - 2012-08-02 20:10 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-10 04:57 - 2012-08-02 20:10 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-03 07:00 - 2012-08-03 08:08 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\Origin
2015-05-27 20:45 - 2012-10-09 11:39 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2015-05-26 21:32 - 2012-08-03 10:50 - 00226680 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2015-05-26 21:23 - 2012-08-03 10:50 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0

==================== Files in the root of some directories =======

2013-04-07 16:45 - 2013-04-07 16:45 - 0000288 _____ () C:\Users\Profilname\AppData\Roaming\.backup.dm

Some files in TEMP:
====================
C:\Users\Profilname\AppData\Local\Temp\AskSLib.dll
C:\Users\Profilname\AppData\Local\Temp\fp_pl_pfs_installer.exe
C:\Users\Profilname\AppData\Local\Temp\Inputps.exe
C:\Users\Profilname\AppData\Local\Temp\mirc635.exe
C:\Users\Profilname\AppData\Local\Temp\nv3DVStreaming.dll
C:\Users\Profilname\AppData\Local\Temp\nvSCPAPI.dll
C:\Users\Profilname\AppData\Local\Temp\nvStereoApiI.dll
C:\Users\Profilname\AppData\Local\Temp\nvStInst.exe
C:\Users\Profilname\AppData\Local\Temp\ose00000.exe
C:\Users\Profilname\AppData\Local\Temp\pp5fi1oq.dll
C:\Users\Profilname\AppData\Local\Temp\sonarinst.exe
C:\Users\Profilname\AppData\Local\Temp\TOBITCLT.DLL
C:\Users\Profilname\AppData\Local\Temp\USBUnplugMonitor.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-13 12:48

==================== End of log ============================

Armer_Thor · 21.06.2015, 07:16

Gmer
-- Beim Start: C:\Windows\system32\config\system: Der Prozess kann nicht auf die Datei zugreifen,da sie von einem anderen Prozess verwendet wird.
--- Während des Scans: C:\Users\Profilname\ntuser.dater Prozess kann nicht auf die Datei zugreifen,da sie von einem anderen Prozess verwendet wird

Code:

ATTFilter

GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-06-21 07:42:04
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-2 Samsung_ rev.DXM0 476,94GB
Running: Gmer-if4hbj4t.exe; Driver: C:\Users\Profilname\AppData\Local\Temp\kglyqaow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe[2112] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                                                                                                                                          00000000774d0084 5 bytes JMP 0000000169921986
.text    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2616] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                                                                                                  0000000074eb2ab1 5 bytes JMP 00000001009e2dcc
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                                               0000000077091401 2 bytes JMP 7536b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                                                 0000000077091419 2 bytes JMP 7536b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                                               0000000077091431 2 bytes JMP 753e8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                                               000000007709144a 2 bytes CALL 7534489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                                          * 9
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                                                  00000000770914dd 2 bytes JMP 753e8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                                           00000000770914f5 2 bytes JMP 753e89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                                                  000000007709150d 2 bytes JMP 753e8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                                           0000000077091525 2 bytes JMP 753e8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                                                 000000007709153d 2 bytes JMP 7535fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                                                      0000000077091555 2 bytes JMP 753668ef C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                                               000000007709156d 2 bytes JMP 753e8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                                                 0000000077091585 2 bytes JMP 753e8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                                                    000000007709159d 2 bytes JMP 753e86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                                                 00000000770915b5 2 bytes JMP 7535fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                                               00000000770915cd 2 bytes JMP 7536b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                                           00000000770916b2 2 bytes JMP 753e8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\system32\PnkBstrA.exe[3168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                                           00000000770916bd 2 bytes JMP 753e8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\vmnat.exe[3344] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 4                                                                                                                                                                                    0000000073ec13b0 2 bytes JMP 75e35660 C:\Windows\syswow64\SHELL32.dll
.text    C:\Windows\SysWOW64\vmnat.exe[3344] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 20                                                                                                                                                                                   0000000073ec13c0 2 bytes CALL 76c09cee C:\Windows\syswow64\msvcrt.dll
.text    ...                                                                                                                                                                                                                                                                          * 20
.text    C:\Windows\SysWOW64\vmnat.exe[3344] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 22                                                                                                                                                                                   0000000073ec153e 2 bytes CALL 75ec7794 C:\Windows\syswow64\SHELL32.dll
.text    C:\Windows\SysWOW64\vmnat.exe[3344] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 43                                                                                                                                                                                   0000000073ec1553 2 bytes CALL 753410ff C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                   0000000077091401 2 bytes JMP 7536b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                     0000000077091419 2 bytes JMP 7536b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                   0000000077091431 2 bytes JMP 753e8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                   000000007709144a 2 bytes CALL 7534489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                                          * 9
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                      00000000770914dd 2 bytes JMP 753e8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                               00000000770914f5 2 bytes JMP 753e89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                      000000007709150d 2 bytes JMP 753e8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                               0000000077091525 2 bytes JMP 753e8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                     000000007709153d 2 bytes JMP 7535fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                          0000000077091555 2 bytes JMP 753668ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                   000000007709156d 2 bytes JMP 753e8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                     0000000077091585 2 bytes JMP 753e8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                        000000007709159d 2 bytes JMP 753e86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                     00000000770915b5 2 bytes JMP 7535fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                   00000000770915cd 2 bytes JMP 7536b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                               00000000770916b2 2 bytes JMP 753e8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe[3540] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                               00000000770916bd 2 bytes JMP 753e8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Windows\SysWOW64\rundll32.exe[5820] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                                                                                                                                                                    0000000074fe26e6 5 bytes JMP 00000001026b10f8
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\SspiCli.dll!DeleteSecurityContext                                                                                                                                                            0000000074e40bb9 5 bytes JMP 0000000116c43990
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\SspiCli.dll!EncryptMessage                                                                                                                                                                   0000000074e4124e 5 bytes JMP 0000000116c438df
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!InternetCloseHandle                                                                                                                                                              0000000075161bb0 5 bytes JMP 0000000116c443ca
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW                                                                                                                                                                 0000000075165ab0 5 bytes JMP 0000000116c44200
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!HttpSendRequestW                                                                                                                                                                 0000000075168770 5 bytes JMP 0000000116c442e3
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!InternetReadFile                                                                                                                                                                 0000000075171c80 5 bytes JMP 0000000116c44c0e
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable                                                                                                                                                       0000000075177540 5 bytes JMP 0000000116c44b81
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!InternetReadFileExA                                                                                                                                                              0000000075198010 5 bytes JMP 0000000116c44ccf
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!HttpSendRequestExW                                                                                                                                                               00000000751c43d0 5 bytes JMP 0000000116c443a5
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!HttpSendRequestA                                                                                                                                                                 00000000751dd8a0 5 bytes JMP 0000000116c44231
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!InternetErrorDlg                                                                                                                                                                 00000000751e0690 5 bytes JMP 0000000116c443e3
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!HttpOpenRequestA                                                                                                                                                                 00000000751e41a0 5 bytes JMP 0000000116c441cf
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!InternetOpenUrlA                                                                                                                                                                 0000000075236000 5 bytes JMP 0000000116c44179
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!InternetOpenUrlW                                                                                                                                                                 0000000075236ac0 5 bytes JMP 0000000116c441a4
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WININET.dll!HttpSendRequestExA                                                                                                                                                               000000007525a4b0 5 bytes JMP 0000000116c44395
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WS2_32.dll!closesocket                                                                                                                                                                       0000000076ef3918 5 bytes JMP 0000000110ac189e
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WS2_32.dll!connect                                                                                                                                                                           0000000076ef6bdd 5 bytes JMP 0000000110ac16df
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\WS2_32.dll!send                                                                                                                                                                              0000000076ef6f01 5 bytes JMP 0000000110ac184c
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\CRYPT32.dll!PFXImportCertStore                                                                                                                                                               0000000074fe26e6 5 bytes JMP 000000010df210f8
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                          0000000077091401 2 bytes JMP 7536b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                            0000000077091419 2 bytes JMP 7536b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                          0000000077091431 2 bytes JMP 753e8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                          000000007709144a 2 bytes CALL 7534489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                                          * 9
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                             00000000770914dd 2 bytes JMP 753e8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                      00000000770914f5 2 bytes JMP 753e89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                             000000007709150d 2 bytes JMP 753e8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                      0000000077091525 2 bytes JMP 753e8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                            000000007709153d 2 bytes JMP 7535fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                                 0000000077091555 2 bytes JMP 753668ef C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                          000000007709156d 2 bytes JMP 753e8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                            0000000077091585 2 bytes JMP 753e8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                               000000007709159d 2 bytes JMP 753e86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                            00000000770915b5 2 bytes JMP 7535fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                          00000000770915cd 2 bytes JMP 7536b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                      00000000770916b2 2 bytes JMP 753e8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5620] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                      00000000770916bd 2 bytes JMP 753e8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17                                                                                                                                                                                      0000000077091401 2 bytes JMP 7536b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17                                                                                                                                                                                        0000000077091419 2 bytes JMP 7536b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17                                                                                                                                                                                      0000000077091431 2 bytes JMP 753e8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42                                                                                                                                                                                      000000007709144a 2 bytes CALL 7534489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                                          * 9
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                                                                                                                                                                                         00000000770914dd 2 bytes JMP 753e8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17                                                                                                                                                                                  00000000770914f5 2 bytes JMP 753e89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                                                                                                                                                                                         000000007709150d 2 bytes JMP 753e8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17                                                                                                                                                                                  0000000077091525 2 bytes JMP 753e8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17                                                                                                                                                                                        000000007709153d 2 bytes JMP 7535fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                                                                                                                                                                                             0000000077091555 2 bytes JMP 753668ef C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17                                                                                                                                                                                      000000007709156d 2 bytes JMP 753e8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17                                                                                                                                                                                        0000000077091585 2 bytes JMP 753e8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                                                                                                                                                                                           000000007709159d 2 bytes JMP 753e86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17                                                                                                                                                                                        00000000770915b5 2 bytes JMP 7535fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17                                                                                                                                                                                      00000000770915cd 2 bytes JMP 7536b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20                                                                                                                                                                                  00000000770916b2 2 bytes JMP 753e8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\Steam.exe[6352] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31                                                                                                                                                                                  00000000770916bd 2 bytes JMP 753e8671 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                                                                                         0000000077091401 2 bytes JMP 7536b21b C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                                                                                           0000000077091419 2 bytes JMP 7536b346 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                                                                                         0000000077091431 2 bytes JMP 753e8f29 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                                                                                         000000007709144a 2 bytes CALL 7534489d C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                                                          * 9
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                                                                                            00000000770914dd 2 bytes JMP 753e8822 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                                                                                     00000000770914f5 2 bytes JMP 753e89f8 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                                                                                            000000007709150d 2 bytes JMP 753e8718 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                                                                                     0000000077091525 2 bytes JMP 753e8ae2 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                                                                                           000000007709153d 2 bytes JMP 7535fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                                                                                                0000000077091555 2 bytes JMP 753668ef C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                                                                                         000000007709156d 2 bytes JMP 753e8fe3 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                                                                                           0000000077091585 2 bytes JMP 753e8b42 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                                                                                              000000007709159d 2 bytes JMP 753e86dc C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                                                                                           00000000770915b5 2 bytes JMP 7535fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                                                                                         00000000770915cd 2 bytes JMP 7536b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                                                                                     00000000770916b2 2 bytes JMP 753e8ea4 C:\Windows\syswow64\kernel32.dll
.text    C:\Spiele\Steam\bin\steamwebhelper.exe[6372] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                                                                                     00000000770916bd 2 bytes JMP 753e8671 C:\Windows\syswow64\kernel32.dll

---- User IAT/EAT - GMER 2.1 ----

IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Program Files\Internet Explorer\iexplore.exe[KERNEL32.dll!GetProcAddress]                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW]                                                                                                                                                              [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW]                                                                                                                                                          [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW]                                                                                                                                                      [7feef74d840] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow]                                                                                                                                                             [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                          [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA]                                                                                                                                                          [7feef7763e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW]                                                                                                                                                              [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow]                                                                                                                                                             [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                          [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW]                                                                                                                                                              [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW]                                                                                                                                                      [7feef74d840] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow]                                                                                                                                                               [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                            [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW]                                                                                                                                                                [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow]                                                                                                                                                            [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!EnableWindow]                                                                [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!DialogBoxIndirectParamW]                                                     [7feef776300] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[KERNEL32.dll!GetProcAddress]                                                            [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow]                                                                                                                                                            [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW]                                                                                                                                                 [7feef776300] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW]                                                                                                                                                             [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW]                                                                                                                                                        [7feef777160] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow]                                                                                                                                                              [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                           [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW]                                                                                                                                                          [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\netprofm.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                            [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                   [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                         [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow]                                                                                                                                                            [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW]                                                                                                                                                             [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\explorerframe.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                   [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\explorerframe.dll[USER32.dll!EnableWindow]                                                                                                                                                       [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\DUI70.dll[USER32.dll!EnableWindow]                                                                                                                                                               [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\msfeeds.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\elscore.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                            [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\DXGIDebug.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                       [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\NaturalLanguage6.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\tquery.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\StructuredQuery.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                 [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\mshtml.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\mshtml.dll[USER32.dll!MessageBoxW]                                                                                                                                                               [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\mshtml.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                           [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\mshtml.dll[USER32.dll!EnableWindow]                                                                                                                                                              [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\Wpc.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                             [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\wevtapi.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\WINHTTP.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\webio.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\ntshrui.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                          [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\ntshrui.dll[USER32.dll!EnableWindow]                                                                                                                                                             [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\ieapfltr.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\EhStorShell.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                     [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\cscui.dll[USER32.dll!EnableWindow]                                                                                                                                                               [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\cscui.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                            [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\cscui.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\CSCDLL.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll[KERNEL32.dll!GetProcAddress]                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\actxprxy.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                        [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\thumbcache.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                      [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SHDOCVW.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SHDOCVW.dll[USER32.dll!EnableWindow]                                                                                                                                                             [7feef733370] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\SHDOCVW.dll[USER32.dll!DialogBoxParamW]                                                                                                                                                          [7feef7764e0] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\NetworkExplorer.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                 [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                             [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\WINSTA.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                          [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\DAVHLPR.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                         [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\WINMM.dll[USER32.dll!MessageBoxW]                                                                                                                                                                [7feef776a70] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                           [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll
IAT      C:\Program Files\Internet Explorer\iexplore.exe[4312] @ C:\Windows\System32\NLSData0007.dll[KERNEL32.dll!GetProcAddress]                                                                                                                                                     [7feef731800] C:\Program Files\Internet Explorer\IEShims.dll

---- Threads - GMER 2.1 ----

Thread   C:\Windows\SysWOW64\rundll32.exe [5820:5828]                                                                                                                                                                                                                                 0000000000090000
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:5852]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:5856]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:4648]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:2452]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:2484]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:2856]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:5392]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:5268]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:6880]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:740]                                                                                                                                                                                                                                  00000000002a0000
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:6052]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Windows\SysWOW64\rundll32.exe [5820:6484]                                                                                                                                                                                                                                 00000000024183d3
Thread   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5620:2808]                                                                                                                                                                                                            0000000016a70000
Thread   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5620:6976]                                                                                                                                                                                                            0000000016c4c2d4
Thread   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5620:6828]                                                                                                                                                                                                            0000000016c4c2d4
Thread   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5620:4004]                                                                                                                                                                                                            00000000067b0000
Thread   C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE [5620:6124]                                                                                                                                                                                                            0000000010820000
---- Processes - GMER 2.1 ----

Library  C:\ProgramData\Kaspersky Lab\KSS2\DataRoot\Bases\Cache\klavemu.kdl.6e86633e63e607038cfa66d3f88c5d60 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [2112] (Heuristics engine/Kaspersky Lab ZAO)(2015-06-19 04:44:17)        000000006fab0000
Library  C:\ProgramData\Kaspersky Lab\KSS2\DataRoot\Bases\Cache\kjim.kdl.4d87815dc55a0ea5f712a61bb640573a (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [2112] (Script Heuristics Engine/Kaspersky Lab ZAO)(2015-06-19 04:44:18)    0000000073a80000
Library  C:\ProgramData\Kaspersky Lab\KSS2\DataRoot\Bases\Cache\qscan.kdl.6f421f0667a2208fb2f4dc2a03912f82 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [2112] (Initial Scan Engine/Kaspersky Lab ZAO)(2015-06-19 04:44:19)        0000000073160000
Library  C:\ProgramData\Kaspersky Lab\KSS2\DataRoot\Bases\Cache\pbs.kdl.855e976d16841a9bbaa528a886998eee (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [2112] (Extensional Scan Engine/Kaspersky Lab ZAO)(2015-06-19 04:44:19)      000000006ac30000
Library  C:\ProgramData\Kaspersky Lab\KSS2\DataRoot\Bases\Cache\kavsys.kdl.ba76be53c8245ddbd0e2864e74f8f638 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [2112] (Set of system interfaces/Kaspersky Lab ZAO)(2015-06-19 04:44:22)  00000000062d0000

---- Disk sectors - GMER 2.1 ----

Disk     \Device\Harddisk0\DR0                                                                                                                                                                                                                                                        unknown MBR code

---- EOF - GMER 2.1 ----

Armer_Thor · 21.06.2015, 07:17

tdsskiller

Code:

ATTFilter

07:45:52.0155 0x1bdc  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
07:45:52.0155 0x1bdc  UEFI system
07:45:56.0226 0x1bdc  ============================================================
07:45:56.0226 0x1bdc  Current date / time: 2015/06/21 07:45:56.0226
07:45:56.0226 0x1bdc  SystemInfo:
07:45:56.0226 0x1bdc  
07:45:56.0226 0x1bdc  OS Version: 6.1.7601 ServicePack: 1.0
07:45:56.0226 0x1bdc  Product type: Workstation
07:45:56.0226 0x1bdc  ComputerName: Profilname-DESKTOP
07:45:56.0226 0x1bdc  UserName: Profilname
07:45:56.0226 0x1bdc  Windows directory: C:\Windows
07:45:56.0226 0x1bdc  System windows directory: C:\Windows
07:45:56.0226 0x1bdc  Running under WOW64
07:45:56.0226 0x1bdc  Processor architecture: Intel x64
07:45:56.0226 0x1bdc  Number of processors: 8
07:45:56.0226 0x1bdc  Page size: 0x1000
07:45:56.0226 0x1bdc  Boot type: Normal boot
07:45:56.0226 0x1bdc  ============================================================
07:45:56.0258 0x1bdc  KLMD registered as C:\Windows\system32\drivers\80825496.sys
07:45:56.0289 0x1bdc  System UUID: {3D2B1979-FD93-983E-E11D-5690CCB60C75}
07:45:56.0445 0x1bdc  Drive \Device\Harddisk0\DR0 - Size: 0x773C256000 ( 476.94 Gb ), SectorSize: 0x200, Cylinders: 0xF334, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
07:45:56.0445 0x1bdc  Drive \Device\Harddisk1\DR1 - Size: 0x2BAA1476000 ( 2794.52 Gb ), SectorSize: 0x200, Cylinders: 0x59101, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
07:45:56.0445 0x1bdc  ============================================================
07:45:56.0445 0x1bdc  \Device\Harddisk0\DR0:
07:45:56.0445 0x1bdc  GPT partitions:
07:45:56.0445 0x1bdc  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {23A24EF2-BBCF-11E2-9DD3-005056C00008}, Name: EFI system partition, StartLBA 0x800, BlocksNum 0x32000
07:45:56.0445 0x1bdc  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {23A24EF3-BBCF-11E2-9DD3-005056C00008}, Name: Microsoft reserved partition, StartLBA 0x32800, BlocksNum 0x40000
07:45:56.0445 0x1bdc  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {23A24EF4-BBCF-11E2-9DD3-005056C00008}, Name: Basic data partition, StartLBA 0x72800, BlocksNum 0x3B96CA34
07:45:56.0445 0x1bdc  MBR partitions:
07:45:56.0445 0x1bdc  \Device\Harddisk1\DR1:
07:45:56.0445 0x1bdc  GPT partitions:
07:45:56.0445 0x1bdc  \Device\Harddisk1\DR1\Partition1: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {E9822CC8-894C-4C08-9D42-07A4437DB1AD}, Name: Microsoft reserved partition, StartLBA 0x22, BlocksNum 0x40000
07:45:56.0445 0x1bdc  \Device\Harddisk1\DR1\Partition2: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {ECF66571-F178-48F0-927A-8A9082CBB62B}, Name: Basic data partition, StartLBA 0x40800, BlocksNum 0x5D4C9800
07:45:56.0445 0x1bdc  MBR partitions:
07:45:56.0445 0x1bdc  ============================================================
07:45:56.0445 0x1bdc  C: <-> \Device\Harddisk0\DR0\Partition3
07:45:56.0507 0x1bdc  D: <-> \Device\Harddisk1\DR1\Partition2
07:45:56.0507 0x1bdc  ============================================================
07:45:56.0507 0x1bdc  Initialize success
07:45:56.0507 0x1bdc  ============================================================
07:46:10.0079 0x17a0  ============================================================
07:46:10.0079 0x17a0  Scan started
07:46:10.0079 0x17a0  Mode: Manual; SigCheck; TDLFS; 
07:46:10.0079 0x17a0  ============================================================
07:46:10.0079 0x17a0  KSN ping started
07:46:12.0435 0x17a0  KSN ping finished: true
07:46:12.0606 0x17a0  ================ Scan system memory ========================
07:46:12.0606 0x17a0  System memory - ok
07:46:12.0606 0x17a0  ================ Scan services =============================
07:46:12.0622 0x17a0  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
07:46:12.0653 0x17a0  1394ohci - ok
07:46:12.0653 0x17a0  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
07:46:12.0669 0x17a0  ACPI - ok
07:46:12.0669 0x17a0  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
07:46:12.0684 0x17a0  AcpiPmi - ok
07:46:12.0684 0x17a0  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
07:46:12.0684 0x17a0  AdobeARMservice - ok
07:46:12.0700 0x17a0  [ 7C58046ACEAF10525077BD586A740E9F, E26D446EDB158A9EDA7FC7E1DA650FA8896748B7DEB9FDBF5BD4352ACF01B721 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
07:46:12.0716 0x17a0  AdobeFlashPlayerUpdateSvc - ok
07:46:12.0716 0x17a0  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
07:46:12.0731 0x17a0  adp94xx - ok
07:46:12.0731 0x17a0  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
07:46:12.0747 0x17a0  adpahci - ok
07:46:12.0747 0x17a0  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
07:46:12.0762 0x17a0  adpu320 - ok
07:46:12.0762 0x17a0  [ 83BFCCAC53795E8A5055A93672D0C46C, B2B03473D950A5BA9DE59D81E7B14C1FAFF17B2A4D8A5808588F5CC21D63B291 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
07:46:12.0762 0x17a0  AeLookupSvc - ok
07:46:12.0778 0x17a0  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
07:46:12.0794 0x17a0  AFD - ok
07:46:12.0794 0x17a0  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
07:46:12.0794 0x17a0  agp440 - ok
07:46:12.0794 0x17a0  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
07:46:12.0809 0x17a0  ALG - ok
07:46:12.0809 0x17a0  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
07:46:12.0809 0x17a0  aliide - ok
07:46:12.0809 0x17a0  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
07:46:12.0825 0x17a0  amdide - ok
07:46:12.0825 0x17a0  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
07:46:12.0825 0x17a0  AmdK8 - ok
07:46:12.0840 0x17a0  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
07:46:12.0840 0x17a0  AmdPPM - ok
07:46:12.0840 0x17a0  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
07:46:12.0856 0x17a0  amdsata - ok
07:46:12.0856 0x17a0  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
07:46:12.0856 0x17a0  amdsbs - ok
07:46:12.0856 0x17a0  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
07:46:12.0872 0x17a0  amdxata - ok
07:46:12.0872 0x17a0  [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID           C:\Windows\system32\drivers\appid.sys
07:46:12.0872 0x17a0  AppID - ok
07:46:12.0872 0x17a0  [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
07:46:12.0887 0x17a0  AppIDSvc - ok
07:46:12.0887 0x17a0  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
07:46:12.0887 0x17a0  Appinfo - ok
07:46:12.0903 0x17a0  [ 30E3850F303EAE5C364782EA78579CC9, 8C94E5A9052F6E794685194EEACB31A174A947D60246908B6A0DEFA081A747A3 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
07:46:12.0903 0x17a0  Apple Mobile Device - ok
07:46:12.0903 0x17a0  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
07:46:12.0918 0x17a0  AppMgmt - ok
07:46:12.0918 0x17a0  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
07:46:12.0918 0x17a0  arc - ok
07:46:12.0918 0x17a0  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
07:46:12.0934 0x17a0  arcsas - ok
07:46:12.0950 0x17a0  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
07:46:12.0950 0x17a0  aspnet_state - ok
07:46:12.0950 0x17a0  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
07:46:12.0965 0x17a0  AsyncMac - ok
07:46:12.0981 0x17a0  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
07:46:12.0981 0x17a0  atapi - ok
07:46:12.0996 0x17a0  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
07:46:13.0012 0x17a0  AudioEndpointBuilder - ok
07:46:13.0012 0x17a0  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll
07:46:13.0028 0x17a0  AudioSrv - ok
07:46:13.0028 0x17a0  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
07:46:13.0043 0x17a0  AxInstSV - ok
07:46:13.0059 0x17a0  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
07:46:13.0059 0x17a0  b06bdrv - ok
07:46:13.0074 0x17a0  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
07:46:13.0074 0x17a0  b57nd60a - ok
07:46:13.0090 0x17a0  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
07:46:13.0090 0x17a0  BDESVC - ok
07:46:13.0090 0x17a0  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
07:46:13.0106 0x17a0  Beep - ok
07:46:13.0121 0x17a0  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
07:46:13.0137 0x17a0  BFE - ok
07:46:13.0152 0x17a0  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
07:46:13.0184 0x17a0  BITS - ok
07:46:13.0184 0x17a0  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
07:46:13.0184 0x17a0  blbdrive - ok
07:46:13.0199 0x17a0  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD, 17BFFC5DF609CE3B2F0CAB4BD6C118608C66A3AD86116A47E90B2BB7D8954122 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
07:46:13.0215 0x17a0  Bonjour Service - ok
07:46:13.0215 0x17a0  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
07:46:13.0215 0x17a0  bowser - ok
07:46:13.0215 0x17a0  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
07:46:13.0230 0x17a0  BrFiltLo - ok
07:46:13.0230 0x17a0  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
07:46:13.0230 0x17a0  BrFiltUp - ok
07:46:13.0246 0x17a0  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
07:46:13.0246 0x17a0  Browser - ok
07:46:13.0246 0x17a0  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
07:46:13.0262 0x17a0  Brserid - ok
07:46:13.0262 0x17a0  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
07:46:13.0277 0x17a0  BrSerWdm - ok
07:46:13.0277 0x17a0  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
07:46:13.0277 0x17a0  BrUsbMdm - ok
07:46:13.0277 0x17a0  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
07:46:13.0293 0x17a0  BrUsbSer - ok
07:46:13.0293 0x17a0  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
07:46:13.0293 0x17a0  BTHMODEM - ok
07:46:13.0308 0x17a0  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
07:46:13.0324 0x17a0  bthserv - ok
07:46:13.0324 0x17a0  [ BDE21A60BBF5A290A1528C05DECF995F, 1D720B298FB9F7D062DF6BA8CABE0B546BEB35C7889B8E6AC2A5E324B2AF41EF ] bufssvr         C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe
07:46:13.0324 0x17a0  bufssvr - detected UnsignedFile.Multi.Generic ( 1 )
07:46:15.0680 0x17a0  Detect skipped due to KSN trusted
07:46:15.0680 0x17a0  bufssvr - ok
07:46:15.0680 0x17a0  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
07:46:15.0711 0x17a0  cdfs - ok
07:46:15.0711 0x17a0  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
07:46:15.0726 0x17a0  cdrom - ok
07:46:15.0726 0x17a0  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
07:46:15.0742 0x17a0  CertPropSvc - ok
07:46:15.0742 0x17a0  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
07:46:15.0758 0x17a0  circlass - ok
07:46:15.0758 0x17a0  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\Windows\system32\CLFS.sys
07:46:15.0773 0x17a0  CLFS - ok
07:46:15.0773 0x17a0  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
07:46:15.0789 0x17a0  clr_optimization_v2.0.50727_32 - ok
07:46:15.0789 0x17a0  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
07:46:15.0789 0x17a0  clr_optimization_v2.0.50727_64 - ok
07:46:15.0804 0x17a0  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
07:46:15.0820 0x17a0  clr_optimization_v4.0.30319_32 - ok
07:46:15.0820 0x17a0  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
07:46:15.0820 0x17a0  clr_optimization_v4.0.30319_64 - ok
07:46:15.0836 0x17a0  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
07:46:15.0836 0x17a0  CmBatt - ok
07:46:15.0836 0x17a0  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
07:46:15.0836 0x17a0  cmdide - ok
07:46:15.0851 0x17a0  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG             C:\Windows\system32\Drivers\cng.sys
07:46:15.0867 0x17a0  CNG - ok
07:46:15.0867 0x17a0  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
07:46:15.0867 0x17a0  Compbatt - ok
07:46:15.0867 0x17a0  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
07:46:15.0882 0x17a0  CompositeBus - ok
07:46:15.0882 0x17a0  COMSysApp - ok
07:46:15.0882 0x17a0  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
07:46:15.0882 0x17a0  crcdisk - ok
07:46:15.0898 0x17a0  [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc        C:\Windows\system32\cryptsvc.dll
07:46:15.0898 0x17a0  CryptSvc - ok
07:46:15.0914 0x17a0  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
07:46:15.0929 0x17a0  CSC - ok
07:46:15.0929 0x17a0  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
07:46:15.0945 0x17a0  CscService - ok
07:46:15.0960 0x17a0  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
07:46:15.0976 0x17a0  DcomLaunch - ok
07:46:15.0992 0x17a0  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
07:46:16.0007 0x17a0  defragsvc - ok
07:46:16.0007 0x17a0  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
07:46:16.0023 0x17a0  DfsC - ok
07:46:16.0038 0x17a0  dgderdrv - ok
07:46:16.0038 0x17a0  [ 30710AEFCE721CEEE0F35EB6A01C263C, FB062EC86474D38BBC38E11E2618A9505001C287430B495C482977BBE58017C8 ] dg_ssudbus      C:\Windows\system32\DRIVERS\ssudbus.sys
07:46:16.0038 0x17a0  dg_ssudbus - ok
07:46:16.0054 0x17a0  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
07:46:16.0054 0x17a0  Dhcp - ok
07:46:16.0085 0x17a0  [ AA5319FA8602676B5D3A2B4A1355896D, 57532E16FF0DDE3D62B6B6DC35E2598DD453140E9277247965A1E835645E588A ] DiagTrack       C:\Windows\system32\diagtrack.dll
07:46:16.0101 0x17a0  DiagTrack - ok
07:46:16.0101 0x17a0  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
07:46:16.0116 0x17a0  discache - ok
07:46:16.0116 0x17a0  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
07:46:16.0132 0x17a0  Disk - ok
07:46:16.0132 0x17a0  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
07:46:16.0148 0x17a0  Dnscache - ok
07:46:16.0148 0x17a0  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
07:46:16.0163 0x17a0  dot3svc - ok
07:46:16.0163 0x17a0  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
07:46:16.0194 0x17a0  DPS - ok
07:46:16.0194 0x17a0  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
07:46:16.0194 0x17a0  drmkaud - ok
07:46:16.0210 0x17a0  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
07:46:16.0226 0x17a0  DXGKrnl - ok
07:46:16.0226 0x17a0  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
07:46:16.0257 0x17a0  EapHost - ok
07:46:16.0304 0x17a0  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
07:46:16.0350 0x17a0  ebdrv - ok
07:46:16.0350 0x17a0  [ 17A6A9AAD04CCC6EE53290585BFC43AF, E4901D86C6470D21ABA0F6D9615A613E5C74A3FEF931E497F51B6AFA5715332B ] EFS             C:\Windows\System32\lsass.exe
07:46:16.0350 0x17a0  EFS - ok
07:46:16.0366 0x17a0  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
07:46:16.0382 0x17a0  ehRecvr - ok
07:46:16.0382 0x17a0  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
07:46:16.0397 0x17a0  ehSched - ok
07:46:16.0397 0x17a0  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
07:46:16.0413 0x17a0  elxstor - ok
07:46:16.0413 0x17a0  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
07:46:16.0428 0x17a0  ErrDev - ok
07:46:16.0428 0x17a0  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
07:46:16.0460 0x17a0  EventSystem - ok
07:46:16.0460 0x17a0  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
07:46:16.0475 0x17a0  exfat - ok
07:46:16.0475 0x17a0  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
07:46:16.0506 0x17a0  fastfat - ok
07:46:16.0506 0x17a0  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
07:46:16.0522 0x17a0  Fax - ok
07:46:16.0522 0x17a0  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
07:46:16.0538 0x17a0  fdc - ok
07:46:16.0538 0x17a0  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
07:46:16.0553 0x17a0  fdPHost - ok
07:46:16.0553 0x17a0  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
07:46:16.0569 0x17a0  FDResPub - ok
07:46:16.0584 0x17a0  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
07:46:16.0584 0x17a0  FileInfo - ok
07:46:16.0584 0x17a0  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
07:46:16.0600 0x17a0  Filetrace - ok
07:46:16.0600 0x17a0  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
07:46:16.0616 0x17a0  flpydisk - ok
07:46:16.0616 0x17a0  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
07:46:16.0631 0x17a0  FltMgr - ok
07:46:16.0647 0x17a0  [ E612E86FA15EA1EF9A52433A2743C447, 8A66164541D2EE2334B6DE3995C31138EA85E3A06BC7FD901E60D345E4E1E8A8 ] FontCache       C:\Windows\system32\FntCache.dll
07:46:16.0662 0x17a0  FontCache - ok
07:46:16.0662 0x17a0  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
07:46:16.0678 0x17a0  FontCache3.0.0.0 - ok
07:46:16.0678 0x17a0  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
07:46:16.0678 0x17a0  FsDepends - ok
07:46:16.0678 0x17a0  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
07:46:16.0694 0x17a0  Fs_Rec - ok
07:46:16.0694 0x17a0  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
07:46:16.0694 0x17a0  fvevol - ok
07:46:16.0709 0x17a0  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
07:46:16.0709 0x17a0  gagp30kx - ok
07:46:16.0709 0x17a0  [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
07:46:16.0709 0x17a0  GEARAspiWDM - ok
07:46:16.0740 0x17a0  [ C0B698B7D0E03B2A01D0F781BEE052BB, C20A43B02FF2536FF009C82CFE286598A87AC0BC5072F8E278802DD0B227AC3E ] GfExperienceService C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
07:46:16.0756 0x17a0  GfExperienceService - ok
07:46:16.0772 0x17a0  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
07:46:16.0787 0x17a0  gpsvc - ok
07:46:16.0803 0x17a0  [ 3CC07DAD48FA53193AE2F85DD8200B5E, 1982E674EC144EC63AB2B7C668EA5AC6FEDA97AD775E50F74CC2B4C16DDB19B2 ] hcmon           C:\Windows\system32\drivers\hcmon.sys
07:46:16.0803 0x17a0  hcmon - ok
07:46:16.0803 0x17a0  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
07:46:16.0803 0x17a0  hcw85cir - ok
07:46:16.0818 0x17a0  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
07:46:16.0834 0x17a0  HdAudAddService - ok
07:46:16.0834 0x17a0  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
07:46:16.0834 0x17a0  HDAudBus - ok
07:46:16.0834 0x17a0  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
07:46:16.0850 0x17a0  HidBatt - ok
07:46:16.0850 0x17a0  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
07:46:16.0865 0x17a0  HidBth - ok
07:46:16.0865 0x17a0  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
07:46:16.0865 0x17a0  HidIr - ok
07:46:16.0865 0x17a0  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
07:46:16.0881 0x17a0  hidserv - ok
07:46:16.0896 0x17a0  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
07:46:16.0896 0x17a0  HidUsb - ok
07:46:16.0896 0x17a0  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
07:46:16.0912 0x17a0  hkmsvc - ok
07:46:16.0928 0x17a0  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
07:46:16.0928 0x17a0  HomeGroupListener - ok
07:46:16.0928 0x17a0  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
07:46:16.0943 0x17a0  HomeGroupProvider - ok
07:46:16.0943 0x17a0  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
07:46:16.0959 0x17a0  HpSAMD - ok
07:46:16.0959 0x17a0  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
07:46:16.0974 0x17a0  HTTP - ok
07:46:16.0974 0x17a0  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
07:46:16.0990 0x17a0  hwpolicy - ok
07:46:16.0990 0x17a0  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
07:46:16.0990 0x17a0  i8042prt - ok
07:46:17.0006 0x17a0  [ D1753C06EE17E29352B065EACF3F10D0, 4DD4C991FAA3CCF99DF8DC9F8F5DEEDEECD55977F0C3AA8C404DEFD21E32A62B ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
07:46:17.0021 0x17a0  iaStor - ok
07:46:17.0021 0x17a0  [ 545462D0DBE24AF379BA869B7C185CCD, 056F9D0D5FD4FEF37665A35A4029722FF60D02A69854E952DC361CC0E5CD26F9 ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
07:46:17.0021 0x17a0  IAStorDataMgrSvc - ok
07:46:17.0037 0x17a0  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
07:46:17.0037 0x17a0  iaStorV - ok
07:46:17.0052 0x17a0  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
07:46:17.0068 0x17a0  idsvc - ok
07:46:17.0068 0x17a0  IEEtwCollectorService - ok
07:46:17.0084 0x17a0  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
07:46:17.0084 0x17a0  iirsp - ok
07:46:17.0099 0x17a0  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
07:46:17.0115 0x17a0  IKEEXT - ok
07:46:17.0130 0x17a0  [ C99F8E90DE4B8F0C7FE15BB1CBCD29DC, F791EE101EEF8B9F48102B6C63A89B78F7C0041C750C4F4C0D16D54B583B7B5C ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
07:46:17.0146 0x17a0  Intel(R) Capability Licensing Service Interface - ok
07:46:17.0146 0x17a0  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
07:46:17.0146 0x17a0  intelide - ok
07:46:17.0146 0x17a0  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
07:46:17.0162 0x17a0  intelppm - ok
07:46:17.0162 0x17a0  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
07:46:17.0177 0x17a0  IPBusEnum - ok
07:46:17.0177 0x17a0  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
07:46:17.0193 0x17a0  IpFilterDriver - ok
07:46:17.0208 0x17a0  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
07:46:17.0224 0x17a0  iphlpsvc - ok
07:46:17.0224 0x17a0  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
07:46:17.0224 0x17a0  IPMIDRV - ok
07:46:17.0240 0x17a0  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
07:46:17.0255 0x17a0  IPNAT - ok
07:46:17.0255 0x17a0  [ 33B286326BD2B1A7748C43391058FB19, C6240C9ED5B7C227595E953E3D1AB5F2D45CCD86FDBDF985836A970B4B6467FE ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
07:46:17.0271 0x17a0  iPod Service - ok
07:46:17.0271 0x17a0  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
07:46:17.0286 0x17a0  IRENUM - ok
07:46:17.0286 0x17a0  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
07:46:17.0286 0x17a0  isapnp - ok
07:46:17.0302 0x17a0  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
07:46:17.0302 0x17a0  iScsiPrt - ok
07:46:17.0302 0x17a0  [ B2381712638B0B714D0EEAB9A1F7C640, 113BCA8868057156EFDC7C079171308C1EBA4F979C85EB1265F42F95A499B086 ] iusb3hcs        C:\Windows\system32\DRIVERS\iusb3hcs.sys
07:46:17.0318 0x17a0  iusb3hcs - ok
07:46:17.0318 0x17a0  [ FD2C6457232E95C014DAD21DEBC64867, 4CC4F488A2555761208D8401265788281B6EC76A8F16C8E115778E571450B90B ] iusb3hub        C:\Windows\system32\DRIVERS\iusb3hub.sys
07:46:17.0333 0x17a0  iusb3hub - ok
07:46:17.0333 0x17a0  [ F6A2B5D030BE7EDF8ADC12C9A40825A8, 03EFAFD6B7801D83D7689435DED8DC321D153AAC4FD69D46ED8C9D7E7F56B44A ] iusb3xhc        C:\Windows\system32\DRIVERS\iusb3xhc.sys
07:46:17.0349 0x17a0  iusb3xhc - ok
07:46:17.0364 0x17a0  [ 2CCD1747A99AA6B13514EB521AFB1CC2, 66A8E4CAFD05B66008E4B652B736BC5D71E9709FF6E41FEB8A8FA870034A51E4 ] JabraDFU        C:\Windows\system32\Drivers\JabraBcDfuX64.sys
07:46:17.0364 0x17a0  JabraDFU - ok
07:46:17.0364 0x17a0  [ 4E5DB6816F165C0C7A7FAA0055788884, 440E9A45D887229CA63838C7FCFC0F299C3DE8DA21DA24871FC29E2F1711A1B6 ] jhi_service     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
07:46:17.0364 0x17a0  jhi_service - ok
07:46:17.0380 0x17a0  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
07:46:17.0380 0x17a0  kbdclass - ok
07:46:17.0380 0x17a0  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
07:46:17.0380 0x17a0  kbdhid - ok
07:46:17.0396 0x17a0  [ 17A6A9AAD04CCC6EE53290585BFC43AF, E4901D86C6470D21ABA0F6D9615A613E5C74A3FEF931E497F51B6AFA5715332B ] KeyIso          C:\Windows\system32\lsass.exe
07:46:17.0396 0x17a0  KeyIso - ok
07:46:17.0396 0x17a0  [ BF69D973523D539A35807946C6DA7E16, 38F2C59B0857131961DBEA48C4A5DFA9BE7B564941935086B8DC8DBEF896F3EC ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
07:46:17.0411 0x17a0  KSecDD - ok
07:46:17.0411 0x17a0  [ 272C27711C8AA6E7815EE33F8ACA9C66, 0A5A10A7A3E87DB92E06395A6676B94FE8B7AD6704864075D443CDC9BABDB4DF ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
07:46:17.0411 0x17a0  KSecPkg - ok
07:46:17.0427 0x17a0  [ EFB2614E9142FA4427CE82EE6DC0CA7B, DE67CED09EA1A3B10BF0F3B22B2675844122783AE2523CE01E0BDE2691FC684A ] KSS             C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
07:46:17.0427 0x17a0  KSS - ok
07:46:17.0427 0x17a0  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
07:46:17.0442 0x17a0  ksthunk - ok
07:46:17.0458 0x17a0  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
07:46:17.0474 0x17a0  KtmRm - ok
07:46:17.0474 0x17a0  [ 875805538A76210489D65A37332085E9, B0C9A18D6367437190EEFB30EB44B7D15F69A2FAEF71FE777AABEE5F3525AD48 ] L1C             C:\Windows\system32\DRIVERS\L1C62x64.sys
07:46:17.0489 0x17a0  L1C - ok
07:46:17.0489 0x17a0  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
07:46:17.0505 0x17a0  LanmanServer - ok
07:46:17.0520 0x17a0  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
07:46:17.0536 0x17a0  LanmanWorkstation - ok
07:46:17.0536 0x17a0  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
07:46:17.0552 0x17a0  lltdio - ok
07:46:17.0567 0x17a0  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
07:46:17.0583 0x17a0  lltdsvc - ok
07:46:17.0583 0x17a0  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
07:46:17.0598 0x17a0  lmhosts - ok
07:46:17.0614 0x17a0  [ B596A99DD9577C6CF1C8078A9FC5038C, 64B24D19CA9CCC1B70DF83EB69B4BBBFDE914F7D1250CD5FE7721445A88D257E ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
07:46:17.0614 0x17a0  LMS - ok
07:46:17.0614 0x17a0  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
07:46:17.0630 0x17a0  LSI_FC - ok
07:46:17.0630 0x17a0  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
07:46:17.0630 0x17a0  LSI_SAS - ok
07:46:17.0630 0x17a0  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
07:46:17.0645 0x17a0  LSI_SAS2 - ok
07:46:17.0645 0x17a0  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
07:46:17.0645 0x17a0  LSI_SCSI - ok
07:46:17.0661 0x17a0  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
07:46:17.0676 0x17a0  luafv - ok
07:46:17.0676 0x17a0  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
07:46:17.0676 0x17a0  Mcx2Svc - ok
07:46:17.0692 0x17a0  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
07:46:17.0692 0x17a0  megasas - ok
07:46:17.0692 0x17a0  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
07:46:17.0708 0x17a0  MegaSR - ok
07:46:17.0708 0x17a0  [ 772A1DEEDFDBC244183B5C805D1B7D85, 7D821B8DF1F174E5414FFDEAB5207DB687740E9842F7203600AEBA086945AFC9 ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
07:46:17.0708 0x17a0  MEIx64 - ok
07:46:17.0708 0x17a0  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
07:46:17.0739 0x17a0  MMCSS - ok
07:46:17.0739 0x17a0  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
07:46:17.0754 0x17a0  Modem - ok
07:46:17.0754 0x17a0  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
07:46:17.0770 0x17a0  monitor - ok
07:46:17.0770 0x17a0  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\drivers\mouclass.sys
07:46:17.0770 0x17a0  mouclass - ok
07:46:17.0770 0x17a0  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
07:46:17.0786 0x17a0  mouhid - ok
07:46:17.0786 0x17a0  [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
07:46:17.0786 0x17a0  mountmgr - ok
07:46:17.0786 0x17a0  [ A08662124B1510709C4514E7333E27D8, 4ECF5200484A0412F1B9EEBA10D3E01F6610FA33C99140EB8F329CFDF812FD3B ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
07:46:17.0801 0x17a0  MozillaMaintenance - ok
07:46:17.0801 0x17a0  [ 73150F67D20270FF95A021A22E64F28A, A8878DEFBE437FB453F8E9243FB5C787D07AC7415A4475388D479C10417C524F ] MpFilter        C:\Windows\system32\DRIVERS\MpFilter.sys
07:46:17.0817 0x17a0  MpFilter - ok
07:46:17.0817 0x17a0  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
07:46:17.0817 0x17a0  mpio - ok
07:46:17.0832 0x17a0  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
07:46:17.0848 0x17a0  mpsdrv - ok
07:46:17.0864 0x17a0  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
07:46:17.0879 0x17a0  MpsSvc - ok
07:46:17.0895 0x17a0  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
07:46:17.0895 0x17a0  MRxDAV - ok
07:46:17.0895 0x17a0  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
07:46:17.0910 0x17a0  mrxsmb - ok
07:46:17.0910 0x17a0  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
07:46:17.0926 0x17a0  mrxsmb10 - ok
07:46:17.0926 0x17a0  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
07:46:17.0926 0x17a0  mrxsmb20 - ok
07:46:17.0942 0x17a0  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
07:46:17.0942 0x17a0  msahci - ok
07:46:17.0942 0x17a0  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
07:46:17.0957 0x17a0  msdsm - ok
07:46:17.0957 0x17a0  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
07:46:17.0957 0x17a0  MSDTC - ok
07:46:17.0973 0x17a0  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
07:46:17.0988 0x17a0  Msfs - ok
07:46:17.0988 0x17a0  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
07:46:18.0004 0x17a0  mshidkmdf - ok
07:46:18.0004 0x17a0  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
07:46:18.0004 0x17a0  msisadrv - ok
07:46:18.0020 0x17a0  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
07:46:18.0035 0x17a0  MSiSCSI - ok
07:46:18.0035 0x17a0  msiserver - ok
07:46:18.0035 0x17a0  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
07:46:18.0051 0x17a0  MSKSSRV - ok
07:46:18.0051 0x17a0  [ CE996C1821021ADF8E28E80A54E846A8, 99042E895B6C2EA80F3BA65563A12C8EBA882E3AD6A21DD8E799B0112C75DDD2 ] MsMpSvc         c:\Program Files\Microsoft Security Client\MsMpEng.exe
07:46:18.0066 0x17a0  MsMpSvc - ok
07:46:18.0066 0x17a0  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
07:46:18.0082 0x17a0  MSPCLOCK - ok
07:46:18.0082 0x17a0  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
07:46:18.0098 0x17a0  MSPQM - ok
07:46:18.0113 0x17a0  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
07:46:18.0113 0x17a0  MsRPC - ok
07:46:18.0113 0x17a0  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
07:46:18.0129 0x17a0  mssmbios - ok
07:46:18.0129 0x17a0  MSSQL$SQLEXPRESS - ok
07:46:18.0129 0x17a0  [ 7A2A8C975356858EB38466A6B1592E8D, 97C3DFCCBE1BA92EE7E4848993D6F369D543A53344A6512C84EF03E7D737A482 ] MSSQLServerADHelper100 C:\Program Files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE
07:46:18.0129 0x17a0  MSSQLServerADHelper100 - ok
07:46:18.0144 0x17a0  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
07:46:18.0160 0x17a0  MSTEE - ok
07:46:18.0160 0x17a0  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
07:46:18.0160 0x17a0  MTConfig - ok
07:46:18.0160 0x17a0  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
07:46:18.0176 0x17a0  Mup - ok
07:46:18.0176 0x17a0  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
07:46:18.0207 0x17a0  napagent - ok
07:46:18.0207 0x17a0  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
07:46:18.0222 0x17a0  NativeWifiP - ok
07:46:18.0238 0x17a0  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
07:46:18.0254 0x17a0  NDIS - ok
07:46:18.0254 0x17a0  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
07:46:18.0269 0x17a0  NdisCap - ok
07:46:18.0269 0x17a0  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
07:46:18.0285 0x17a0  NdisTapi - ok
07:46:18.0300 0x17a0  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
07:46:18.0316 0x17a0  Ndisuio - ok
07:46:18.0316 0x17a0  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
07:46:18.0332 0x17a0  NdisWan - ok
07:46:18.0332 0x17a0  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
07:46:18.0347 0x17a0  NDProxy - ok
07:46:18.0363 0x17a0  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
07:46:18.0378 0x17a0  NetBIOS - ok
07:46:18.0378 0x17a0  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
07:46:18.0394 0x17a0  NetBT - ok
07:46:18.0394 0x17a0  [ 17A6A9AAD04CCC6EE53290585BFC43AF, E4901D86C6470D21ABA0F6D9615A613E5C74A3FEF931E497F51B6AFA5715332B ] Netlogon        C:\Windows\system32\lsass.exe
07:46:18.0410 0x17a0  Netlogon - ok
07:46:18.0410 0x17a0  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
07:46:18.0441 0x17a0  Netman - ok
07:46:18.0441 0x17a0  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:46:18.0441 0x17a0  NetMsmqActivator - ok
07:46:18.0456 0x17a0  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:46:18.0456 0x17a0  NetPipeActivator - ok
07:46:18.0472 0x17a0  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
07:46:18.0488 0x17a0  netprofm - ok
07:46:18.0488 0x17a0  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:46:18.0503 0x17a0  NetTcpActivator - ok
07:46:18.0503 0x17a0  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:46:18.0519 0x17a0  NetTcpPortSharing - ok
07:46:18.0519 0x17a0  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
07:46:18.0519 0x17a0  nfrd960 - ok
07:46:18.0519 0x17a0  [ 4774AD83C650001B337B92E5E5DA337B, 138ECC7F556D8A12AE58B78B68F6515BE4C00F9F062596B48B6CA6C010F13035 ] NisDrv          C:\Windows\system32\DRIVERS\NisDrvWFP.sys
07:46:18.0534 0x17a0  NisDrv - ok
07:46:18.0534 0x17a0  [ 96B7D15161A778B359E707796CCEA646, 9E4A25D9848FAECC517474EAD548E7975CBE3F41AAA964E5245E78F2A723925E ] NisSrv          c:\Program Files\Microsoft Security Client\NisSrv.exe
07:46:18.0550 0x17a0  NisSrv - ok
07:46:18.0550 0x17a0  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
07:46:18.0566 0x17a0  NlaSvc - ok
07:46:18.0566 0x17a0  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
07:46:18.0581 0x17a0  Npfs - ok
07:46:18.0581 0x17a0  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
07:46:18.0612 0x17a0  nsi - ok
07:46:18.0612 0x17a0  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
07:46:18.0628 0x17a0  nsiproxy - ok
07:46:18.0644 0x17a0  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
07:46:18.0675 0x17a0  Ntfs - ok
07:46:18.0675 0x17a0  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
07:46:18.0690 0x17a0  Null - ok
07:46:18.0706 0x17a0  [ 624C1453F9109D98F7E2612DAD76BBB1, 4578623BF7EA1AF42038070AA3A1A9AC4A9582132ABBFAD9C3A99F46308DE8C3 ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
07:46:18.0706 0x17a0  NVHDA - ok
07:46:18.0878 0x17a0  [ 3E188568A3D51195399A790B51F0A7B8, 76BBE2F6CD8B67D184FACE85D638E0861842784F5A087A412F0F05AF27079DC4 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
07:46:19.0018 0x17a0  nvlddmkm - ok
07:46:19.0049 0x17a0  [ 32ECE52E4C4A5FC2115279D7B13E6270, AE520E4708B3750D61BE17AA6020D0D0518CC72D4D29F4D618090F74EA2850BF ] NvNetworkService C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
07:46:19.0080 0x17a0  NvNetworkService - ok
07:46:19.0080 0x17a0  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
07:46:19.0080 0x17a0  nvraid - ok
07:46:19.0096 0x17a0  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
07:46:19.0096 0x17a0  nvstor - ok
07:46:19.0096 0x17a0  [ DA48A4EB3DD38C7BF90CB12DD1672618, 2EFEEE7E9294A17251B45259C06B40E11088D38970068D6D88EE2105B35F5530 ] NvStreamKms     C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys
07:46:19.0096 0x17a0  NvStreamKms - ok
07:46:19.0112 0x17a0  NvStreamSvc - ok
07:46:19.0127 0x17a0  [ D768CA15B379A9611B22719A1364D3C0, 2F2D6143E2B06A3EE7011E559475BFC3DEFC8AB67F1F93404E6B83CDB69185C0 ] nvsvc           C:\Windows\system32\nvvsvc.exe
07:46:19.0143 0x17a0  nvsvc - ok
07:46:19.0143 0x17a0  [ DBFE7B2DF103F74AE51840B3C5F25FE9, 436CAA417FD24BA870F117FA4BABA2AB694825795508BCFCC8C927CC2D5BBC5E ] nvvad_WaveExtensible C:\Windows\system32\drivers\nvvad64v.sys
07:46:19.0143 0x17a0  nvvad_WaveExtensible - ok
07:46:19.0143 0x17a0  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
07:46:19.0158 0x17a0  nv_agp - ok
07:46:19.0158 0x17a0  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
07:46:19.0158 0x17a0  ohci1394 - ok
07:46:19.0190 0x17a0  [ FCE83ABDE761C87D17EA65960455F0E5, E59C13E26845FE0537AEBF0E4A9DC0AF3E6DF55C7A54247FC8078AC5DE666AD4 ] Origin Client Service C:\Spiele\Origin\OriginClientService.exe
07:46:19.0221 0x17a0  Origin Client Service - ok
07:46:19.0221 0x17a0  [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
07:46:19.0236 0x17a0  ose - ok
07:46:19.0299 0x17a0  [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
07:46:19.0361 0x17a0  osppsvc - ok
07:46:19.0377 0x17a0  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
07:46:19.0392 0x17a0  p2pimsvc - ok
07:46:19.0392 0x17a0  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
07:46:19.0408 0x17a0  p2psvc - ok
07:46:19.0408 0x17a0  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
07:46:19.0424 0x17a0  Parport - ok
07:46:19.0424 0x17a0  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
07:46:19.0424 0x17a0  partmgr - ok
07:46:19.0439 0x17a0  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll
07:46:19.0439 0x17a0  PcaSvc - ok
07:46:19.0439 0x17a0  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
07:46:19.0455 0x17a0  pci - ok
07:46:19.0455 0x17a0  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
07:46:19.0455 0x17a0  pciide - ok
07:46:19.0470 0x17a0  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
07:46:19.0470 0x17a0  pcmcia - ok
07:46:19.0470 0x17a0  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
07:46:19.0470 0x17a0  pcw - ok
07:46:19.0486 0x17a0  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
07:46:19.0502 0x17a0  PEAUTH - ok
07:46:19.0517 0x17a0  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
07:46:19.0548 0x17a0  PeerDistSvc - ok
07:46:19.0564 0x17a0  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
07:46:19.0564 0x17a0  PerfHost - ok
07:46:19.0595 0x17a0  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
07:46:19.0626 0x17a0  pla - ok
07:46:19.0642 0x17a0  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
07:46:19.0642 0x17a0  PlugPlay - ok
07:46:19.0658 0x17a0  [ CD421DDB5C6E5458CE52EDC36DE7DC5B, 7B9C0A8B2B86BBF5D7E02F2620B0015A2530CBBC99724BE20313DE53EB31D62E ] PnkBstrA        C:\Windows\system32\PnkBstrA.exe
07:46:19.0658 0x17a0  PnkBstrA - ok
07:46:19.0673 0x17a0  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
07:46:19.0673 0x17a0  PNRPAutoReg - ok
07:46:19.0673 0x17a0  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
07:46:19.0689 0x17a0  PNRPsvc - ok
07:46:19.0704 0x17a0  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
07:46:19.0720 0x17a0  PolicyAgent - ok
07:46:19.0720 0x17a0  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
07:46:19.0751 0x17a0  Power - ok
07:46:19.0751 0x17a0  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
07:46:19.0767 0x17a0  PptpMiniport - ok
07:46:19.0767 0x17a0  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
07:46:19.0782 0x17a0  Processor - ok
07:46:19.0782 0x17a0  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
07:46:19.0782 0x17a0  ProfSvc - ok
07:46:19.0798 0x17a0  [ 17A6A9AAD04CCC6EE53290585BFC43AF, E4901D86C6470D21ABA0F6D9615A613E5C74A3FEF931E497F51B6AFA5715332B ] ProtectedStorage C:\Windows\system32\lsass.exe
07:46:19.0798 0x17a0  ProtectedStorage - ok
07:46:19.0798 0x17a0  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
07:46:19.0814 0x17a0  Psched - ok
07:46:19.0845 0x17a0  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
07:46:19.0860 0x17a0  ql2300 - ok
07:46:19.0876 0x17a0  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
07:46:19.0876 0x17a0  ql40xx - ok
07:46:19.0876 0x17a0  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
07:46:19.0892 0x17a0  QWAVE - ok
07:46:19.0892 0x17a0  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
07:46:19.0907 0x17a0  QWAVEdrv - ok
07:46:19.0907 0x17a0  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
07:46:19.0923 0x17a0  RasAcd - ok
07:46:19.0923 0x17a0  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
07:46:19.0938 0x17a0  RasAgileVpn - ok
07:46:19.0938 0x17a0  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
07:46:19.0970 0x17a0  RasAuto - ok
07:46:19.0970 0x17a0  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
07:46:19.0985 0x17a0  Rasl2tp - ok
07:46:19.0985 0x17a0  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
07:46:20.0016 0x17a0  RasMan - ok
07:46:20.0016 0x17a0  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
07:46:20.0032 0x17a0  RasPppoe - ok
07:46:20.0032 0x17a0  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
07:46:20.0048 0x17a0  RasSstp - ok
07:46:20.0063 0x17a0  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
07:46:20.0079 0x17a0  rdbss - ok
07:46:20.0079 0x17a0  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
07:46:20.0094 0x17a0  rdpbus - ok
07:46:20.0094 0x17a0  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
07:46:20.0110 0x17a0  RDPCDD - ok
07:46:20.0110 0x17a0  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
07:46:20.0126 0x17a0  RDPDR - ok
07:46:20.0126 0x17a0  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
07:46:20.0141 0x17a0  RDPENCDD - ok
07:46:20.0141 0x17a0  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
07:46:20.0157 0x17a0  RDPREFMP - ok
07:46:20.0157 0x17a0  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
07:46:20.0172 0x17a0  RdpVideoMiniport - ok
07:46:20.0172 0x17a0  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
07:46:20.0188 0x17a0  RDPWD - ok
07:46:20.0188 0x17a0  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
07:46:20.0188 0x17a0  rdyboost - ok
07:46:20.0204 0x17a0  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
07:46:20.0219 0x17a0  RemoteAccess - ok
07:46:20.0219 0x17a0  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
07:46:20.0235 0x17a0  RemoteRegistry - ok
07:46:20.0235 0x17a0  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
07:46:20.0266 0x17a0  RpcEptMapper - ok
07:46:20.0266 0x17a0  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
07:46:20.0266 0x17a0  RpcLocator - ok
07:46:20.0282 0x17a0  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
07:46:20.0297 0x17a0  RpcSs - ok
07:46:20.0313 0x17a0  [ C9FE05A63C500ABE3AFA5786504C4D36, F076B57B9EF6A179A37D5E00E1891236025D451CF067D2F1A1CBA2113218FEB6 ] RsFx0105        C:\Windows\system32\DRIVERS\RsFx0105.sys
07:46:20.0313 0x17a0  RsFx0105 - ok
07:46:20.0313 0x17a0  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
07:46:20.0328 0x17a0  rspndr - ok
07:46:20.0344 0x17a0  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
07:46:20.0344 0x17a0  s3cap - ok
07:46:20.0344 0x17a0  [ 17A6A9AAD04CCC6EE53290585BFC43AF, E4901D86C6470D21ABA0F6D9615A613E5C74A3FEF931E497F51B6AFA5715332B ] SamSs           C:\Windows\system32\lsass.exe
07:46:20.0344 0x17a0  SamSs - ok
07:46:20.0360 0x17a0  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
07:46:20.0360 0x17a0  sbp2port - ok
07:46:20.0360 0x17a0  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
07:46:20.0391 0x17a0  SCardSvr - ok
07:46:20.0391 0x17a0  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
07:46:20.0406 0x17a0  scfilter - ok
07:46:20.0422 0x17a0  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
07:46:20.0453 0x17a0  Schedule - ok
07:46:20.0453 0x17a0  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
07:46:20.0469 0x17a0  SCPolicySvc - ok
07:46:20.0469 0x17a0  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
07:46:20.0484 0x17a0  SDRSVC - ok
07:46:20.0484 0x17a0  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
07:46:20.0500 0x17a0  secdrv - ok
07:46:20.0500 0x17a0  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
07:46:20.0516 0x17a0  seclogon - ok
07:46:20.0531 0x17a0  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
07:46:20.0547 0x17a0  SENS - ok
07:46:20.0547 0x17a0  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
07:46:20.0547 0x17a0  SensrSvc - ok
07:46:20.0562 0x17a0  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
07:46:20.0562 0x17a0  Serenum - ok
07:46:20.0562 0x17a0  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
07:46:20.0578 0x17a0  Serial - ok
07:46:20.0578 0x17a0  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
07:46:20.0578 0x17a0  sermouse - ok
07:46:20.0578 0x17a0  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
07:46:20.0609 0x17a0  SessionEnv - ok
07:46:20.0609 0x17a0  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
07:46:20.0609 0x17a0  sffdisk - ok
07:46:20.0609 0x17a0  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
07:46:20.0625 0x17a0  sffp_mmc - ok
07:46:20.0625 0x17a0  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
07:46:20.0625 0x17a0  sffp_sd - ok
07:46:20.0625 0x17a0  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
07:46:20.0640 0x17a0  sfloppy - ok
07:46:20.0640 0x17a0  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
07:46:20.0656 0x17a0  SharedAccess - ok
07:46:20.0672 0x17a0  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
07:46:20.0687 0x17a0  ShellHWDetection - ok
07:46:20.0687 0x17a0  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
07:46:20.0703 0x17a0  SiSRaid2 - ok
07:46:20.0703 0x17a0  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
07:46:20.0703 0x17a0  SiSRaid4 - ok
07:46:20.0703 0x17a0  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
07:46:20.0734 0x17a0  Smb - ok
07:46:20.0734 0x17a0  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
07:46:20.0734 0x17a0  SNMPTRAP - ok
07:46:20.0734 0x17a0  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
07:46:20.0750 0x17a0  spldr - ok
07:46:20.0750 0x17a0  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
07:46:20.0765 0x17a0  Spooler - ok
07:46:20.0812 0x17a0  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
07:46:20.0874 0x17a0  sppsvc - ok
07:46:20.0890 0x17a0  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
07:46:20.0906 0x17a0  sppuinotify - ok
07:46:20.0906 0x17a0  [ 2E21D0699F3DFFFFD141763E3AA99D9A, 60063207F002B67B3E2BC78BBD15A2725AE8CFBC3289D21BE598F13F53C929B1 ] SQLAgent$SQLEXPRESS C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE
07:46:20.0921 0x17a0  SQLAgent$SQLEXPRESS - ok
07:46:20.0921 0x17a0  [ 8FD8EE71D7D639F85805EEE4ADB2AA15, 027E680BE49F705843B0117A72FAFC7681798B99685B91989928EF03767CD7A5 ] SQLWriter       C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
07:46:20.0937 0x17a0  SQLWriter - ok
07:46:20.0937 0x17a0  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
07:46:20.0952 0x17a0  srv - ok
07:46:20.0968 0x17a0  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
07:46:20.0968 0x17a0  srv2 - ok
07:46:20.0984 0x17a0  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
07:46:20.0984 0x17a0  srvnet - ok
07:46:20.0984 0x17a0  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
07:46:21.0015 0x17a0  SSDPSRV - ok
07:46:21.0015 0x17a0  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
07:46:21.0030 0x17a0  SstpSvc - ok
07:46:21.0030 0x17a0  [ 91310683D7B6B292B746D60734B59322, 2C56C3E4AA7356FB544B52F80ABDA39A80473390CB2059C69BDCCAD40FE56325 ] ssudmdm         C:\Windows\system32\DRIVERS\ssudmdm.sys
07:46:21.0046 0x17a0  ssudmdm - ok
07:46:21.0046 0x17a0  [ 706080AD43599D4AB04F1676A3A62CC1, BD9A645163501E2234CAB2B99DB297A634526786D2CDC55FE1C18F5019623E34 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
07:46:21.0062 0x17a0  Steam Client Service - ok
07:46:21.0077 0x17a0  [ C64C157B167FE562E8670984E72C25FA, 9302C82A75CA65515297B72F3A6230307AAE0B14FD8C9C7FA343F7B62E5ED376 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
07:46:21.0077 0x17a0  Stereo Service - ok
07:46:21.0077 0x17a0  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
07:46:21.0093 0x17a0  stexstor - ok
07:46:21.0093 0x17a0  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
07:46:21.0108 0x17a0  stisvc - ok
07:46:21.0108 0x17a0  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
07:46:21.0124 0x17a0  storflt - ok
07:46:21.0124 0x17a0  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
07:46:21.0124 0x17a0  StorSvc - ok
07:46:21.0140 0x17a0  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
07:46:21.0140 0x17a0  storvsc - ok
07:46:21.0140 0x17a0  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
07:46:21.0140 0x17a0  swenum - ok
07:46:21.0155 0x17a0  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
07:46:21.0171 0x17a0  swprv - ok
07:46:21.0202 0x17a0  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
07:46:21.0233 0x17a0  SysMain - ok
07:46:21.0233 0x17a0  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
07:46:21.0249 0x17a0  TabletInputService - ok
07:46:21.0249 0x17a0  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
07:46:21.0280 0x17a0  TapiSrv - ok
07:46:21.0280 0x17a0  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
07:46:21.0296 0x17a0  TBS - ok
07:46:21.0327 0x17a0  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
07:46:21.0358 0x17a0  Tcpip - ok
07:46:21.0389 0x17a0  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
07:46:21.0405 0x17a0  TCPIP6 - ok
07:46:21.0420 0x17a0  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
07:46:21.0420 0x17a0  tcpipreg - ok
07:46:21.0420 0x17a0  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
07:46:21.0436 0x17a0  TDPIPE - ok
07:46:21.0436 0x17a0  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
07:46:21.0436 0x17a0  TDTCP - ok
07:46:21.0436 0x17a0  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
07:46:21.0452 0x17a0  tdx - ok
07:46:21.0530 0x17a0  [ 6EC042A004268B3EA2FB96D939303095, 0E889FB317AF484DA4A8529C5569350C69F4587C2B455C0F559E8061ECC2247B ] TeamViewer      C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
07:46:21.0592 0x17a0  TeamViewer - ok
07:46:21.0608 0x17a0  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
07:46:21.0608 0x17a0  TermDD - ok
07:46:21.0623 0x17a0  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
07:46:21.0639 0x17a0  TermService - ok
07:46:21.0639 0x17a0  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
07:46:21.0654 0x17a0  Themes - ok
07:46:21.0654 0x17a0  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
07:46:21.0670 0x17a0  THREADORDER - ok
07:46:21.0670 0x17a0  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
07:46:21.0701 0x17a0  TrkWks - ok
07:46:21.0701 0x17a0  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
07:46:21.0717 0x17a0  TrustedInstaller - ok
07:46:21.0717 0x17a0  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
07:46:21.0732 0x17a0  tssecsrv - ok
07:46:21.0732 0x17a0  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
07:46:21.0732 0x17a0  TsUsbFlt - ok
07:46:21.0732 0x17a0  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
07:46:21.0764 0x17a0  tunnel - ok
07:46:21.0764 0x17a0  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
07:46:21.0764 0x17a0  uagp35 - ok
07:46:21.0764 0x17a0  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
07:46:21.0795 0x17a0  udfs - ok
07:46:21.0795 0x17a0  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
07:46:21.0795 0x17a0  UI0Detect - ok
07:46:21.0810 0x17a0  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
07:46:21.0810 0x17a0  uliagpkx - ok
07:46:21.0810 0x17a0  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\drivers\umbus.sys
07:46:21.0826 0x17a0  umbus - ok
07:46:21.0826 0x17a0  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
07:46:21.0826 0x17a0  UmPass - ok
07:46:21.0826 0x17a0  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
07:46:21.0842 0x17a0  UmRdpService - ok
07:46:21.0842 0x17a0  [ C5CC2D35F038F2A934483A4D1C2E4435, 3501A70235C6089D3DF8B0BCA84CDA2FB7D768F0971A32AF06B4948F65B19E66 ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
07:46:21.0857 0x17a0  UNS - ok
07:46:21.0857 0x17a0  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
07:46:21.0888 0x17a0  upnphost - ok
07:46:21.0888 0x17a0  [ C9E9D59C0099A9FF51697E9306A44240, 78D9A7A5E5742962B6978F475BF06CB32262F1D214699D3D40538476A58012A1 ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys
07:46:21.0888 0x17a0  USBAAPL64 - ok
07:46:21.0904 0x17a0  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
07:46:21.0904 0x17a0  usbccgp - ok
07:46:21.0904 0x17a0  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
07:46:21.0920 0x17a0  usbcir - ok
07:46:21.0920 0x17a0  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
07:46:21.0920 0x17a0  usbehci - ok
07:46:21.0935 0x17a0  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
07:46:21.0935 0x17a0  usbhub - ok
07:46:21.0935 0x17a0  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
07:46:21.0951 0x17a0  usbohci - ok
07:46:21.0951 0x17a0  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
07:46:21.0951 0x17a0  usbprint - ok
07:46:21.0951 0x17a0  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
07:46:21.0966 0x17a0  usbscan - ok
07:46:21.0966 0x17a0  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
07:46:21.0966 0x17a0  USBSTOR - ok
07:46:21.0982 0x17a0  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
07:46:21.0982 0x17a0  usbuhci - ok
07:46:21.0982 0x17a0  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
07:46:21.0998 0x17a0  UxSms - ok
07:46:21.0998 0x17a0  [ 17A6A9AAD04CCC6EE53290585BFC43AF, E4901D86C6470D21ABA0F6D9615A613E5C74A3FEF931E497F51B6AFA5715332B ] VaultSvc        C:\Windows\system32\lsass.exe
07:46:22.0013 0x17a0  VaultSvc - ok
07:46:22.0013 0x17a0  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
07:46:22.0013 0x17a0  vdrvroot - ok
07:46:22.0029 0x17a0  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
07:46:22.0044 0x17a0  vds - ok
07:46:22.0060 0x17a0  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
07:46:22.0060 0x17a0  vga - ok
07:46:22.0060 0x17a0  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
07:46:22.0076 0x17a0  VgaSave - ok
07:46:22.0091 0x17a0  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
07:46:22.0091 0x17a0  vhdmp - ok
07:46:22.0122 0x17a0  [ E066AA9C9866C2001372486A6841108C, 648E39962EDB3D77FBB5E2D5B603E16240AADE181A20E8778EE3D8847E4C0984 ] VIAHdAudAddService C:\Windows\system32\drivers\viahduaa.sys
07:46:22.0154 0x17a0  VIAHdAudAddService - ok
07:46:22.0154 0x17a0  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
07:46:22.0169 0x17a0  viaide - ok
07:46:22.0169 0x17a0  [ 1236737C7993FB462610E1A0AA92C40B, 85385740AE7F885ACD605860AB2642DAC7456BB26C6615DAA9EE02AF54FEF77C ] VIAKaraokeService C:\Windows\system32\viakaraokesrv.exe
07:46:22.0169 0x17a0  VIAKaraokeService - ok
07:46:22.0169 0x17a0  [ A942813405C51998DD2C2B86A08394D5, 7882BBBE2279945879B6136281CCD7035D173AD2D5EBFC17F6126B231C7EDF89 ] VMAuthdService  C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
07:46:22.0185 0x17a0  VMAuthdService - detected UnsignedFile.Multi.Generic ( 1 )
07:46:24.0525 0x17a0  Detect skipped due to KSN trusted
07:46:24.0525 0x17a0  VMAuthdService - ok
07:46:24.0540 0x17a0  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
07:46:24.0556 0x17a0  vmbus - ok
07:46:24.0572 0x17a0  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
07:46:24.0572 0x17a0  VMBusHID - ok
07:46:24.0572 0x17a0  [ 6203C901DEFF10631AAD919B3BD1489B, 2CF99A56EEBB444A30736982647FBECC037D03F4EC3A7B06C147FF62876F438B ] vmci            C:\Windows\system32\DRIVERS\vmci.sys
07:46:24.0572 0x17a0  vmci - ok
07:46:24.0587 0x17a0  [ DE8F365C4C038AFE02F6E3B18ECAED33, 1D6BE6D6CC347A0D21A14A33DE5F1647B6AD4D7C85696BC2F8F2204FC00FCB63 ] vmkbd           C:\Windows\system32\drivers\VMkbd.sys
07:46:24.0587 0x17a0  vmkbd - ok
07:46:24.0587 0x17a0  [ AEF53B47E960F227BF7638A6A1A9D5C6, 21280177B404F27A5C9725AE50D6E8595CFFED59837741C9FEEF6013CE7C8CF6 ] VMnetAdapter    C:\Windows\system32\DRIVERS\vmnetadapter.sys
07:46:24.0587 0x17a0  VMnetAdapter - ok
07:46:24.0603 0x17a0  [ C234A1DC2F06A15B9210787F54253810, B1A25D9F84752294BEE643EB9E17CC0538E5C26B7C741E32F7AEFE6514B1F5C6 ] VMnetBridge     C:\Windows\system32\DRIVERS\vmnetbridge.sys
07:46:24.0603 0x17a0  VMnetBridge - ok
07:46:24.0603 0x17a0  VMnetDHCP - ok
07:46:24.0603 0x17a0  [ 36EDBFE2C2405081620ADEF7B691ED89, 15483F80DD8197A1EAC1D7E8AB0BBE1624287A750F3E9CC9E42BF8F3E6A12D1B ] VMnetuserif     C:\Windows\system32\drivers\vmnetuserif.sys
07:46:24.0603 0x17a0  VMnetuserif - ok
07:46:24.0618 0x17a0  [ 415B167695C4B5960A13098622EF3D80, E68AE845A6967E68FB22EB0F4D95631D041DA906801202F7662B22EAD34B2371 ] vmusb           C:\Windows\system32\Drivers\vmusb.sys
07:46:24.0618 0x17a0  vmusb - ok
07:46:24.0634 0x17a0  [ B55A8DADA1D825B73C811101B06E012F, BF529432E87FEE648C931FA6EFE7DCF9F87A7608265E0635D54B66EB57967A51 ] VMUSBArbService C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
07:46:24.0650 0x17a0  VMUSBArbService - ok
07:46:24.0650 0x17a0  VMware NAT Service - ok
07:46:24.0650 0x17a0  [ 0E6ACC0257C6EFBB41E9FF4CD2A88B7F, B1ACAACDD6807039095C89CAEA6F2A3A2BCA0F95AB87F52B62D0DC87555F0DEC ] vmx86           C:\Windows\system32\drivers\vmx86.sys
07:46:24.0665 0x17a0  vmx86 - ok
07:46:24.0665 0x17a0  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
07:46:24.0665 0x17a0  volmgr - ok
07:46:24.0665 0x17a0  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
07:46:24.0681 0x17a0  volmgrx - ok
07:46:24.0681 0x17a0  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
07:46:24.0696 0x17a0  volsnap - ok
07:46:24.0696 0x17a0  [ ED1F4BDF68C649C6F79A02502BB6C9BC, 3D2830822D4A2C7B3676100B27DEC7B1C2EF640DA36C6543365A9CF2A61BF68E ] VsEtwService120 C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe
07:46:24.0712 0x17a0  VsEtwService120 - ok
07:46:24.0712 0x17a0  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
07:46:24.0728 0x17a0  vsmraid - ok
07:46:24.0728 0x17a0  [ EF1E48D431223F670CFFD6169B1A136F, 7DEF32CA45019DD79438B93626C4F31BB903093D605F18F71E055319BF4BB41E ] vsock           C:\Windows\system32\drivers\vsock.sys
07:46:24.0728 0x17a0  vsock - ok
07:46:24.0759 0x17a0  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
07:46:24.0790 0x17a0  VSS - ok
07:46:24.0790 0x17a0  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
07:46:24.0821 0x17a0  vwifibus - ok
07:46:24.0837 0x17a0  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
07:46:24.0868 0x17a0  W32Time - ok
07:46:24.0884 0x17a0  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
07:46:24.0884 0x17a0  WacomPen - ok
07:46:24.0884 0x17a0  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
07:46:24.0899 0x17a0  WANARP - ok
07:46:24.0899 0x17a0  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
07:46:24.0930 0x17a0  Wanarpv6 - ok
07:46:24.0946 0x17a0  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
07:46:24.0977 0x17a0  wbengine - ok
07:46:24.0977 0x17a0  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
07:46:24.0993 0x17a0  WbioSrvc - ok
07:46:24.0993 0x17a0  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
07:46:25.0008 0x17a0  wcncsvc - ok
07:46:25.0008 0x17a0  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
07:46:25.0024 0x17a0  WcsPlugInService - ok
07:46:25.0024 0x17a0  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
07:46:25.0024 0x17a0  Wd - ok
07:46:25.0040 0x17a0  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
07:46:25.0055 0x17a0  Wdf01000 - ok
07:46:25.0055 0x17a0  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll
07:46:25.0071 0x17a0  WdiServiceHost - ok
07:46:25.0071 0x17a0  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\Windows\system32\wdi.dll
07:46:25.0071 0x17a0  WdiSystemHost - ok
07:46:25.0086 0x17a0  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
07:46:25.0086 0x17a0  WebClient - ok
07:46:25.0086 0x17a0  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
07:46:25.0118 0x17a0  Wecsvc - ok
07:46:25.0118 0x17a0  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
07:46:25.0133 0x17a0  wercplsupport - ok
07:46:25.0133 0x17a0  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
07:46:25.0164 0x17a0  WerSvc - ok
07:46:25.0164 0x17a0  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
07:46:25.0180 0x17a0  WfpLwf - ok
07:46:25.0180 0x17a0  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
07:46:25.0180 0x17a0  WIMMount - ok
07:46:25.0180 0x17a0  WinDefend - ok
07:46:25.0196 0x17a0  WinHttpAutoProxySvc - ok
07:46:25.0196 0x17a0  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
07:46:25.0211 0x17a0  Winmgmt - ok
07:46:25.0242 0x17a0  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll
07:46:25.0274 0x17a0  WinRM - ok
07:46:25.0289 0x17a0  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\drivers\WinUsb.sys
07:46:25.0289 0x17a0  WinUsb - ok
07:46:25.0305 0x17a0  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
07:46:25.0320 0x17a0  Wlansvc - ok
07:46:25.0320 0x17a0  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
07:46:25.0336 0x17a0  WmiAcpi - ok
07:46:25.0336 0x17a0  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
07:46:25.0352 0x17a0  wmiApSrv - ok
07:46:25.0352 0x17a0  WMPNetworkSvc - ok
07:46:25.0352 0x17a0  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
07:46:25.0352 0x17a0  WPCSvc - ok
07:46:25.0367 0x17a0  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
07:46:25.0367 0x17a0  WPDBusEnum - ok
07:46:25.0367 0x17a0  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
07:46:25.0383 0x17a0  ws2ifsl - ok
07:46:25.0398 0x17a0  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
07:46:25.0398 0x17a0  wscsvc - ok
07:46:25.0398 0x17a0  WSearch - ok
07:46:25.0445 0x17a0  [ 0814A74C853F50B354F08F83DDA9F7FB, 0A63BAA8DE451B8C2C71FEF961718E769B9BAC305C76D24048C664CB27D0DF28 ] wuauserv        C:\Windows\system32\wuaueng.dll
07:46:25.0476 0x17a0  wuauserv - ok
07:46:25.0476 0x17a0  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
07:46:25.0492 0x17a0  WudfPf - ok
07:46:25.0492 0x17a0  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\drivers\WUDFRd.sys
07:46:25.0508 0x17a0  WUDFRd - ok
07:46:25.0508 0x17a0  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
07:46:25.0508 0x17a0  wudfsvc - ok
07:46:25.0523 0x17a0  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
07:46:25.0523 0x17a0  WwanSvc - ok
07:46:25.0523 0x17a0  ================ Scan global ===============================
07:46:25.0539 0x17a0  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
07:46:25.0539 0x17a0  [ 2313AF8D5A9CEB4A55400A01DD311A95, A5779FE967EA2703E86BEDC32CD736617AF278C72048228F038DFC628E1E0AA2 ] C:\Windows\system32\winsrv.dll
07:46:25.0539 0x17a0  [ 2313AF8D5A9CEB4A55400A01DD311A95, A5779FE967EA2703E86BEDC32CD736617AF278C72048228F038DFC628E1E0AA2 ] C:\Windows\system32\winsrv.dll
07:46:25.0554 0x17a0  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
07:46:25.0554 0x17a0  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
07:46:25.0554 0x17a0  [ Global ] - ok
07:46:25.0554 0x17a0  ================ Scan MBR ==================================
07:46:25.0554 0x17a0  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
07:46:25.0586 0x17a0  \Device\Harddisk0\DR0 - ok
07:46:25.0586 0x17a0  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
07:46:25.0664 0x17a0  \Device\Harddisk1\DR1 - ok
07:46:25.0664 0x17a0  ================ Scan VBR ==================================
07:46:25.0664 0x17a0  [ B8EA68E3B53C7CFA4E2120CADD3A6659 ] \Device\Harddisk0\DR0\Partition1
07:46:25.0664 0x17a0  \Device\Harddisk0\DR0\Partition1 - ok
07:46:25.0679 0x17a0  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk0\DR0\Partition2
07:46:25.0679 0x17a0  \Device\Harddisk0\DR0\Partition2 - ok
07:46:25.0679 0x17a0  [ B803934A05F1AA220D9EC2A2AC857F34 ] \Device\Harddisk0\DR0\Partition3
07:46:25.0679 0x17a0  \Device\Harddisk0\DR0\Partition3 - ok
07:46:25.0679 0x17a0  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk1\DR1\Partition1
07:46:25.0679 0x17a0  \Device\Harddisk1\DR1\Partition1 - ok
07:46:25.0679 0x17a0  [ 6846F155C1168DA447BD976F56F9E837 ] \Device\Harddisk1\DR1\Partition2
07:46:25.0742 0x17a0  \Device\Harddisk1\DR1\Partition2 - ok
07:46:25.0742 0x17a0  ================ Scan generic autorun ======================
07:46:25.0788 0x17a0  [ 35BA4E6632BA690EA6421C1E03537D0E, 99D6B4DB12ABE3A7F44AB1B2D626978E85231185AE280D9516986027BC8385CB ] C:\Program Files\Microsoft Security Client\msseces.exe
07:46:25.0820 0x17a0  MSC - ok
07:46:25.0820 0x17a0  Nvtmru - ok
07:46:25.0820 0x17a0  [ DD81D91FF3B0763C392422865C9AC12E, F5691B8F200E3196E6808E932630E862F8F26F31CD949981373F23C9D87DB8B9 ] C:\Windows\system32\rundll32.exe
07:46:25.0820 0x17a0  ShadowPlay - ok
07:46:25.0866 0x17a0  [ D5FFA9F81738C81253C0D3C7E03E3AB0, C908F7DAE626997128DEE511822245224BBA94C6C139DD284253EDBCE710D947 ] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
07:46:25.0898 0x17a0  NvBackend - ok
07:46:25.0976 0x17a0  [ 2C5C919C1147B91BA2B47527B709BDA5, 58E2D6DBF0A7023A56C1576A0E8915CB3F2D4ED72F0A0B3652F29009DD853BDE ] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
07:46:26.0038 0x17a0  HDAudDeck - ok
07:46:26.0054 0x17a0  [ 6BA8D86746935498D64CB5CF6286F2EB, E47D1DEE39451428344233DB15412BCB486C4F6FE1D0426F20AA4C6245387926 ] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
07:46:26.0054 0x17a0  USB3MON - ok
07:46:26.0054 0x17a0  [ 5514B64F7F2D25E09E2FDAF5D62B688C, 43263715ADC49250762A01E41DB2832C6A8B63CE4F66CDD8FC0B51DCA031DF27 ] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe
07:46:26.0069 0x17a0  IAStorIcon - ok
07:46:26.0069 0x17a0  [ 61E4289E91E88C90478D7F4BEB10DCF7, 1D0F4034E0111CF5758F470C15A22A0A28EB8269CB5BF07222C9C0FB07A15C55 ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
07:46:26.0069 0x17a0  APSDaemon - ok
07:46:26.0069 0x17a0  [ BAF535F843A3E790E04A7613811B55BC, 764608E1BC657FBBBB3E0DC5D36F0701CAA9D28BE15E416DF84AD3EFC7EB85D9 ] C:\Program Files (x86)\iTunes\iTunesHelper.exe
07:46:26.0085 0x17a0  iTunesHelper - ok
07:46:26.0085 0x17a0  [ 55514FE6B378640081C6F37280619D19, 1C4CD46D3FD12C29214AF3C89D50F63E062FBEEE929494A286E3C055E6E06045 ] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
07:46:26.0100 0x17a0  KiesTrayAgent - ok
07:46:26.0116 0x17a0  [ 3E04F1E482357B1FC8B088197C3D9FF8, 85524ADDC27ADC831EBBD24E079B412CFDC69E5F594BD153319087665A28D546 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
07:46:26.0132 0x17a0  Adobe ARM - ok
07:46:26.0147 0x17a0  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
07:46:26.0178 0x17a0  Sidebar - ok
07:46:26.0178 0x17a0  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
07:46:26.0178 0x17a0  mctadmin - ok
07:46:26.0210 0x17a0  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
07:46:26.0225 0x17a0  Sidebar - ok
07:46:26.0225 0x17a0  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
07:46:26.0241 0x17a0  mctadmin - ok
07:46:26.0288 0x17a0  [ D270652063855034758D65001715BDEE, 0EBF559AE8D6B54E4AC035042783D1FA30624F222D0F1E717C724845A082F2CE ] C:\Spiele\Origin\Origin.exe
07:46:26.0334 0x17a0  EADM - ok
07:46:26.0397 0x17a0  [ 8DACA62F3E15E45EBAF7AE51A609CBC1, 5FACF0EA36572E7228EB2808731ED00DD08B481937569E71C3A537D7E65022AD ] C:\Spiele\Steam\steam.exe
07:46:26.0444 0x17a0  Steam - ok
07:46:26.0459 0x17a0  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
07:46:26.0475 0x17a0  Sidebar - ok
07:46:26.0475 0x17a0  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
07:46:26.0490 0x17a0  mctadmin - ok
07:46:26.0506 0x17a0  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
07:46:26.0522 0x17a0  Sidebar - ok
07:46:26.0537 0x17a0  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
07:46:26.0537 0x17a0  mctadmin - ok
07:46:26.0537 0x17a0  Waiting for KSN requests completion. In queue: 122
07:46:27.0551 0x17a0  Waiting for KSN requests completion. In queue: 122
07:46:28.0565 0x17a0  Waiting for KSN requests completion. In queue: 122
07:46:29.0579 0x17a0  AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.8.204.0 ), 0x60000 ( disabled : updated )
07:46:29.0595 0x17a0  Win FW state via NFP2: enabled
07:46:31.0982 0x17a0  ============================================================
07:46:31.0982 0x17a0  Scan finished
07:46:31.0982 0x17a0  ============================================================
07:46:31.0982 0x0998  Detected object count: 0
07:46:31.0982 0x0998  Actual detected object count: 0

schrauber · 22.06.2015, 19:03

hi,

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Armer_Thor · 23.06.2015, 05:45

Die Skype.exe und der dazugehörige Regschlüssel wurde moniert und entfernt.

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 

1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.06.22.04
  rootkit: v2015.06.22.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17843
Profilname :: Profilname-DESKTOP 

[administrator]

22.06.2015 21:15:00
mbar-log-2015-06-22 (21-15-00).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | 

Drivers | MBR | Physical Sectors | 

Memory | Startup | Registry | File 

System | Heuristics/Extra | 

Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 435409
Time elapsed: 6 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 1
HKU\S-1-5-21-3184420333-268895486-

2121797410-1000\SOFTWARE\MICROSOFT

\WINDOWS\CURRENTVERSION\RUN|Skype 

(Trojan.Agent) -> Data: "C:\Users

\Profilname\AppData\Roaming\Skype

\Phone\Skype.exe" /nosplash /minimized 

-> Delete on reboot. 

[b5075b6291f938fe52325895af55b54b]

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 1
C:\Users\Profilname\AppData\Roaming

\Skype\Phone\Skype.exe (Trojan.Agent) 

-> Delete on reboot. 

[b5075b6291f938fe52325895af55b54b]

Physical Sectors Detected: 0
(No malicious items detected)

(end)

Nachtrag:
Viel wichtiger als die Säuberung von diesem System wäre mir möglichst viel über den Schädling zu erfahren.

Besonders 2 Dinge interessieren mich:
- Könnte der Zeitstempel vom erstellen der Skype.exe das infektionsdatum sein?
- Könnte man sich sowas allein über den Browser einfangen, oder muss direkt etwas ausgeführt bzw. auch etwas im UAC bestätigt worden sein ?

schrauber · 23.06.2015, 12:14

Geht beides, idR muss aber was ausgeführt werden.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Armer_Thor · 23.06.2015, 14:04

Erledigt.
ComboFix

Code:

ATTFilter

ComboFix 15-06-23.01 - Profilname 23.06.2015  14:35:01.1.8 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.16346.12943 [GMT 2:00]
ausgeführt von:: c:\users\Profilname\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}
SP: Microsoft Security Essentials *Disabled/Updated* {0C8D1929-27B2-688D-E114-9117BD2BB1B7}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\Temp\log.txt
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-05-23 bis 2015-06-23  ))))))))))))))))))))))))))))))
.
.
2015-06-23 12:37 . 2015-06-23 12:37	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-06-22 19:15 . 2015-06-22 19:15	--------	d-----w-	c:\programdata\Malwarebytes
2015-06-22 19:14 . 2015-06-23 01:30	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-06-22 19:14 . 2015-06-23 01:22	136408	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-06-22 19:14 . 2015-06-23 01:21	107736	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-06-22 16:40 . 2015-05-03 03:16	12214312	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CBB91686-84D4-4160-B09C-72BB60FCED12}\mpengine.dll
2015-06-21 06:21 . 2015-05-03 03:16	12214312	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2015-06-21 05:32 . 2015-06-21 05:33	--------	d-----w-	C:\FRST
2015-06-19 04:43 . 2015-06-19 04:43	--------	d-----w-	c:\programdata\Kaspersky Lab
2015-06-19 04:43 . 2015-06-19 04:43	--------	d-----w-	c:\program files (x86)\Kaspersky Lab
2015-06-18 07:43 . 2015-06-19 04:43	--------	d-----w-	c:\program files (x86)\Mozilla Thunderbird
2015-06-17 17:11 . 2015-03-26 18:19	1187344	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C16F8178-7726-46CE-8F28-3BA81772B85E}\gapaengine.dll
2015-06-02 13:37 . 2015-06-02 13:37	--------	d-----w-	c:\users\Profilname\AppData\Local\GWX
2015-05-26 19:33 . 2015-05-26 19:33	76152	----a-w-	c:\windows\system32\PnkBstrA.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-06-10 03:24 . 2012-08-02 18:56	140135120	----a-w-	c:\windows\system32\MRT.exe
2015-06-10 02:57 . 2012-08-02 18:10	778416	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2015-06-10 02:57 . 2012-08-02 18:10	142512	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2015-05-26 19:32 . 2012-08-03 08:50	226680	----a-w-	c:\windows\SysWow64\PnkBstrB.exe
2015-05-26 19:23 . 2012-08-03 08:50	214392	----a-w-	c:\windows\SysWow64\PnkBstrB.ex0
2015-05-25 18:01 . 2015-06-10 03:10	44032	----a-w-	c:\windows\apppatch\acwow64.dll
2015-05-13 06:52 . 2015-05-20 12:44	31552	----a-w-	c:\windows\system32\nvhdap64.dll
2015-05-13 06:52 . 2015-05-20 12:44	195912	----a-w-	c:\windows\system32\drivers\nvhda64v.sys
2015-05-13 06:52 . 2015-02-14 23:37	1558848	----a-w-	c:\windows\system32\nvhdagenco6420103.dll
2015-05-12 06:27 . 2015-05-20 12:44	982672	----a-w-	c:\windows\SysWow64\NvIFR.dll
2015-05-12 06:27 . 2015-05-20 12:44	974480	----a-w-	c:\windows\SysWow64\NvFBC.dll
2015-05-12 06:27 . 2015-05-20 12:44	939080	----a-w-	c:\windows\SysWow64\nvumdshim.dll
2015-05-12 06:27 . 2015-05-20 12:44	502896	----a-w-	c:\windows\system32\nvEncodeAPI64.dll
2015-05-12 06:27 . 2015-05-20 12:44	42718864	----a-w-	c:\windows\system32\nvcompiler.dll
2015-05-12 06:27 . 2015-05-20 12:44	408208	----a-w-	c:\windows\system32\NvIFROpenGL.dll
2015-05-12 06:27 . 2015-05-20 12:44	407296	----a-w-	c:\windows\SysWow64\nvEncodeAPI.dll
2015-05-12 06:27 . 2015-05-20 12:44	37741712	----a-w-	c:\windows\SysWow64\nvcompiler.dll
2015-05-12 06:27 . 2015-05-20 12:44	364176	----a-w-	c:\windows\SysWow64\NvIFROpenGL.dll
2015-05-12 06:27 . 2015-05-20 12:44	30478992	----a-w-	c:\windows\system32\nvoglv64.dll
2015-05-12 06:27 . 2015-05-20 12:44	2932368	----a-w-	c:\windows\system32\nvcuvid.dll
2015-05-12 06:27 . 2015-05-20 12:44	2599056	----a-w-	c:\windows\SysWow64\nvcuvid.dll
2015-05-12 06:27 . 2015-05-20 12:44	22945424	----a-w-	c:\windows\SysWow64\nvoglv32.dll
2015-05-12 06:27 . 2015-05-20 12:44	1898312	----a-w-	c:\windows\system32\nvdispco6435286.dll
2015-05-12 06:27 . 2015-05-20 12:44	176064	----a-w-	c:\windows\system32\nvinitx.dll
2015-05-12 06:27 . 2015-05-20 12:44	16145176	----a-w-	c:\windows\system32\nvopencl.dll
2015-05-12 06:27 . 2015-05-20 12:44	15858728	----a-w-	c:\windows\system32\nvd3dumx.dll
2015-05-12 06:27 . 2015-05-20 12:44	1557648	----a-w-	c:\windows\system32\nvdispgenco6435286.dll
2015-05-12 06:27 . 2015-05-20 12:44	154256	----a-w-	c:\windows\SysWow64\nvinit.dll
2015-05-12 06:27 . 2015-05-20 12:44	150832	----a-w-	c:\windows\system32\nvoglshim64.dll
2015-05-12 06:27 . 2015-05-20 12:44	14455296	----a-w-	c:\windows\system32\nvcuda.dll
2015-05-12 06:27 . 2015-05-20 12:44	13263568	----a-w-	c:\windows\SysWow64\nvopencl.dll
2015-05-12 06:27 . 2015-05-20 12:44	128512	----a-w-	c:\windows\SysWow64\nvoglshim32.dll
2015-05-12 06:27 . 2015-05-20 12:44	11790144	----a-w-	c:\windows\SysWow64\nvcuda.dll
2015-05-12 06:27 . 2015-05-20 12:44	1099808	----a-w-	c:\windows\system32\nvumdshimx.dll
2015-05-12 06:27 . 2015-05-20 12:44	10972304	----a-w-	c:\windows\system32\drivers\nvlddmkm.sys
2015-05-12 06:27 . 2015-05-20 12:44	1059984	----a-w-	c:\windows\system32\NvIFR64.dll
2015-05-12 06:27 . 2015-05-20 12:44	1050256	----a-w-	c:\windows\system32\NvFBC64.dll
2015-05-12 06:27 . 2014-03-20 21:02	12849056	----a-w-	c:\windows\SysWow64\nvd3dum.dll
2015-05-12 06:27 . 2013-11-01 17:54	15048816	----a-w-	c:\windows\SysWow64\nvwgf2um.dll
2015-05-12 06:27 . 2012-10-10 20:23	3363224	----a-w-	c:\windows\system32\nvapi64.dll
2015-05-12 06:27 . 2012-10-10 20:23	17540416	----a-w-	c:\windows\system32\nvwgf2umx.dll
2015-05-12 06:27 . 2012-10-10 20:22	2971776	----a-w-	c:\windows\SysWow64\nvapi.dll
2015-05-12 03:30 . 2012-08-02 18:16	937288	----a-w-	c:\windows\system32\nvvsvc.exe
2015-05-12 03:30 . 2012-08-02 18:16	62608	----a-w-	c:\windows\system32\nvshext.dll
2015-05-12 03:30 . 2012-08-02 18:16	385352	----a-w-	c:\windows\system32\nvmctray.dll
2015-05-12 03:30 . 2012-08-02 18:16	2558608	----a-w-	c:\windows\system32\nvsvcr.dll
2015-05-12 03:30 . 2012-08-02 18:16	6872392	----a-w-	c:\windows\system32\nvcpl.dll
2015-05-12 03:30 . 2012-08-02 18:16	3490448	----a-w-	c:\windows\system32\nvsvc64.dll
2015-05-12 02:34 . 2015-05-20 12:45	571024	----a-w-	c:\windows\SysWow64\nvStreaming.exe
2015-05-11 17:01 . 2012-08-02 18:16	4391871	----a-w-	c:\windows\system32\nvcoproc.bin
2015-05-08 00:35 . 2014-08-02 18:05	1316184	----a-w-	c:\windows\SysWow64\nvspbridge.dll
2015-05-08 00:35 . 2013-11-01 17:57	1316000	----a-w-	c:\windows\SysWow64\nvspcap.dll
2015-05-08 00:34 . 2014-08-02 18:05	1756424	----a-w-	c:\windows\system32\nvspbridge64.dll
2015-05-08 00:34 . 2013-11-01 17:57	1570672	----a-w-	c:\windows\system32\nvspcap64.dll
2015-05-01 13:17 . 2015-05-13 01:01	124112	----a-w-	c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-01 13:16 . 2015-05-13 01:01	102608	----a-w-	c:\windows\SysWow64\PresentationCFFRasterizerNative_v0300.dll
2015-04-20 03:17 . 2015-05-12 17:51	1179136	----a-w-	c:\windows\system32\FntCache.dll
2015-04-20 03:17 . 2015-05-12 17:51	1647104	----a-w-	c:\windows\system32\DWrite.dll
2015-04-20 02:56 . 2015-05-12 17:51	1250816	----a-w-	c:\windows\SysWow64\DWrite.dll
2015-04-18 03:10 . 2015-05-12 17:57	460800	----a-w-	c:\windows\system32\certcli.dll
2015-04-18 02:56 . 2015-05-12 17:57	342016	----a-w-	c:\windows\SysWow64\certcli.dll
2015-04-14 01:38 . 2015-04-14 01:38	1217192	----a-w-	c:\windows\SysWow64\FM20.DLL
2015-04-13 03:28 . 2015-05-12 17:52	328704	----a-w-	c:\windows\system32\services.exe
2015-04-08 03:29 . 2015-05-12 17:51	275456	----a-w-	c:\windows\system32\InkEd.dll
2015-04-08 03:29 . 2015-05-12 17:50	24576	----a-w-	c:\windows\system32\jnwmon.dll
2015-04-08 03:14 . 2015-05-12 17:51	216064	----a-w-	c:\windows\SysWow64\InkEd.dll
2015-03-26 18:19 . 2012-10-04 08:59	1187344	----a-w-	c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EADM"="c:\spiele\Origin\Origin.exe" [2015-06-03 3632472]
"Steam"="c:\spiele\Steam\steam.exe" [2015-06-04 2892992]
"KSS"="c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe" [2014-06-15 202080]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2012-05-23 5120144]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-03-26 291608]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIconLaunch.exe" [2012-02-29 56088]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-01 152392]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2014-12-17 311616]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-12-19 1022152]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys;c:\windows\SYSNATIVE\drivers\dgderdrv.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 JabraDFU;Jabra Bluecore DFU driver;c:\windows\system32\Drivers\JabraBcDfuX64.sys;c:\windows\SYSNATIVE\Drivers\JabraBcDfuX64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 Origin Client Service;Origin Client Service;c:\spiele\Origin\OriginClientService.exe;c:\spiele\Origin\OriginClientService.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VsEtwService120;Visual Studio ETW-Ereignisauflistungsdienst;c:\program files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe;c:\program files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [x]
R4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE;c:\program files\Microsoft SQL Server\100\Shared\SQLADHLP.EXE [x]
R4 RsFx0105;RsFx0105 Driver;c:\windows\system32\DRIVERS\RsFx0105.sys;c:\windows\SYSNATIVE\DRIVERS\RsFx0105.sys [x]
R4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE;c:\program files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [x]
S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
S0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys;c:\windows\SYSNATIVE\drivers\vsock.sys [x]
S2 bufssvr;bufssvr;c:\program files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe;c:\program files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe [x]
S2 DiagTrack;Diagnostics Tracking Service;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 KSS;Kaspersky Security Scan Service;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe;c:\program files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S2 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe [x]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2015-06-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-02 02:57]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2015-04-29 1337000]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2015-05-08 1570672]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2015-05-08 2685072]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
LSP: %windir%\system32\vsocklib.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-Nvtmru - c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-BattlEye for A2 - c:\spiele\Steam\steamapps\common\Arma 2BattlEye\UnInstallBE.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_160_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_18_0_0_160_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_160_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_18_0_0_160_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_160.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.18"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_160.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_160.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_18_0_0_160.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]
@Denied: (A 2) (Everyone)
@="IFlashBroker6"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-06-23  14:39:32
ComboFix-quarantined-files.txt  2015-06-23 12:39
.
Vor Suchlauf: 12 Verzeichnis(se), 96.305.872.896 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 102.920.863.744 Bytes frei
.
- - End Of File - - 7A86222A58A433A1008050C07F8CC6BD

schrauber · 24.06.2015, 06:36

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Armer_Thor · 24.06.2015, 23:01

mBAM

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 24.06.2015
Suchlauf-Zeit: 23:31:44
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.06.24.04
Rootkit Datenbank: v2015.06.22.01
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Profilname

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 456665
Verstrichene Zeit: 6 Min, 24 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 8
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{3408AC0D-510E-4808-8F7B-6B70B1F88534}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\WOW6432NODE\TYPELIB\{03771AEF-400D-4A13-B712-25878EC4A3F5}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 
PUP.Optional.Outbrowse, HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{6D4506CE-F855-4657-AA38-DB6B1F733982}, In Quarantäne, [7a0af3cb47438da966cc713ea26107f9], 

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 0
(Keine schädliche Elemente gefunden)

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

AdwCleaner

Code:

ATTFilter

# AdwCleaner v4.207 - Bericht erstellt 24/06/2015 um 23:50:47
# Aktualisiert 21/06/2015 von Xplode
# Datenbank : 2015-06-23.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Profilname - Profilname-DESKTOP
# Gestarted von : C:\Users\Profilname\Desktop\AdwCleaner_4.207.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\Common Files\Tobit
Ordner Gelöscht : C:\Users\Profilname\AppData\Roaming\Tobit

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}
Daten Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - *.local

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17840


-\\ Mozilla Firefox v27.0.1 (de)


*************************

AdwCleaner[R0].txt - [1672 Bytes] - [24/06/2015 23:49:22]
AdwCleaner[S0].txt - [1584 Bytes] - [24/06/2015 23:50:47]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1643  Bytes] ##########

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 7.1.2 (06.24.2015:2)
OS: Windows 7 Professional x64
Ran by Profilname on 24.06.2015 at 23:54:02,36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files

Successfully deleted: [File] C:\Program Files (x86)\mozilla firefox\defaults\pref\channel-prefs.js



~~~ Folders

Successfully deleted: [Folder] C:\Users\Profilname\appdata\local\crashrpt



~~~ FireFox






~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.06.2015 at 23:55:29,35
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

RST neu

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by Profilname (administrator) on Profilname-DESKTOP on 24-06-2015 23:57:07
Running from C:\Users\Profilname\Desktop
Loaded Profiles: Profilname (Available Profiles: Profilname)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-08] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5120144 2012-05-23] (VIA)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-12-17] (Samsung Electronics Co., Ltd.)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [EADM] => C:\Spiele\Origin\Origin.exe [3632472 2015-06-03] (Electronic Arts)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [Steam] => C:\Spiele\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3184420333-268895486-2121797410-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3184420333-268895486-2121797410-1000 -> DefaultScope {9F24406C-E1F8-4D62-B61C-4B0120CD5F63} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3184420333-268895486-2121797410-1000 -> {9F24406C-E1F8-4D62-B61C-4B0120CD5F63} URL = https://www.google.com/search?q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-06-23] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-06-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: AntiGameOrigin - C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default\Extensions\antigameorigin@antigame.de.xpi [2014-03-17]
FF Extension: NoScript - C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-08-02]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 bufssvr; C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe [90112 2010-03-12] (BUFFALO INC.) [File not signed]
S2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-08] (NVIDIA Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-10] (Intel Corporation)
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
S2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58387104 2014-07-12] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-08] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-08] (NVIDIA Corporation)
S3 Origin Client Service; C:\Spiele\Origin\OriginClientService.exe [1997168 2015-06-03] (Electronic Arts)
S2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2015-05-26] ()
S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] ()
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [441504 2014-07-12] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
S2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2012-05-04] (VIA Technologies, Inc.)
S2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe [79872 2012-11-01] (VMware, Inc.) [File not signed]
S3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 JabraDFU; C:\Windows\System32\Drivers\JabraBcDfuX64.sys [39288 2014-11-27] (GN Netcom A/S)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [136408 2015-06-24] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-24 23:57 - 2015-06-24 23:57 - 00000000 ____D C:\Users\Profilname\Desktop\FRST-OlderVersion
2015-06-24 23:55 - 2015-06-24 23:55 - 00000800 _____ C:\Users\Profilname\Desktop\JRT.txt
2015-06-24 23:54 - 2015-06-24 23:54 - 00000207 _____ C:\Windows\tweaking.com-regbackup-Profilname-DESKTOP-Windows-7-Professional-(64-bit).dat
2015-06-24 23:54 - 2015-06-24 23:54 - 00000000 ____D C:\RegBackup
2015-06-24 23:53 - 2015-06-24 23:53 - 02951785 _____ (Malwarebytes Corporation) C:\Users\Profilname\Desktop\JRT.exe
2015-06-24 23:47 - 2015-06-24 23:50 - 00000000 ____D C:\AdwCleaner
2015-06-24 23:47 - 2015-06-24 23:47 - 02244096 _____ C:\Users\Profilname\Desktop\AdwCleaner_4.207.exe
2015-06-24 23:31 - 2015-06-24 23:31 - 00000000 ____D C:\Users\Profilname\Desktop\Neuer Ordner
2015-06-24 23:24 - 2015-06-24 23:24 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Profilname\Desktop\mbam-setup-2.1.6.1022.exe
2015-06-24 23:24 - 2015-06-24 23:24 - 00001102 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-24 23:24 - 2015-06-24 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-06-24 23:24 - 2015-06-24 23:24 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-06-24 23:24 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-24 23:24 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-24 02:07 - 2015-06-24 02:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mIRC
2015-06-24 02:02 - 2015-06-24 02:02 - 00024244 _____ C:\ComboFix.txt
2015-06-23 14:32 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-23 14:32 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-23 14:32 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-23 14:29 - 2015-06-24 02:02 - 00000000 ____D C:\Qoobox
2015-06-23 14:29 - 2015-06-23 14:38 - 00000000 ____D C:\Windows\erdnt
2015-06-23 13:57 - 2015-06-23 13:57 - 05629494 ____R (Swearware) C:\Users\Profilname\Desktop\ComboFix.exe
2015-06-23 02:33 - 2015-06-23 02:33 - 00000000 ____H C:\Users\Profilname\Documents\Default.rdp
2015-06-22 21:15 - 2015-06-24 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-22 21:14 - 2015-06-24 23:51 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-22 21:14 - 2015-06-23 22:07 - 00000000 ____D C:\Users\Profilname\Desktop\mbar
2015-06-22 21:14 - 2015-06-23 22:07 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-06-22 21:14 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-22 21:13 - 2015-06-22 21:13 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Profilname\Desktop\mbar-1.09.1.1004.exe
2015-06-21 08:09 - 2015-06-21 08:09 - 00000000 _____ C:\Users\Profilname\Desktop\Neues Textdokument.txt
2015-06-21 07:33 - 2015-06-21 07:33 - 00059004 _____ C:\Users\Profilname\Desktop\Addition.txt
2015-06-21 07:32 - 2015-06-24 23:57 - 00012886 _____ C:\Users\Profilname\Desktop\FRST.txt
2015-06-21 07:32 - 2015-06-24 23:57 - 00000000 ____D C:\FRST
2015-06-21 07:31 - 2015-06-21 07:31 - 00000472 _____ C:\Users\Profilname\Desktop\defogger_disable.log
2015-06-21 07:31 - 2015-06-21 07:31 - 00000000 _____ C:\Users\Profilname\defogger_reenable
2015-06-21 07:29 - 2015-06-21 07:29 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Profilname\Desktop\tdsskiller.exe
2015-06-21 07:26 - 2015-06-24 23:57 - 02112512 _____ (Farbar) C:\Users\Profilname\Desktop\FRST64.exe
2015-06-21 07:26 - 2015-06-21 07:26 - 00050477 _____ C:\Users\Profilname\Desktop\Defogger.exe
2015-06-21 07:25 - 2015-06-21 07:25 - 00380416 _____ C:\Users\Profilname\Desktop\Gmer-if4hbj4t.exe
2015-06-21 07:22 - 2015-06-21 07:22 - 00000900 _____ C:\Unbenanntes Dokument
2015-06-21 07:14 - 2015-06-21 07:14 - 00000776 _____ C:\Unbenanntes Dokument~
2015-06-19 06:43 - 2015-06-19 06:43 - 00001077 _____ C:\Users\Profilname\Desktop\Kaspersky Security Scan.lnk
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-06-18 09:43 - 2015-06-19 06:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-06-10 05:10 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 05:10 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 05:10 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 05:10 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 05:10 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 05:10 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 05:10 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 05:10 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 05:10 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 05:10 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 05:10 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 05:10 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 05:10 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 05:10 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 05:10 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 05:10 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 05:10 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 05:10 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 05:10 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 05:10 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:10 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 05:10 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 05:10 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 05:10 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 05:10 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 05:10 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 05:10 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 05:10 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 05:10 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 05:10 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 05:10 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 05:10 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 05:10 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 05:10 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 05:10 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 05:10 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 05:10 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 05:10 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 05:10 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 05:10 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 05:10 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 05:10 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 05:10 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 05:10 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 05:10 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 05:10 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 05:10 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 05:10 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 05:10 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 05:10 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 05:10 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 05:10 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 05:10 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 05:10 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 05:10 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 05:10 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 05:10 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 05:10 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 05:10 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 05:10 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 05:10 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 05:10 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 05:10 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 05:10 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 05:10 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 05:10 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 05:10 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 05:10 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 05:10 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 05:10 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 05:10 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 05:10 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 05:10 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 05:10 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 05:10 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 05:10 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 05:10 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 05:10 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 05:10 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 05:10 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 05:10 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 05:10 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 05:10 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 05:10 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 05:10 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-02 15:37 - 2015-06-02 15:37 - 00000000 ____D C:\Users\Profilname\AppData\Local\GWX
2015-05-26 21:33 - 2015-05-26 21:33 - 00076152 _____ C:\Windows\system32\PnkBstrA.exe
2015-05-26 21:22 - 2015-05-26 21:22 - 01533584 _____ C:\Users\Profilname\Desktop\battlelog-web-plugins_2.6.2_157.exe

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-24 23:55 - 2009-07-14 19:58 - 00768288 _____ C:\Windows\system32\perfh007.dat
2015-06-24 23:55 - 2009-07-14 19:58 - 00176044 _____ C:\Windows\system32\perfc007.dat
2015-06-24 23:55 - 2009-07-14 07:13 - 01815528 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-24 23:54 - 2009-07-14 06:45 - 00026128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-24 23:54 - 2009-07-14 06:45 - 00026128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-24 23:51 - 2013-02-01 09:24 - 00000000 ____D C:\ProgramData\VMware
2015-06-24 23:51 - 2012-08-03 08:09 - 00000000 ____D C:\ProgramData\Origin
2015-06-24 23:51 - 2012-08-02 20:16 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-24 23:51 - 2012-08-02 16:22 - 00338740 _____ C:\Windows\PFRO.log
2015-06-24 23:51 - 2012-08-02 16:05 - 01814507 _____ C:\Windows\WindowsUpdate.log
2015-06-24 23:51 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-24 23:51 - 2009-07-14 06:51 - 00183053 _____ C:\Windows\setupact.log
2015-06-24 23:50 - 2012-08-02 20:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-24 23:23 - 2014-12-24 14:37 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 04:38 - 2014-01-09 16:32 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\mIRC
2015-06-24 04:09 - 2013-03-27 05:00 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\vlc
2015-06-24 02:01 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-23 23:50 - 2012-08-02 20:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-23 23:50 - 2012-08-02 20:10 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-23 23:50 - 2012-08-02 20:10 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-23 14:36 - 2013-05-12 06:44 - 00000000 ____D C:\ProgramData\TEMP
2015-06-22 06:30 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-21 07:31 - 2012-08-02 16:05 - 00000000 ____D C:\Users\Profilname
2015-06-19 20:15 - 2012-08-02 21:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-19 09:01 - 2012-08-02 21:12 - 00000000 ____D C:\Users\Profilname\AppData\Local\Thunderbird
2015-06-14 18:41 - 2013-03-15 02:57 - 00000000 ____D C:\Users\Profilname\AppData\Local\QuickPar
2015-06-13 17:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-13 13:39 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-11 04:22 - 2014-11-15 08:54 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieBrowserModeList
2015-06-11 04:22 - 2014-04-14 11:26 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieUserList
2015-06-11 04:22 - 2014-04-14 11:26 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieSiteList
2015-06-11 04:22 - 2009-07-14 06:45 - 00344912 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 04:21 - 2014-12-10 04:19 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 04:21 - 2014-04-29 15:00 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-11 04:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-10 05:28 - 2012-08-02 16:14 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-10 05:26 - 2013-08-14 03:00 - 00000000 ____D C:\Windows\system32\MRT
2015-06-10 05:24 - 2012-08-02 20:56 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 04:57 - 2014-06-14 19:59 - 00000000 ____D C:\Users\Profilname\AppData\Local\Adobe
2015-06-03 07:00 - 2012-08-03 08:08 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\Origin
2015-05-27 20:45 - 2012-10-09 11:39 - 00000000 ____D C:\Program Files (x86)\Battlelog Web Plugins
2015-05-26 21:32 - 2012-08-03 10:50 - 00226680 _____ C:\Windows\SysWOW64\PnkBstrB.exe
2015-05-26 21:23 - 2012-08-03 10:50 - 00214392 _____ C:\Windows\SysWOW64\PnkBstrB.ex0

==================== Files in the root of some directories =======

2013-04-07 16:45 - 2013-04-07 16:45 - 0000288 _____ () C:\Users\Profilname\AppData\Roaming\.backup.dm

Some files in TEMP:
====================
C:\Users\Profilname\AppData\Local\Temp\mirc741.exe
C:\Users\Profilname\AppData\Local\Temp\Quarantine.exe
C:\Users\Profilname\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-23 00:43

==================== End of log ============================

schrauber · 25.06.2015, 18:55

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Armer_Thor · 27.06.2015, 05:31

Offen sind nur noch wenige Fragen

- Welche Schädlinge waren / sind auf dem Computer ?
- Kannst du mir einen Lektüretipp geben, wenn man die ganzen Logs besser verstehen können möchte ?

Eset

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# end=init
# utc_time=2015-06-26 05:14:29
# local_time=2015-06-26 07:14:29 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
Update Finalize
Updated modules version: 24521
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# end=updated
# utc_time=2015-06-26 05:16:21
# local_time=2015-06-26 07:16:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# engine=24521
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-26 05:19:01
# local_time=2015-06-26 07:19:01 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 3024792 106632763 0 0
# scanned=11225
# found=0
# cleaned=0
# scan_time=158
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# end=init
# utc_time=2015-06-26 05:19:27
# local_time=2015-06-26 07:19:27 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
esets_scanner_update returned -1 esets_gle=53251
Update Finalize
Updated modules version: 24521
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# end=updated
# utc_time=2015-06-26 05:19:34
# local_time=2015-06-26 07:19:34 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# engine=24521
# end=stopped
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-26 05:50:30
# local_time=2015-06-26 07:50:30 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 3026681 106634652 0 0
# scanned=283982
# found=0
# cleaned=0
# scan_time=1855
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# end=init
# utc_time=2015-06-26 05:50:56
# local_time=2015-06-26 07:50:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
Update Init
Update Download
esets_scanner_update returned -1 esets_gle=53251
Update Finalize
Updated modules version: 24521
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# end=updated
# utc_time=2015-06-26 05:52:06
# local_time=2015-06-26 07:52:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# osver=6.1.7601 NT Service Pack 1
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7777
# api_version=3.1.1
# EOSSerial=bc3002d6a73cef489c6968dae0c2e915
# engine=24521
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-06-26 08:03:18
# local_time=2015-06-26 10:03:18 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 3034649 106642620 0 0
# scanned=368589
# found=2
# cleaned=0
# scan_time=7871
sh=A0037C3C3E60635D1714AC7119EE96693680B973 ft=1 fh=6db4d990e5cc9378 vn="Win32/Adware.WhenU.SaveNow evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\XP_Backup2009\Brennsoftware\daemon400.exe"
sh=1E96517A1E5B31A5F03A2EC27F8916035C70C054 ft=1 fh=0a066ab553cde119 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwÃ¼nschte Anwendung" ac=I fn="D:\XP_Backup2009\Brennsoftware\Alcohol\1.9.7.6221.exe\Alcohol120_trial_1.9.7.6221.exe"

SecurityCheck

Code:

ATTFilter

Results of screen317's Security Check version 1.004  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Microsoft Security Essentials   
  (On Access scanning disabled!) 
 Error obtaining update status for antivirus!  
`````````Anti-malware/Other Utilities Check:````````` 
 Visual Studio Extensions for Windows Library for JavaScript 
 Java version 32-bit out of Date! 
  Adobe Flash Player 17.0.0.190 Flash Player out of Date!  
 Adobe Reader XI  
 Mozilla Firefox 27.0.1 Firefox out of Date!  
 Mozilla Thunderbird (31.3.0) 
````````Process Check: objlist.exe by Laurent````````  
 Microsoft Security Essentials MSMpEng.exe 
 Microsoft Security Essentials msseces.exe 
 Kaspersky Lab Kaspersky Security Scan 2.0 kss.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

RST die 3.

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:24-06-2015
Ran by Profilname (administrator) on Profilname-DESKTOP on 27-06-2015 04:39:58
Running from C:\Users\Profilname\Desktop
Loaded Profiles: Profilname (Available Profiles: Profilname)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe
(BUFFALO INC.) C:\Program Files (x86)\BUFFALO\SLManagerEasy\Inputps.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
(Electronic Arts) C:\Spiele\Origin\Origin.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
() C:\Windows\System32\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
() C:\Users\Profilname\Desktop\0002 SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1337000 2015-04-30] (Microsoft Corporation)
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2685072 2015-05-08] (NVIDIA Corporation)
HKLM-x32\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [5120144 2012-05-23] (VIA)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2012-02-01] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-12-17] (Samsung Electronics Co., Ltd.)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [EADM] => C:\Spiele\Origin\Origin.exe [3632472 2015-06-03] (Electronic Arts)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [Steam] => C:\Spiele\Steam\steam.exe [2892992 2015-06-04] (Valve Corporation)
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\...\Run: [KSS] => C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-3184420333-268895486-2121797410-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-3184420333-268895486-2121797410-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-21-3184420333-268895486-2121797410-1000 -> DefaultScope {9F24406C-E1F8-4D62-B61C-4B0120CD5F63} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKU\S-1-5-21-3184420333-268895486-2121797410-1000 -> {9F24406C-E1F8-4D62-B61C-4B0120CD5F63} URL = https://www.google.com/search?q={searchTerms}
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_190.dll [2015-06-23] ()
FF Plugin: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelogx64.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_190.dll [2015-06-23] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2013-10-01] ()
FF Plugin-x32: @canon.com/EPPEX -> C:\Program Files (x86)\Canon\My Image Garden\AddOn\CIG\npmigfpi.dll [2011-11-30] (CANON INC.)
FF Plugin-x32: @esn/esnlaunch,version=1.140.0 -> C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File
FF Plugin-x32: @esn/esnlaunch,version=2.1.4 -> C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll No File
FF Plugin-x32: @esn/npbattlelog,version=2.6.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.6.2\npbattlelog.dll [2015-01-13] (EA Digital Illusions CE AB)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2012-01-06] (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll [2015-05-12] (NVIDIA Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF Extension: AntiGameOrigin - C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default\Extensions\antigameorigin@antigame.de.xpi [2014-03-17]
FF Extension: NoScript - C:\Users\Profilname\AppData\Roaming\Mozilla\Firefox\Profiles\p97wt5a4.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2012-08-02]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 bufssvr; C:\Program Files (x86)\BUFFALO\SLManagerEasy\Bufssvr.exe [90112 2010-03-12] (BUFFALO INC.) [File not signed]
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [1152656 2015-05-08] (NVIDIA Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-10] (Intel Corporation)
R2 KSS; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan 2.0\kss.exe [202080 2014-06-15] (Kaspersky Lab ZAO)
S2 MBAMScheduler; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamscheduler.exe [1871160 2015-04-14] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2015-04-30] (Microsoft Corporation)
R2 MSSQL$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [58387104 2014-07-12] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366544 2015-04-30] (Microsoft Corporation)
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1884304 2015-05-08] (NVIDIA Corporation)
R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [22997648 2015-05-08] (NVIDIA Corporation)
S3 Origin Client Service; C:\Spiele\Origin\OriginClientService.exe [1997168 2015-06-03] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76152 2015-05-26] ()
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] ()
S4 SQLAgent$SQLEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [441504 2014-07-12] (Microsoft Corporation)
R2 TeamViewer; C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe [5419792 2014-11-28] (TeamViewer GmbH)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27760 2012-05-04] (VIA Technologies, Inc.)
R2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Player\vmware-authd.exe [79872 2012-11-01] (VMware, Inc.) [File not signed]
S3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [89232 2014-07-22] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S3 JabraDFU; C:\Windows\System32\Drivers\JabraBcDfuX64.sys [39288 2014-11-27] (GN Netcom A/S)
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [104560 2012-04-25] (Qualcomm Atheros Co., Ltd.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [280376 2015-03-04] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124568 2015-03-04] (Microsoft Corporation)
R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [19600 2015-05-08] (NVIDIA Corporation)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [38032 2014-11-22] (NVIDIA Corporation)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [70296 2012-10-24] (VMware, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 dgderdrv; System32\drivers\dgderdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-27 04:36 - 2015-06-26 19:12 - 00852662 _____ C:\Users\Profilname\Desktop\0002 SecurityCheck.exe
2015-06-27 04:27 - 2015-06-27 04:27 - 00000484 _____ C:\Users\Profilname\Desktop\eset online.txt
2015-06-26 19:14 - 2015-06-26 19:14 - 00000000 ____D C:\Program Files (x86)\ESET
2015-06-26 19:14 - 2015-06-26 19:11 - 02870984 _____ (ESET) C:\Users\Profilname\Desktop\0001 esetsmartinstaller_deu.exe
2015-06-26 19:11 - 2015-06-26 19:12 - 00000000 ____D C:\Users\Profilname\Desktop\26.06.2015
2015-06-24 23:57 - 2015-06-24 23:57 - 00000000 ____D C:\Users\Profilname\Desktop\FRST-OlderVersion
2015-06-24 23:55 - 2015-06-24 23:55 - 00000800 _____ C:\Users\Profilname\Desktop\JRT.txt
2015-06-24 23:54 - 2015-06-24 23:54 - 00000207 _____ C:\Windows\tweaking.com-regbackup-Profilname-DESKTOP-Windows-7-Professional-(64-bit).dat
2015-06-24 23:54 - 2015-06-24 23:54 - 00000000 ____D C:\RegBackup
2015-06-24 23:53 - 2015-06-24 23:53 - 02951785 _____ (Malwarebytes Corporation) C:\Users\Profilname\Desktop\JRT.exe
2015-06-24 23:47 - 2015-06-24 23:50 - 00000000 ____D C:\AdwCleaner
2015-06-24 23:47 - 2015-06-24 23:47 - 02244096 _____ C:\Users\Profilname\Desktop\AdwCleaner_4.207.exe
2015-06-24 23:31 - 2015-06-24 23:31 - 00000000 ____D C:\Users\Profilname\Desktop\Neuer Ordner
2015-06-24 23:24 - 2015-06-24 23:24 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Profilname\Desktop\mbam-setup-2.1.6.1022.exe
2015-06-24 23:24 - 2015-06-24 23:24 - 00001102 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-06-24 23:24 - 2015-06-24 23:24 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-06-24 23:24 - 2015-06-24 23:24 - 00000000 ____D C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-06-24 23:24 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-06-24 23:24 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-06-24 02:07 - 2015-06-24 02:07 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\mIRC
2015-06-24 02:02 - 2015-06-24 02:02 - 00024244 _____ C:\ComboFix.txt
2015-06-23 14:32 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2015-06-23 14:32 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2015-06-23 14:32 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2015-06-23 14:32 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2015-06-23 14:29 - 2015-06-24 02:02 - 00000000 ____D C:\Qoobox
2015-06-23 14:29 - 2015-06-23 14:38 - 00000000 ____D C:\Windows\erdnt
2015-06-23 13:57 - 2015-06-23 13:57 - 05629494 ____R (Swearware) C:\Users\Profilname\Desktop\ComboFix.exe
2015-06-23 02:33 - 2015-06-23 02:33 - 00000000 ____H C:\Users\Profilname\Documents\Default.rdp
2015-06-22 21:15 - 2015-06-24 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2015-06-22 21:14 - 2015-06-26 18:47 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-06-22 21:14 - 2015-06-23 22:07 - 00000000 ____D C:\Users\Profilname\Desktop\mbar
2015-06-22 21:14 - 2015-06-23 22:07 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-06-22 21:14 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-06-22 21:13 - 2015-06-22 21:13 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Profilname\Desktop\mbar-1.09.1.1004.exe
2015-06-21 08:09 - 2015-06-21 08:09 - 00000000 _____ C:\Users\Profilname\Desktop\Neues Textdokument.txt
2015-06-21 07:33 - 2015-06-21 07:33 - 00059004 _____ C:\Users\Profilname\Desktop\Addition.txt
2015-06-21 07:32 - 2015-06-27 04:39 - 00015459 _____ C:\Users\Profilname\Desktop\FRST.txt
2015-06-21 07:32 - 2015-06-27 04:39 - 00000000 ____D C:\FRST
2015-06-21 07:31 - 2015-06-21 07:31 - 00000472 _____ C:\Users\Profilname\Desktop\defogger_disable.log
2015-06-21 07:31 - 2015-06-21 07:31 - 00000000 _____ C:\Users\Profilname\defogger_reenable
2015-06-21 07:29 - 2015-06-21 07:29 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Profilname\Desktop\tdsskiller.exe
2015-06-21 07:26 - 2015-06-24 23:57 - 02112512 _____ (Farbar) C:\Users\Profilname\Desktop\FRST64.exe
2015-06-21 07:26 - 2015-06-21 07:26 - 00050477 _____ C:\Users\Profilname\Desktop\Defogger.exe
2015-06-21 07:25 - 2015-06-21 07:25 - 00380416 _____ C:\Users\Profilname\Desktop\Gmer-if4hbj4t.exe
2015-06-21 07:22 - 2015-06-21 07:22 - 00000900 _____ C:\Unbenanntes Dokument
2015-06-21 07:14 - 2015-06-21 07:14 - 00000776 _____ C:\Unbenanntes Dokument~
2015-06-19 06:43 - 2015-06-19 06:43 - 00001077 _____ C:\Users\Profilname\Desktop\Kaspersky Security Scan.lnk
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Kaspersky Security Scan
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2015-06-19 06:43 - 2015-06-19 06:43 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2015-06-18 09:43 - 2015-06-19 06:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2015-06-10 05:10 - 2015-06-01 21:16 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-06-10 05:10 - 2015-06-01 20:07 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-06-10 05:10 - 2015-05-27 16:35 - 24917504 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-06-10 05:10 - 2015-05-27 16:08 - 19607040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-06-10 05:10 - 2015-05-25 20:24 - 05569984 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-06-10 05:10 - 2015-05-25 20:23 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-06-10 05:10 - 2015-05-25 20:23 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-06-10 05:10 - 2015-05-25 20:21 - 01728960 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01255424 _____ (Microsoft Corporation) C:\Windows\system32\diagtrack.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 01162752 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00728576 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00113664 _____ (Microsoft Corporation) C:\Windows\system32\sechost.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2015-06-10 05:10 - 2015-05-25 20:19 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00879104 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\tracerpt.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00104448 _____ (Microsoft Corporation) C:\Windows\system32\logman.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\typeperf.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\relog.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-06-10 05:10 - 2015-05-25 20:18 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-06-10 05:10 - 2015-05-25 20:18 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\diskperf.exe
2015-06-10 05:10 - 2015-05-25 20:14 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-06-10 05:10 - 2015-05-25 20:14 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:11 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 20:07 - 03989440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-06-10 05:10 - 2015-05-25 20:07 - 03934144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-06-10 05:10 - 2015-05-25 20:04 - 01310744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00641536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00635392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00551424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00092160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sechost.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-06-10 05:10 - 2015-05-25 20:01 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2015-06-10 05:10 - 2015-05-25 20:00 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tracerpt.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00082944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\logman.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00040448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\typeperf.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00037888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\relog.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2015-06-10 05:10 - 2015-05-25 20:00 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\diskperf.exe
2015-06-10 05:10 - 2015-05-25 19:59 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-06-10 05:10 - 2015-05-25 19:59 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2015-06-10 05:10 - 2015-05-25 19:57 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-06-10 05:10 - 2015-05-25 19:57 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:55 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 19:08 - 03206144 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-06-10 05:10 - 2015-05-25 19:00 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\UtcResources.dll
2015-06-10 05:10 - 2015-05-25 18:50 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2015-06-10 05:10 - 2015-05-25 18:50 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2015-06-10 05:10 - 2015-05-25 18:48 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2015-06-10 05:10 - 2015-05-25 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2015-06-10 05:10 - 2015-05-23 05:28 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-06-10 05:10 - 2015-05-23 05:15 - 00503808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-06-10 05:10 - 2015-05-23 05:15 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-06-10 05:10 - 2015-05-23 05:15 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-06-10 05:10 - 2015-05-23 05:14 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-06-10 05:10 - 2015-05-23 05:13 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-06-10 05:10 - 2015-05-23 05:10 - 02278912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-06-10 05:10 - 2015-05-23 05:09 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-06-10 05:10 - 2015-05-23 05:08 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-06-10 05:10 - 2015-05-23 05:06 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-06-10 05:10 - 2015-05-23 05:05 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-06-10 05:10 - 2015-05-23 05:05 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-06-10 05:10 - 2015-05-23 05:04 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-06-10 05:10 - 2015-05-23 04:57 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-06-10 05:10 - 2015-05-23 04:52 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-06-10 05:10 - 2015-05-23 04:49 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-06-10 05:10 - 2015-05-23 04:48 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-06-10 05:10 - 2015-05-23 04:47 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-06-10 05:10 - 2015-05-23 04:47 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-06-10 05:10 - 2015-05-23 04:38 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-06-10 05:10 - 2015-05-23 04:37 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-06-10 05:10 - 2015-05-23 04:37 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-06-10 05:10 - 2015-05-23 04:28 - 12829696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-06-10 05:10 - 2015-05-23 04:20 - 01950720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-06-10 05:10 - 2015-05-23 04:16 - 01309696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-06-10 05:10 - 2015-05-23 04:14 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-06-10 05:10 - 2015-05-22 21:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-06-10 05:10 - 2015-05-22 21:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-06-10 05:10 - 2015-05-22 21:01 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-06-10 05:10 - 2015-05-22 21:00 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-06-10 05:10 - 2015-05-22 21:00 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-06-10 05:10 - 2015-05-22 20:59 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-06-10 05:10 - 2015-05-22 20:53 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-06-10 05:10 - 2015-05-22 20:52 - 06026240 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-06-10 05:10 - 2015-05-22 20:52 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-06-10 05:10 - 2015-05-22 20:48 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-06-10 05:10 - 2015-05-22 20:47 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-06-10 05:10 - 2015-05-22 20:47 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-06-10 05:10 - 2015-05-22 20:40 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-06-10 05:10 - 2015-05-22 20:36 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-06-10 05:10 - 2015-05-22 20:29 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-06-10 05:10 - 2015-05-22 20:25 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-06-10 05:10 - 2015-05-22 20:24 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-06-10 05:10 - 2015-05-22 20:21 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 01021440 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00757248 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00700416 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00423424 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-06-10 05:10 - 2015-05-22 20:18 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-06-10 05:10 - 2015-05-22 20:13 - 01119232 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-06-10 05:10 - 2015-05-22 20:07 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-06-10 05:10 - 2015-05-22 20:06 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-06-10 05:10 - 2015-05-22 20:05 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-06-10 05:10 - 2015-05-22 20:05 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-06-10 05:10 - 2015-05-22 19:57 - 14404096 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-06-10 05:10 - 2015-05-22 19:50 - 02426880 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-06-10 05:10 - 2015-05-22 19:38 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-06-10 05:10 - 2015-05-22 19:26 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-06-10 05:10 - 2015-05-21 15:19 - 00193536 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2015-06-10 05:10 - 2015-04-29 20:22 - 14635008 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-06-10 05:10 - 2015-04-29 20:21 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-06-10 05:10 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-06-10 05:10 - 2015-04-29 20:21 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-06-10 05:10 - 2015-04-29 20:19 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-06-10 05:10 - 2015-04-29 20:07 - 11411456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-06-10 05:10 - 2015-04-29 20:07 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-06-10 05:10 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-06-10 05:10 - 2015-04-29 20:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-06-10 05:10 - 2015-04-29 20:05 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-06-10 05:10 - 2015-04-24 20:17 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2015-06-10 05:10 - 2015-04-24 19:56 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
2015-06-10 05:10 - 2015-04-11 05:19 - 00069888 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\stream.sys
2015-06-02 15:37 - 2015-06-02 15:37 - 00000000 ____D C:\Users\Profilname\AppData\Local\GWX

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-06-27 04:15 - 2009-07-14 06:45 - 00026128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-06-27 04:15 - 2009-07-14 06:45 - 00026128 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-06-27 03:50 - 2012-08-02 20:10 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-06-27 03:00 - 2012-08-02 16:05 - 01898830 _____ C:\Windows\WindowsUpdate.log
2015-06-26 19:22 - 2009-07-14 19:58 - 00768288 _____ C:\Windows\system32\perfh007.dat
2015-06-26 19:22 - 2009-07-14 19:58 - 00176044 _____ C:\Windows\system32\perfc007.dat
2015-06-26 19:22 - 2009-07-14 07:13 - 01815528 _____ C:\Windows\system32\PerfStringBackup.INI
2015-06-26 18:48 - 2012-08-03 08:09 - 00000000 ____D C:\ProgramData\Origin
2015-06-26 18:47 - 2013-02-01 09:24 - 00000000 ____D C:\ProgramData\VMware
2015-06-26 18:47 - 2012-08-02 20:16 - 00000000 ____D C:\ProgramData\NVIDIA
2015-06-26 18:47 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2015-06-26 18:47 - 2009-07-14 06:51 - 00183389 _____ C:\Windows\setupact.log
2015-06-24 23:51 - 2012-08-02 16:22 - 00338740 _____ C:\Windows\PFRO.log
2015-06-24 23:23 - 2014-12-24 14:37 - 00003886 _____ C:\Windows\System32\Tasks\Adobe Acrobat Update Task
2015-06-24 04:38 - 2014-01-09 16:32 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\mIRC
2015-06-24 04:09 - 2013-03-27 05:00 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\vlc
2015-06-24 02:01 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2015-06-23 23:50 - 2012-08-02 20:10 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-06-23 23:50 - 2012-08-02 20:10 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-06-23 23:50 - 2012-08-02 20:10 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-06-23 14:36 - 2013-05-12 06:44 - 00000000 ____D C:\ProgramData\TEMP
2015-06-22 06:30 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2015-06-21 07:31 - 2012-08-02 16:05 - 00000000 ____D C:\Users\Profilname
2015-06-19 20:15 - 2012-08-02 21:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2015-06-19 09:01 - 2012-08-02 21:12 - 00000000 ____D C:\Users\Profilname\AppData\Local\Thunderbird
2015-06-14 18:41 - 2013-03-15 02:57 - 00000000 ____D C:\Users\Profilname\AppData\Local\QuickPar
2015-06-13 17:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2015-06-13 13:39 - 2009-07-14 06:57 - 00001547 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-06-11 04:22 - 2014-11-15 08:54 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieBrowserModeList
2015-06-11 04:22 - 2014-04-14 11:26 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieUserList
2015-06-11 04:22 - 2014-04-14 11:26 - 00000000 __SHD C:\Users\Profilname\AppData\Local\EmieSiteList
2015-06-11 04:22 - 2009-07-14 06:45 - 00344912 _____ C:\Windows\system32\FNTCACHE.DAT
2015-06-11 04:21 - 2014-12-10 04:19 - 00000000 ____D C:\Windows\system32\appraiser
2015-06-11 04:21 - 2014-04-29 15:00 - 00000000 ___SD C:\Windows\system32\CompatTel
2015-06-11 04:21 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2015-06-10 05:28 - 2012-08-02 16:14 - 00000000 ____D C:\ProgramData\Microsoft Help
2015-06-10 05:26 - 2013-08-14 03:00 - 00000000 ____D C:\Windows\system32\MRT
2015-06-10 05:24 - 2012-08-02 20:56 - 140135120 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-06-10 04:57 - 2014-06-14 19:59 - 00000000 ____D C:\Users\Profilname\AppData\Local\Adobe
2015-06-03 07:00 - 2012-08-03 08:08 - 00000000 ____D C:\Users\Profilname\AppData\Roaming\Origin

==================== Files in the root of some directories =======

2013-04-07 16:45 - 2013-04-07 16:45 - 0000288 _____ () C:\Users\Profilname\AppData\Roaming\.backup.dm

Some files in TEMP:
====================
C:\Users\Profilname\AppData\Local\Temp\mirc741.exe
C:\Users\Profilname\AppData\Local\Temp\Quarantine.exe
C:\Users\Profilname\AppData\Local\Temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-06-23 00:43

==================== End of log ============================

Auszüge aus SecurityCheck

Code:

ATTFilter

Microsoft Security Essentials   
  (On Access scanning disabled!) 
 Error obtaining update status for antivirus!  
`````````Anti-malware/Other Utilities Check:`````````

-Wurde vor dem Ausführen der hier genannten Programme manuell deaktiviert.

Code:

ATTFilter

Results of screen317's Security Check version 1.004  
 Windows 7 Service Pack 1 x64 (UAC is disabled!)

Kann ich mir absolut nicht erklären!?

schrauber · 27.06.2015, 08:47

Was kannste dir nicht erklären?

Java, Flash und Firefox updaten. Neben der Adware war auch noch ein alter Ransomware auf dem Rechner.

Ne Lektüre gibt es da nicht, das ist ne richtige Ausbildung

Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:

NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie

.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Armer_Thor · 27.06.2015, 10:06

Nochmals vielen Dank! Auch für die Tipps für die Zukunft.

Ich kann mir nicht erklären wieso das UAC deaktiviert ist.

Abschließend nur noch eine Frage: Adware und Ransomware - klingt nicht dannach als könnten darüber meine Kennwörter in fremde Hände gelangt sein, oder irre ich mich ?

Insgeheim hatte ich gehofft einen Keylogger o.ä. zu finden damit geklärt wäre wie "alles" passiet ist.

Feedback folgt und eine Spende kommt sobald ich wieder vor dem eigenen Computer sitze.

schrauber · 27.06.2015, 18:15

Naja, so pauschal kannste das nicht sagen. Selbst bei Adware gehen heute teilweise PW weg. Ist ja nur ein weiterer Baukasten, den Du deiner Malware/Adware hinzufügen musst.

PW ändern bei Befall ist immer Pflicht.

Datenleck Aufspüren PC2

Log-Analyse und Auswertung: Datenleck Aufspüren PC2